Multi-Focused Fine-Grained Security Framework

Patent metadata

Field	Value
Publication number	US-2016306985-A1
Application number	US-201514688985-A
Country	US
Kind code	A1
Filing date	Apr 16, 2015
Priority date	Apr 16, 2015
Publication date	Oct 20, 2016
Grant date	—

Abstract

An approach is provided in which a knowledge manager generates a knowledge structure that includes security annotation tokens and term tokens. Each of the security annotation tokens are stored in a parallel field and align to at least one of the term tokens. The knowledge manager matches security policies corresponding to a search request to one or more of the security annotation tokens and, in turn, generates search results based upon obfuscation of one or more of the term tokens aligned to the matched security annotation tokens.

First claim

1 . (canceled)

2 . (canceled)

3 . (canceled)

4 . (canceled)

5 . (canceled)

6 . (canceled)

7 . (canceled)

8 . An information handling system comprising:
one or more processors; a memory coupled to at least one of the processors; and a set of computer program instructions stored in the memory and executed by at least one of the processors in order to perform actions of:
creating a knowledge structure that includes a plurality of security annotation tokens and a plurality of term tokens, wherein each of the plurality of security annotation tokens are stored in at least one of a plurality of parallel fields that correspond to at least one of the plurality of term tokens;
matching one or more security policies corresponding to a search request to one or more of the plurality of security annotation tokens; and
generating one or more answers to the search request based upon obfuscation of a subset of the plurality of term tokens that each correspond to at least one of the matched one or more security annotation tokens.

9 . The information handling system of claim 8 wherein at least one of the one or more processors perform additional actions comprising:
determining that at least one of the one or more security policies is a search restriction policy corresponding to the matched one or more security annotation tokens; and
omitting the subset of term tokens during a search of the knowledge base.

10 . The information handling system of claim 8 wherein at least one of the one or more processors perform additional actions comprising:
determining that at least one of the one or more security policies is a scoring restriction policy corresponding to the matched one or more security annotation tokens; and
omitting the subset of term tokens during a scoring of one or more search results corresponding to the one or more answers.

11 . The information handling system of claim 8 wherein at least one of the one or more processors perform additional actions comprising:
determining that at least one of the one or more security policies is a passage authorization security policy corresponding to the matched one or more security annotation tokens; and
deleting one or more candidate answers based upon the passage authorization security policy.

12 . The information handling system of claim 8 wherein at least one of the one or more processors perform additional actions comprising:
determining that at least one of the one or more security policies is a visualization security policy corresponding to the matched one or more security annotation tokens; and
displaying a modified one of the one or more answers that masks one or more of the subset of term tokens.

13 . The information handling system of claim 12 wherein at least one of the one or more processors perform additional actions comprising:
replacing the masked one or more term tokens with one or more security warning messages.

14 . The information handling system of claim 8 wherein, prior to the creation of the knowledge structure, at least one of the one or more processors perform additional actions comprising:
assigning a plurality of security annotation tags to a document based upon one or more document properties of the document;
generating the plurality of security annotation tokens from the plurality of security annotation tags; and
generating the plurality of term tokens from a plurality of terms included in the document.

15 . A computer program product stored in a computer readable storage medium, comprising computer program code that, when executed by an information handling system, causes the information handling system to perform actions comprising:
creating a knowledge structure that includes a plurality of security annotation tokens and a plurality of term tokens, wherein each of the plurality of security annotation tokens are stored in at least one of a plurality of parallel fields that correspond to at least one of the plurality of term tokens; matching one or more security policies corresponding to a search request to one or more of the plurality of security annotation tokens; and generating one or more answers to the search request based upon obfuscation of a subset of the plurality of term tokens that each correspond to at least one of the matched one or more security annotation tokens.

16 . The computer program product of claim 15 wherein the information handling system performs additional actions comprising:
determining that at least one of the one or more security policies is a search restriction policy corresponding to the matched one or more security annotation tokens; and
omitting the subset of term tokens during a search of the knowledge base.

17 . The computer program product of claim 15 wherein the information handling system performs additional actions comprising:
determining that at least one of the one or more security policies is a scoring restriction policy corresponding to the matched one or more security annotation tokens; and
omitting the subset of term tokens during a scoring of one or more search results corresponding to the one or more answers.

18 . The computer program product of claim 15 wherein the information handling system performs additional actions comprising:
determining that at least one of the one or more security policies is a passage authorization security policy corresponding to the matched one or more security annotation tokens; and
deleting one or more candidate answers based upon the passage authorization security policy.

19 . The computer program product of claim 15 wherein the information handling system performs additional actions comprising:
determining that at least one of the one or more security policies is a visualization security policy corresponding to the matched one or more security annotation tokens; and
displaying a modified one of the one or more answers that masks one or more of the subset of term tokens.

20 . The computer program product of claim 19 wherein the information handling system performs additional actions comprising:
replacing the masked one or more term tokens with one or more security warning messages.

21 . The computer program product of claim 15 wherein, prior to the creation of the knowledge structure, the information handling system performs additional actions comprising:
assigning a plurality of security annotation tags to a document based upon one or more document properties of the document;
generating the plurality of security annotation tokens from the plurality of security annotation tags; and
generating the plurality of term tokens from a plurality of terms included in the document.

22 . (canceled)

23 . (canceled)

24 . An information handling system comprising:
one or more processors; a memory coupled to at least one of the processors; and a set of computer program instructions stored in the memory and executed by at least one of the processors in order to perform actions of:
receiving a search request initiated by a user;
identifying one or more user authorizations corresponding to the user; and
generating one or more answers of the search request based upon the one or more user authorizations, wherein the generation of the one or more answers comprises:
creating one or more preliminary search results from searching a knowledge structure utilizing one or more search restriction policies corresponding to the one or more

Assignees

• IBM

Inventors

• Beamon Bridget B
• Debroni Bradley M
• Filoti Octavian F
• Kyle Bryan J
• Nolan Christopher M

Classifications

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• G06F21/6245

  Protecting personal data, e.g. for financial or medical purposes · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• G06F21/604 Primary

  Tools and structures for managing or administering access control systems · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title