CONTEXT-BASED SECURITY SCREENING FOR ACCESSING DATA

• US 20160335449A1
• Filed: 07/29/2016
• Published: 11/17/2016
• Est. Priority Date: 11/19/2012
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: ADAMS, Samuel S., FRIEDLANDER, Robert R., KRAEMER, James R., LINTON, Jeb R.
• Granted Patent: US 9,811,683 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS

Abstract

A computer system securely accesses a specific data store. A non-contextual data object is associated with a context object to define a first synthetic context-based object. The non-contextual data object ambiguously describes multiple types of persons, and the context object provides a circumstantial context that identifies a specific type of person from the multiple types of persons. The first synthetic context-based object is associated with at least one specific data store in a data structure. A string of binary data that describes a requester of data, including a time window for receipt and security level of the requester, is received by the computer system for generating a new synthetic context-based object. If there is a match between the new synthetic context-based object, the first synthetic context-based object, and the security level of the requester, then the data is returned to the requester by the computer system.

Claims

1. A computer system comprising:

one or more processors;

one or more computer readable memories; and

one or more non-transitory computer readable storage mediums, wherein program instructions are stored on at least one of the one or more non-transitory storage mediums for execution by at least one of the one or more processors via at least one of the one or more computer readable memories to perform a method comprising;

associating a first non-contextual data object with a first context object to define a first synthetic context-based object, wherein the first non-contextual data object describes multiple types of persons, wherein the first context object provides a context that identifies a specific type of person from the multiple types of persons, and wherein the first context object further describes a location of a computer that is being used by a requester of data as being a public Wi-Fi hot spot that provides the computer with access to a network;

associating the first synthetic context-based object with at least one specific data store in a data structure;

receiving a string of binary data that describes a request, from the requester, for data from said at least one specific data store in the data structure;

determining the context according to the physical location of the computer being used, by the requester, to send the request to a security module;

generating a new synthetic context-based object for the requester;

determining whether the new synthetic context-based object matches the first synthetic context-based object;

in response to determining that the new synthetic context-based object matches the first synthetic context-based object, locating, via the first synthetic context-based object, said at least one specific data store;

providing the requester access to said at least one specific data store;

constructing a dimensionally constrained hierarchical synthetic context-based object library for multiple synthetic context-based objects, wherein synthetic context-based objects within a same dimension of the dimensionally constrained hierarchical synthetic context-based object library share data from a same non-contextual data object, and wherein synthetic context-based objects within the same dimension of the dimensionally constrained hierarchical synthetic context-based object library contain disparate data from different context objects;

receiving the request for data from at least one data store that is associated with synthetic context-based objects within the same dimension of the dimensionally constrained hierarchical synthetic context-based object library;

receiving a time window for receiving the data from said at least one data store that is associated with synthetic context-based objects within the same dimension of the dimensionally constrained hierarchical synthetic context-based object library, wherein the time window describes an amount of time that the requester of data is willing to wait for at least one data store that is associated with synthetic context-based objects within the same dimension of the dimensionally constrained hierarchical synthetic context-based object library;

determining a security level of the requester based on the time window received from the requester, wherein a longer time window is indicative of a higher security level for the requester than a relatively shorter time window;

matching, based on the time window for the requester, the security level of the requester to data from said at least one specific data store that is associated with synthetic context-based objects within the same dimension of the dimensionally constrained hierarchical synthetic context-based object library; and

returning, to the requester, data from said at least one specific data store that is associated with synthetic context-based objects within the same dimension of the dimensionally constrained hierarchical synthetic context-based object library and that matches the security level of the requester.

2. The computer system of claim 1, wherein the method further comprises:

blocking the requester from accessing data stores other than said at least one specific data store in the data structure.

3. The computer system of claim 1, wherein the method further comprises:

further determining the context according to a current activity of the requester, wherein the current activity is not based on a role or title of the requester.

4. The computer system of claim 1, wherein the method further comprises:

further determining the context according to a professional certification possessed by the requester.

5. The computer system of claim 1, wherein said at least one specific data store is owned by an enterprise, and wherein the requester is an employee of the enterprise, and wherein the method further comprises:

further determining the context according to a length of time that the requester has been an employee of the enterprise.

6. The computer system of claim 1, wherein said at least one specific data store is owned by an enterprise, and wherein the method further comprises:

further determining the context according to whether the requester is a full time employee of the enterprise, a contract employee of the enterprise, or a non-employee of the enterprise.

7. The computer system of claim 1, wherein the method further comprises:

further determining the context of the requester by data mining a database that describes current interests of the requester.

8. The computer system of claim 1, wherein the method further comprises:

further determining the context of the requester by data mining a database that describes an educational background of the requester.

9. The computer system of claim 1, wherein the method further comprises:

associating a second non-contextual data object with a second context object to define a second synthetic context-based object, wherein the second non-contextual data object relates to multiple subject-matters, and wherein the second context object provides a context that identifies a specific subject-matter, from the multiple subject-matters, of the second non-contextual data object;

associating the second synthetic context-based object with said at least one specific data store in the data structure;

associating the second synthetic context-based object with the first synthetic context-based object; and

accessing said at least one specific data store by accessing the second synthetic context-based object via the first synthetic context-based object.

10. The computer system of claim 9, wherein said at least one specific data store is a text document, and wherein the method further comprises:

searching the text document for text data that is part of the second synthetic context-based object; and

associating the text document that contains said text data with the second synthetic context-based object.

11. The computer system of claim 9, wherein said at least one specific data store is a video file, and wherein the method further comprises:

searching metadata associated with the video file for text data that is part of the second synthetic context-based object; and

associating the video file having said metadata with the second synthetic context-based object.

12. The computer system of claim 9, wherein said at least one specific data store is a web page, and wherein the method further comprises:

searching the web page for text data that is part of the second synthetic context-based object; and

associating the web page that contains said text data with the second synthetic context-based object.

13. A computer system comprising:

one or more processors;

one or more computer readable memories; and

one or more non-transitory computer readable storage mediums, wherein program instructions are stored on at least one of the one or more non-transitory storage mediums for execution by at least one of the one or more processors via at least one of the one or more computer readable memories to perform a method comprising;

associating a first non-contextual data object with a first context object to define a first synthetic context-based object, wherein the first non-contextual data object relates to multiple subject-matters and describes multiple types of persons, wherein the first context object provides a context that identifies a specific type of person from the multiple types of persons, and wherein the first context object further describes a location of a computer that is being used by a requester of data as being a public Wi-Fi hot spot that provides the computer with access to a network;

associating the first synthetic context-based object with at least one specific data store in a data structure;

receiving a string of binary data that describes the requester of data from said at least one specific data store in the data structure;

generating a new synthetic context-based object for the requester;

determining whether the new synthetic context-based object matches the first synthetic context-based object;

in response to determining that the new synthetic context-based object matches the first synthetic context-based object, locating, via the first synthetic context-based object, said at least one specific data store;

providing the requester access to said at least one specific data store;

constructing a dimensionally constrained hierarchical synthetic context-based object library for multiple synthetic context-based objects, wherein synthetic context-based objects within a same dimension of the dimensionally constrained hierarchical synthetic context-based object library share data from a same non-contextual data object, and wherein synthetic context-based objects within the same dimension of the dimensionally constrained hierarchical synthetic context-based object library contain disparate data from different context objects;

receiving, from the requester, a request for at least one data store that is associated with synthetic context-based objects within the same dimension of the dimensionally constrained hierarchical synthetic context-based object library;

receiving, from the requester, a time window for receiving the data from said at least one data store that is associated with synthetic context-based objects within the same dimension of the dimensionally constrained hierarchical synthetic context-based object library, wherein the time window describes an amount of time that the requester of data is willing to wait for at least one data store that is associated with synthetic context-based objects within the same dimension of the dimensionally constrained hierarchical synthetic context-based object library;

determining a security level of the requester based on the time window received from the requester, wherein a longer time window is indicative of a higher security level for the requester than a relatively shorter time window;

matching, based on the time window for the requester, the security level of the requester to data from said at least one specific data store that is associated with synthetic context-based objects within the same dimension of the dimensionally constrained hierarchical synthetic context-based object library; and

returning, to the requester, data from said at least one specific data store that is associated with synthetic context-based objects within the same dimension of the dimensionally constrained hierarchical synthetic context-based object library and that matches the security level of the requester.

14. A computer system comprising:

one or more processors;

one or more computer readable memories; and

one or more non-transitory computer readable storage mediums, wherein program instructions are stored on at least one of the one or more non-transitory storage mediums for execution by at least one of the one or more processors via at least one of the one or more computer readable memories to perform a method comprising;

associating a first non-contextual data object with a first context object to define a first synthetic context-based object, wherein the first non-contextual data object describes multiple types of persons, and wherein the first context object provides a context that identifies a specific type of person from the multiple types of persons;

associating the first synthetic context-based object with at least one specific data store in a data structure;

receiving a string of binary data that describes a requester of data from said at least one specific data store in the data structure;

determining the context according to a physical location of a computer being used, by the requester, to send the request to the security module;

generating a new synthetic context-based object for the requester;

determining whether the new synthetic context-based object matches the first synthetic context-based object;

in response to determining that the new synthetic context-based object matches the first synthetic context-based object, locating, via the first synthetic context-based object, said at least one specific data store;

providing the requester access to said at least one specific data store;

constructing a dimensionally constrained hierarchical synthetic context-based object library for multiple synthetic context-based objects, wherein synthetic context-based objects within a same dimension of the dimensionally constrained hierarchical synthetic context-based object library share data from a same non-contextual data object, and wherein synthetic context-based objects within the same dimension of the dimensionally constrained hierarchical synthetic context-based object library contain disparate data from different context objects;

receiving, from the requester, the request for data from at least one data store that is associated with synthetic context-based objects within the same dimension of the dimensionally constrained hierarchical synthetic context-based object library; and

returning, to the requester, data from said at least one specific data store that is associated with synthetic context-based objects within the same dimension of the dimensionally constrained hierarchical synthetic context-based object library.

15. The computer system of claim 14, wherein the method further comprises:

blocking the requester from accessing data stores other than said at least one specific data store in the data structure.

16. The computer system of claim 14, wherein the method further comprises:

further determining the context according to a current activity of the requester, wherein the current activity is not based on a role or title of the requester.

17. The computer system of claim 14, wherein the method further comprises:

further determining the context according to a professional certification possessed by the requester.

18. The computer system of claim 14, wherein the method further comprises:

further determining the context according to a time window within which data from said at least one specific data store must be returned to the requester.

19. The computer system of claim 14, wherein said at least one specific data store is owned by an enterprise, and wherein the requester is an employee of the enterprise, and wherein the method further comprises:

further determining the context according to a length of time that the requester has been an employee of the enterprise.

20. The computer system of claim 14, wherein said at least one specific data store is owned by an enterprise, and wherein the method further comprises:

further determining the context according to whether the requester is a full time employee of the enterprise, a contract employee of the enterprise, or a non-employee of the enterprise.