Device and method for determining content of access control of data

Patent metadata

Field	Value
Publication number	US-10747893-B2
Application number	US-201313961222-A
Country	US
Kind code	B2
Filing date	Aug 7, 2013
Priority date	Aug 22, 2012
Publication date	Aug 18, 2020
Grant date	Aug 18, 2020

Abstract

Determining the content of access control to data based on classification results obtained by classifying data includes recording setting information that sets a plurality of classification engines for predetermined conditions related to either data or to the access to the data and acquiring data subject to access when access to the data subject to access is requested. Responsive to satisfaction of predetermined conditions related to either the data subject to the access or access to the data subject to access, classification of data subject to access by the plurality of classification engines set for predetermined conditions in the setting information is indicated using a processor. Further, using the processor, the content of access control to the data subject to access based on classification results obtained by the plurality of classification engines classifying data subject to access is determined based on the indicating classification of data.

First claim

What is claimed is:

1. A computer-implemented method for controlling access to data subject to access control, comprising:
determining that the data subject to access control is subject to an access request by a user;
acquiring access information including the data subject to access control and the access request;
selecting, using the access information and a classification engine reference setting file, a plurality of classification engines including a general use classification engine and a specific application classification engine;
receiving, from each of the plurality of classification engines each using the same access information, a classification result thereby resulting in a plurality of classification results received from the plurality of classification engines; and
denying the access request based upon the plurality of classification results, wherein
each of the received classifications results are independently generated, respectively, by the plurality of classifications engines,
the classification engine reference setting file defines the specific application classification engine based upon at least one condition during the access request, and
each of the plurality of classification engines include:
a knowledge base,
a data extracting part configured to extract structured data from the data subject to access control, and
a data analyzing part configured to analyze the structured data using the knowledge base.

2. The method of claim 1 , wherein
the access request by a user is based upon the using intending to email the data subject to access control to an intended recipient.

3. The method of claim 1 , wherein
the at least one condition includes at least one of:
the data subject to access being an encrypted file,
the data subject to access being located into a specific folder, and
the data subject to access being a compressed file.

4. The method of claim 1 , wherein
the specific application classification engine is specific to the user.

5. The method of claim 1 , wherein
the access request being denied is based upon user settings upon the plurality of classification engines providing different classification results.

6. The method of claim 1 , wherein
the classification engine reference setting file is specific to the user.

7. The method of claim 1 , wherein
the classification engine reference setting file is specific to an intended recipient of the data subject to access control.

8. A computer hardware system configured to control access to data subject to access control, comprising:
a hardware processor configured to initiate the following executable operations:
determining that the data subject to access control is subject to an access request by a user;
acquiring access information including the data subject to access control and the access request;
selecting, using the access information and a classification engine reference setting file, a plurality of classification engines including a general use classification engine and a specific application classification engine;
receiving, from each of the plurality of classification engines each using the same access information, a classification result thereby resulting in a plurality of classification results received from the plurality of classification engines; and
denying the access request based upon the plurality of classification results, wherein
each of the received classifications results are independently generated, respectively, by the plurality of classifications engines,

the classification engine reference setting file defines the specific application classification engine based upon at least one condition during the access request, and
each of the plurality of classification engines include:
a knowledge base,
a data extracting part configured to extract structured data from the data subject to access control, and
a data analyzing part configured to analyze the structured data using the knowledge base.

9. The system of claim 8 , wherein
the access request by a user is based upon the using intending to email the data subject to access control to an intended recipient.

10. The system of claim 8 , wherein
the at least one condition includes at least one of:
the data subject to access being an encrypted file,
the data subject to access being located into a specific folder, and
the data subject to access being a compressed file.

11. The system of claim 8 , wherein
the specific application classification engine is specific to the user.

12. The system of claim 8 , wherein
the access request being denied is based upon user settings upon the plurality of classification engines providing different classification results.

13. The system of claim 8 , wherein
the classification engine reference setting file is specific to the user.

14. The system of claim 8 , wherein
the classification engine reference setting file is specific to an intended recipient of the data subject to access control.

15. A computer program product, comprising:
a hardware storage device having stored thereon program code for controlling access to data subject to access control,
the program code, which when executed by a computer hardware system, causes the computer hardware system to perform:
determining that the data subject to access control is subject to an access request by a user;
acquiring access information including the data subject to access control and the access request;
selecting, using the access information and a classification engine reference setting file, a plurality of classification engines including a general use classification engine and a specific application classification engine;
receiving, from each of the plurality of classification engines each using the same access information, a classification result thereby resulting in a plurality of classification results received from the plurality of classification engines; and
denying the access request based upon the plurality of classification results, wherein
each of the received classifications results are independently generated, respectively, by the plurality of classifications engines,

the classification engine reference setting file defines the specific application classification engine based upon at least one condition during the access request, and
each of the plurality of classification engines include:
a knowledge base,
a data extracting part configured to extract structured data from the data subject to access control, and
a data analyzing part configured to analyze the structured data using the knowledge base.

16. The computer program product of claim 15 , wherein
the access request by a user is based upon the using intending to email the data subject to access control to an intended recipient.

17. The computer program product of claim 15 , wherein
the at least one condition includes at least one of:
the data subject to access being an encrypted file,
the data subject to access being located into a specific folder, and
the data subject to access being a compressed file.

18. The computer program product of claim 15 , wherein
the specific application classification engine is specific to the user.

19. The computer program product of claim 15 , wherein
the access request being denied is based upon user settings upon the plurality of classification engines providing different classification results.

20. The computer program product of claim 15 , wherein
the classification engine reference

Assignees

• IBM

Inventors

• Kiriyama Hayato
• Shioya Tomohiro
• Tsumura Tadashi

Classifications

• G06F21/606 Primary

  by securing the transmission between two devices or processes · CPC title

• G06F21/62 Primary

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title