Method and system for implementing changes to security policies in a distributed security system

• US 7,565,683 B1
• Filed: 06/26/2002
• Issued: 07/21/2009
• Est. Priority Date: 12/12/2001
• Status: Expired due to Term

• Current Assignee: Intellectual Ventures I LLC (Intellectual Ventures LLC)
• Original Assignee: Guardian Data Storage LLC
• Inventors: Supramaniam, Senthilvasan, Vainstein, Klimenty, Huang, Weiqing
• Primary Examiner(s): Revak; Christopher A
• Application Number:
  US10/186,203
• Time in Patent Office: 2,582 Days
• Field of Search: 726/1
• US Class Current: 726/1
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

Improved approaches for effectuating changes to security policies in a distributed security system are disclosed. The changes to security policies are distributed to those users (e.g., user and/or computers) in the security system that are affected. The distribution of such changes to security policies can be deferred for those affected users that are not activated (e.g., logged-in or on-line) with the security system.

Claims

1. A method for distributing a security policy change within a security system distributed over a computer network, the computer network having at least a server machine and a plurality of user computers, said method comprising:

(a) receiving a security policy change at a server machine of the computer network;

(b) determining those one or more users that are affected by the security policy change;

(c) preparing a security policy change message for the one or more users that are determined to be affected by the security policy change;

(d) delivering the one or more security policy change messages to the user computers associated with the affected users who are logged into the system in such a manner as to be able to receive the security policy change message, and

(e) caching the security policy changing messages for users not logged into the system in such a manner so as to be able to receive the security policy change messages.

2. The method as recited in claim 1, whereby only the user computers associated with the affected users receive the security policy change messages.

3. The method as recited in claim 1, wherein the security policy change alters at least one of an access rule or a group'"'"'s membership.

4. The method as recited in claim 1, wherein the computer network is an enterprise computer network.

5. The method as recited in claim 1, wherein the security policy change, when effectuated, affects restrictive access to files secured by the security system.

6. The method as recited in claim 1, wherein the security policy change messages cause an action at the user computers that receive the security policy change messages.

7. The method as recited in claim 6, wherein the action is a forced logout of at least one of the user computers from the security system.

8. The method as recited in claim 1, wherein said delivering comprises:

deferring delivery of at least one the one or more security policy change messages that are destined for the user computers associated with the affected users.

9. The method as recited in claim 1, wherein said delivering (d) comprises:

(d1) determining whether the affected users are logged into the security system, and

(d2) deferring delivery of the one or more security policy change messages that are destined for the user computers associated with the affected users that are not logged into the security system.

10. The method as recited in claim 9, further comprising

(e) subsequently delivering one or more of the security policy change messages that have been deferred and cached to the corresponding affected users when the corresponding affected users subsequently log into the security system.

11. The method as recited in claim 9, wherein said deferring (d2) operates to store the one or more security policy change messages being deferred into a delivery queue.

12. The method as recited in claim 1, wherein said delivering (d) comprises:

(d1) determining locations for the affected users within the security system, and

(d2) forwarding the one or more security policy change messages to corresponding ones of the users'"'"' computers at the determined locations for the affected users.

13. The method as recited in claim 1, wherein said caching (e) comprises:

(e1) identifying at least one of the one or more security policy change messages that is to be delivered on a deferred basis;

(e2) determining whether the identified security policy change message affects any other security policy changes messages resident in a delivery queue; and

(e3) modifying one or more of the other security policy change messages in the delivery queue based at least in part on the identified security policy change message.

14. The method as recited in claim 13, wherein said caching (e) further comprises:

(e4) storing the identified security policy change message into the delivery queue, whereby the identified security policy change message is thereafter delivered on a deferred basis.

15. The method as recited in claim 13, wherein said caching (e) further comprises:

(e4) storing the identified security policy change message into the delivery queue; and

(e5) subsequently delivering one or more of the security policy change messages that have been stored in the delivery queue to the corresponding affected users when the corresponding affected users subsequently log into the security system.

16. A tangible computer readable storage medium having computer program code recorded thereon, that when executed by a processor, causes a processor to distribute a security policy change within a security system distributed over a computer network, the computer network having at least a server machine and a plurality of user computers, the computer readable storage medium comprising:

computer program code that enables the processor to receive a security policy change at a server machine of the computer network;

computer program code that enables the processor to determine those one or more users that are affected by the security policy change;

computer program code that enables the processor to prepare a security policy change message for the one or more users that are determined to be affected by the security policy change; and

computer program code that enables the processor to (a) deliver the one or more security policy change messages to the user computers associated with the affected users who are logged into the system in such a manner as to be able to receive such policy change message, and (b) cache policy changing messages for users not logged into the system in such a manner so as to be able to receive such policy change messages.

17. The computer readable storage medium as recited in claim 16, wherein said computer program code for delivering comprises:

computer program code that enables the processor to defer delivery of at least one the one or more security policy change messages that are destined for the user computers associated with the affected users.

18. The computer readable storage medium as recited in claim 16, wherein the computer program code that enables the processor to deliver for delivering comprises:

computer program code that enables the processor to determine whether the affected users are logged into the security system, and

computer program code that enables the processor to defer delivery of the one or more security policy change messages that are destined for the user computers associated with the affected users that are not logged into the security system.

19. The computer readable storage medium as recited in claim 18, wherein said computer program code for delivering further comprises:

computer program code that enables the processor to subsequently deliver one or more of the security policy change messages that have been deferred to the corresponding affected users when the corresponding affected users subsequently log into the security system.

20. The computer storage readable medium as recited in claim 16, wherein said computer program code for delivering comprises:

computer program code that enables the processor to determine locations for the affected users within the security system, and

computer program code that enables the processor to forward the one or more security policy change messages to corresponding ones of the users'"'"' computers at the determined locations for the affected users.

21. The computer readable storage medium as recited in claim 16, wherein the computer program code for delivering comprises:

computer program code that enables the processor to identify at least one of the one or more security policy change messages that is to be delivered on a deferred basis;

computer program code that enables the processor to determine whether the identified security policy change message affects any other security policy changes messages resident in a delivery queue; and

computer program code that enables the processor to modify one or more of the other security policy change messages in the delivery queue based at least in part on the identified security policy change message.

22. The computer readable storage medium as recited in claim 21, wherein the computer program code that enables the processor to deliver further comprises:

computer program code that enables the processor to store the identified security policy change message into the delivery queue; and

computer program code for subsequently delivering one or more of the security policy change messages that have been stored in the delivery queue to the corresponding affected users when the corresponding affected users subsequently log into the security system.