Using object based security for controlling object specific actions on a surface based computing device

• US 7,979,902 B2
• Filed: 11/13/2007
• Issued: 07/12/2011
• Est. Priority Date: 11/13/2007
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Harris, Monica S., Chakra, Al, Lyle, Ruthie D.
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Hailu; Teshome
• Application Number:
  US11/939,065
• Publication Number:
  US 20090126010A1
• Time in Patent Office: 1,337 Days
• Field of Search: 726/17
• US Class Current: 726/17
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

The present invention discloses a solution for object level security on a surface based computing device that includes software objects and behavior tokens. The behavior tokens can control an extent that users are able to manipulate the software objects using the surface based computing device. Different levels of control can be established on an object-by-object basis for different users. The extent users are able to manipulate the software objects can also depends upon set of users proximate to the surface based computing device.

Claims

1. A method for controlling behavior of software objects used on a surface based computing device comprising:

associating software objects with behavior tokens, which control an extent that users are able to manipulate said software objects using a surface based computing device, wherein different manipulations of said software objects are based upon a set of a plurality of different users proximate to the surface based computing device;

automatically detecting a presence of the set of a plurality of different users proximate to the surface based computing device, wherein each of the plurality of different users are concurrently interacting with software objects displayed on the surface based computing device;

determining at least one of an identity and a privilege group for each detected user;

computing a device state for the surface based computing device, wherein the device state determines a maximum privilege level for any of the users to manipulate any of the software objects on the surface based computing device, wherein three or more different device states exist, each granting different maximum privilege levels for manipulating the software objects, wherein changes in which of the plurality of different users are proximate to the surface based computing device automatically result in a corresponding change in the device state of the surface based computing device;

receiving an attempt to perform an operation against one of the software objects using the surface based computing device;

ascertaining a set of manipulation rights for the software object based upon details specified within a behavioral token associated with the software object and based upon a set of users proximate to the surface based computing device, wherein the behavior token defines the device state of the surface based computing device;

applying said ascertained manipulation rights; and

selectively permitting execution of operations associated with the received attempt in accordance with the applied rights.

2. The method of claim 1, wherein said behavior tokens are defined within metadata of the associated software objects, wherein a one-to-one correspondence exists between software objects and behavior tokens, and wherein manipulation rights are granted on a per-object basis.

3. The method of claim 1, wherein said privileges comprise configurable application level behavioral restrictions upon a use of the software object, wherein one of said application level behavioral restrictions defines restrictions on an amount of zoom that is able to be performed against an image software object by a user, wherein each of the plurality of different users has administrator privileges, said method further comprising:

detecting an approach of a new user to a proximity of the surface based computing device;

determining the new user has consumer privileges, which has lesser zoom privileges than those zoom privileges associated with administrators;

changing the device state from an administrator state to an administrator and consumer state responsive to determining the new user has approached the proximity of the surface based computing device; and

restricting zoom characteristics of the software objects to a lesser zoom magnitude while the device state of the surface based computer is in the consumer state.

4. The method of claim 1, further comprising:

detecting a change to a set of users proximate to the surface based computing device;

determining at least one of an identity and a privilege group for a user associated with the detected change; and

dynamically altering a set of rights available for manipulating the software objects based upon the detected change.

5. The method of claim 1, wherein said different device states of the surface based computer comprise an Owners Only State, an Administrator Only State, an Administrator and Consumer State, a Consumer Only State, and an Intruder State, wherein the Owners Only State is a state where the different users proximate to the surface based computing device own the software objects displayed on the surface based computing device, wherein the Administrator Only State is a state where the different users proximate to the surface based computing device all have administrator privileges for at least a portion of the software objects displayed on the surface based computing device, wherein Administrator and Consumer State is a state where a portion of the different users proximate to the surface based computing device have administrator privileges and where a different portion of the different users have consumer privileges on the software objects, wherein the Consumer Only State is a state where the different users proximate to the surface based computing device all have consumer privileges on the software objects, and wherein the Intruder State is a state where the different users proximate to the surface based computing device comprise at least one user that has no privileges for at least one of the software objects.

6. A method for controlling software object behavior on a surface based computing device comprising:

detecting a set of a plurality of users proximate to surface based computing device which displays a plurality of different software objects;

determining privileges that each of the users of said set of users have for using each of the software objects via the surface based computing device, wherein each of the set of users have user specific privileges for using each of the software objects, which is defined by behavioral tokens associated with each of the software objects; and

for each of the software objects, determining a device state specific to that software object that varies based on the plurality of users and their respective privileges for using that software objects, wherein three or more different device states exist, each granting different maximum privilege levels for manipulating the corresponding software objects, wherein changes in which of the plurality of different users are proximate to the surface based computing device automatically result in a corresponding changes in the device state of the surface based computing devices for the different software objects;

dynamically adjusting usages rules for the software objects in accordance with the determined privileges and in accordance with the device states determined for each of the software objects.

7. The method of claim 6, further comprising:

detecting a change to the set of users proximate to the surface based computing device; and

repeating the determining and dynamically adjusting steps.

8. The method of claim 7, wherein said privileges are established on a per-object basis, wherein said privileges vary by a user attempting to use a software object, and wherein said privileges comprise a read, edit, delete, and copy privileges, wherein said privileges comprise configurable application level behavioral restrictions upon a use of the software object, wherein said privileges comprise configurable application level behavioral restrictions upon a use of the software object.

9. The method of claim 6, wherein said different device states of the surface based computer comprise an Owners Only State, an Administrator Only State, an Administrator and Consumer State, a Consumer Only State, and an Intruder State.

10. The method of claim 9, wherein the Owners Only State is a state where the different users proximate to the surface based computing device own the software objects displayed on the surface based computing device, wherein the Administrator Only State is a state where the different users proximate to the surface based computing device all have administrator privileges for at least a portion of the software objects displayed on the surface based computing device, wherein Administrator and Consumer State is a state where a portion of the different users proximate to the surface based computing device have administrator privileges and where a different portion of the different users have consumer privileges on the software objects, wherein the Consumer Only State is a state where the different users proximate to the surface based computing device all have consumer privileges on the software objects, and wherein the Intruder State is a state where the different users proximate to the surface based computing device comprise at least one user that has no privileges for at least one of the software objects.

11. The method of claim 8, wherein each software object is associated with at least one behavioral token, wherein said behavioral token controls what operations are able to be performed against the related software object, wherein the controlled operations vary depending upon the set of users proximate to the surface based computing device.

12. The method of claim 11, wherein controlled operations include applying restrictions to application level interactions with the software objects.

13. The method of claim 12, wherein said applied restrictions comprise a restriction of a level of zoom that is able to be applied to an image software object.

14. The method of claim 6, wherein said different device states of the surface based computer comprise an Administrator Only State, a Consumer Only State, and an Intruder State, wherein the Administrator Only State is a state where the different users proximate to the surface based computing device all have administrator privileges for at least a portion of the software objects displayed on the surface based computing device, wherein the Consumer Only State is a state where the different users proximate to the surface based computing device all have consumer privileges on the software objects, and wherein the Intruder State is a state where the different users proximate to the surface based computing device comprise at least one user that has no privileges for at least one of the software objects.

15. A system for object level security on a surface based computing device comprising:

a set of one or more software objects stored on a machine readable medium accessible by a surface based computing device;

a set of one or more behavior tokens stored on a machine readable medium accessible by a surface based computing device, wherein said behavior tokens control an extent that users are able to manipulate said software objects using said surface based computing device, wherein different levels of control are established on an object-by-object basis for different users, wherein the extent users are able to manipulate said software objects depends upon set of a plurality of different users proximate to the surface based computing device, which is referred to as a device state of the surface based computing device, wherein device states of the surface based computer comprise at least three of an Owners Only State, an Administrator Only State, an Administrator and Consumer State, a Consumer Only State, and an Intruder State, wherein the system granting different maximum privilege levels for manipulating the software objects in accordance with the device state of the surface based computing device, wherein changes in which of the plurality of different users that are proximate to the surface based computing device automatically result in the surface based computing device effectuating a corresponding change in the device state of the surface based computing device.

16. The system of claim 15, further comprising:

a presence detector configured to detect individuals proximate to said surface based computing device and configured to determine an identity of a user attempting to manipulate one of the software objects, wherein user identities determined by said presence detector are matched against user identities specified within the behavior tokens and are used to control manipulations of said software objects via the surface based computing device.

17. The system of claim 16, wherein at least one of said security tokens retract manipulation privileges otherwise granted against at least one of the software objects based upon a presence of an unauthorized user, as determined by the presence detector.

18. The system of claim 16, wherein at least one of the behavior tokens grant manipulation privileges otherwise unavailable for at least one of the software objects based upon a presence of an authorizing user, as determined by the presence detector.

19. The system of claim 16 wherein a behavior token must be associated with each software object before said software object is able to be manipulated by the surface based computing device by surface based computing device users.

20. The system of claim 15, wherein said software objects comprise a plurality of software objects, wherein said behavior tokens comprise a plurality of behavior tokens, and wherein a one-to-one relationship exists between the software objects and the behavior tokens.