Patent Application
20120136908
One aspect of the present invention provides for a method and a system for efficiently providing directory clients with information that cannot be stored in a directory server and for adding “virtual attributes” to a directory.
There is a need to provide for a new virtual attribute based access method and system.
In a rapidly changing environment, the decision as to whether or not a subject may access a controlled resource must be made based on information that does not exists as attributes in directory. For example, when a subject becomes a security risk, enterprises need to immediately suspend access of the suspected subject to controlled resources. These resources may be physical (e.g., buildings, vehicles, machinery, weapons) or virtual (e.g., web services, applications).
A person may become a security risk for any number of reasons that may be assessed through calculation of some value that does not exist as an attribute in a directory.
What is needed is a system and method for providing “virtual attributes” and using them in Attribute Based Access Control (ABAC). The resulting Virtual Attribute Based Access Control (VABAC) system allows a Policy Decision Point (PDP) to make better informed decisions based on information that results from metrics, statistics, or data from some outside system and for efficiently providing directory clients with information that cannot be stored in a directory server and for adding “virtual attributes” to a directory.
Therefore, there exists a need for a solution that solves at least one of the deficiencies of the related art.
The present invention may comprise a system and method for providing “virtual attributes” and using them in Attribute Based Access Control (ABAC). The resulting Virtual Attribute Based Access Control (VABAC) system allows a Policy Decision Point (PDP) to make better informed decisions based on information that results from metrics, statistics, or data from some outside system. Given virtual attributes, the PDPs can make access decisions based on things like reputation, skill level, trust level, organizational structure, etc.
The present invention adds “virtual attributes” to a directory. A virtual attribute is an element of a directory object that, from a directory client's perspective, looks and behaves like a directory attribute. Unlike a real directory attribute, the value of an ObjectClass instance's virtual attribute would be calculated via some computation instead of being retrieved from some database or attribute store. The information source of the computation may come from external systems, internal “real” attributes, or a combination of both.
A good example of a virtual attribute would be the current location of a satellite. The directory would associate the satellite's orbital trajectory formula with the location attribute of a satellite, but would never store the value of the current location of the satellite since it is always moving. If a directory client requested the value for the location of a satellite, the directory would return the coordinates, but calculate them on the fly instead of retrieving them from a database.
The present invention may provide a system for efficiently providing directory clients with information that cannot be stored in a directory server and for adding virtual attributes to a directory comprising a virtual attribute input unit, a virtual attribute based access control unit, a processing unit and a virtual attributes database.
The present invention may further comprise a method for efficiently providing directory clients with information that cannot be stored in a directory server and for adding “virtual attributes” to a directory, the method comprising creating an attribute in a directory and refreshing the system with data with a frequency that is high enough to satisfy real-time requirements.
The present invention may further comprise a computer-readable medium storing computer instructions, which, when executed, enables a system operating for efficiently providing directory clients with information that cannot be stored in a directory server and for adding “virtual attributes” to a directory, to perform steps comprising creating an attribute in a directory and refreshing the system with data with a frequency that is high enough to satisfy real-time requirements.
The present invention a method for deploying a system for efficiently providing directory clients with information that cannot be stored in a directory server and for adding “virtual attributes” to a directory, the method comprising creating an attribute in a directory and refreshing the system with data with a frequency that is high enough to satisfy real-time requirements.
These and other features of this invention will be more readily understood from the following detailed description of the various aspects of the invention taken in conjunction with the accompanying drawings in which:
The drawings are merely schematic representations, not intended to portray specific parameters of the invention. The drawings are intended to depict only typical embodiments of the invention, and therefore should not be considered as limiting the scope of the invention.
Security risk may be assessed based on using a combination of a rule based system in conjunction with some calculation that may include metrics and statistical analysis. Rules that specify minimum/maximum/equivalent metrics for given contexts will provide or deny access to resources. The result of these calculations become virtual attributes in an Attribute Based Access Control (ABAC) system. The solution of the present invention has the advantage of instantaneous and very dynamic assessment without the decision making of a superior.
This invention adds “virtual attributes” to a directory. A virtual attribute is an element of a directory object that, from a directory client's perspective, looks and behaves like a directory attribute. Unlike a real directory attribute, the value of an ObjectClass instance's virtual attribute would be calculated via some computation instead of being retrieved from some database or attribute store. The information source of the computation may come from external systems, internal “real” attributes, or a combination of both.
A good example of a virtual attribute would be the current location of a satellite. The directory would associate the satellite's orbital trajectory formula with the location attribute of a satellite, but would never store the value of the current location of the satellite since it is always moving. If a directory client requested the value for the location of a satellite, the directory would return the coordinates, but calculate them on the fly instead of retrieving them from a database. Another example of virtual attributes include acquisition of instrumentation data from monitoring devices.
The current solution requires a superior to evaluate each person and to deny access based on a personal decision. This control does not happen in real time, is based on the superior's biases, and requires the superior to have access to a control system. In Attribute-Based Access Control (ABAC), a Policy Decision Point (PDP) may require one or more attributes which do not exist in a directory. As a result, the PDP must make a decision based solely on the attributes that are available. The PDP, in this case, cannot make an informed decision and results in a sub-optimal decision.
A mechanism is needed to efficiently provide directory clients with information that cannot be stored in a directory server. The dynamic nature of some information makes it impossible to store anywhere. Some information quickly becomes obsolete or loses value (e.g., real-time data acquisition systems), making placement in a directory problematic. Although, this information does not reside on directory sources, it is advantageous to provide access to it through an instance of a directory object class for the sake of directory clients. This information may be used by Virtual Attribute Based Access Control (VABAC) systems to control access to resources (e.g., data and applications).
The VABAC works by providing a value for a directory attribute even though that value does not exist in that directory. A virtual directory that adheres to the directory interface calculates the value as it is needed. This virtual directory may cache the value for short periods of time to reduce processing time.
The virtual directory may be implemented as a wrapper around another directory and intercepts the directory request. It parses the request, calculating the virtual attributes itself and passing the normal attribute request to the wrapped directory.
When someone attempts to access a controlled resource, a Policy Enforcement Point (PEP) requests an access decision from a PDP. That PDP then bases a decision based on policies and the virtual attributes retrieved from the virtual directory. At that point the virtual directory computes the value for the virtual attributes and returns it as though it were a real attribute. Like any ABAC, the VABAC requires an authentication system (biometric, challenge/response, etc.) to identify the subject. Once the identity is confirmed, the subject attempts to access the resource under control (
In
When someone (Subject 102) attempts to access Controlled Resource 110, Policy Enforcement Point (PEP) 104 requests an access resource decision from a PDP 106. PDP 106 then bases a decision based on policies and the virtual attributes retrieved from Virtual Attribute Enabled Directory or Virtual Directory 108. At that point, Virtual Directory 108 computes the value for the virtual attributes and returns it as though it were a real attribute. Like any ABAC, the VABAC 100 requires an authentication system (biometric, challenge/response, etc.) to identify the subject. Once the identity is confirmed, Subject 102 attempts to access Resource under control 110 (
Input/output or I/O devices (External Peripherals 216) (including but not limited to keyboards, displays (Display 220), pointing devices, etc.) can be coupled to System 204 (
It should be understood that the present invention is typically computer-implemented via hardware and/or software. As such, client systems and/or servers will include computerized components as known in the art. Such components typically include (among others) a processing unit, a memory, a bus, input/output (I/O) interfaces, external devices, etc.
While shown and described herein as a system and method for efficiently providing directory clients with information that cannot be stored in a directory server and for adding “virtual attributes” to a directory. For example, in one embodiment, the invention provides a computer-readable/useable efficiently providing directory clients with information that cannot be stored in a directory server and for adding “virtual attributes” to a directory. To this extent, the computer-readable/useable medium includes program code that implements each of the various process steps of the invention. It is understood that the terms computer-readable medium or computer useable medium comprises one or more of any type of physical embodiment of the program code. In particular, the computer-readable/useable medium can comprise program code embodied on one or more portable storage articles of manufacture (e.g., a compact disc, a magnetic disk, a tape, etc.), on one or more data storage portions of a computing device, such as memory and/or storage system (e.g., a fixed disk, a read-only memory, a random access memory, a cache memory, etc.), and/or as a data signal (e.g., a propagated signal) traveling over a network (e.g., during a wired/wireless electronic distribution of the program code).
In another embodiment, the invention provides a computer-implemented method for efficiently providing directory clients with information that cannot be stored in a directory server and for adding “virtual attributes” to a directory. In this case, a computerized infrastructure can be provided and one or more systems for performing the process steps of the invention can be obtained (e.g., created, purchased, used, modified, etc.) and deployed to the computerized infrastructure. To this extent, the deployment of a system can comprise one or more of (1) installing program code on a computing device, such as computer system from a computer-readable medium; (2) adding one or more computing devices to the computer infrastructure; and (3) incorporating and/or modifying one or more existing systems of the computer infrastructure to enable the computerized infrastructure to perform the process steps of the invention.
As used herein, it is understood that the terms “program code” and “computer program code” are synonymous and may mean any expression, in any language, code or notation, of a set of instructions intended to cause a computing device having an information processing capability to perform a particular function either directly before or after either or both of the following: (a) conversion to another language, code or notation; and/or (b) reproduction in a different material form. To this extent, program code can be embodied as one or more of: an application/software program, component software/a library of functions, an operating system, a basic I/O system/driver for a particular computing and/or I/O device, and the like.
In another embodiment, the invention provides a business method that performs the process steps of the invention on a subscription, advertising, and/or fee basis. That is, a service provider, such as a solution integrator, could offer to deploy a computer infrastructure for efficiently providing directory clients with information that cannot be stored in a directory server and for adding “virtual attributes” to a directory. In this case, the service provider can create, maintain, and support, etc., the computer infrastructure by integrating computer-readable code into a computing system, wherein the code in combination with the computing system is capable of performing the process steps of the invention for one or more customers. In return, the service provider can receive payment from the customer(s) under a subscription and/or fee agreement and/or the service provider can receive payment from the sale of advertising content to one or more third parties.
The foregoing description of various aspects of the invention has been presented for purposes of illustration and description. It is not intended to be exhaustive or to limit the invention to the precise form disclosed, and obviously, many modifications and variations are possible. Such modifications and variations that may be apparent to a person skilled in the art are intended to be included within the scope of the invention as defined by the accompanying claims.
