Verifying the Terms of Use for Access to a Service

Patent metadata

Field	Value
Publication number	US-2019294667-A1
Application number	US-201916438734-A
Country	US
Kind code	A1
Filing date	Jun 12, 2019
Priority date	Dec 11, 2012
Publication date	Sep 26, 2019
Grant date	—

Abstract

Provided are techniques in which a document accompanying a service is acquired, a natural language analysis is per on the acquired document, a determination is made from the results of the natural language analysis whether an item defined in the access control policy is found in the acquired document and, when the item defined in the access control policy is found in the acquired document, the access control policy is referenced and access to the service controlled accordingly.

First claim

We claim:

1 . A method for controlling access to a service provided by a first computing device, using computer processing, the method comprising:
acquiring, by a second computing device, a document provided by the first computing device, wherein the document comprises specified conditions required for access to the service; performing, by the second computing device, natural language analysis on the acquired document, the natural language, processing comprising:
annotating a term in the document with an attribute value; and
matching the attribute value with an attribute value of an access control policy;
determining, by the second computing device, from the results of the natural language analysis that an item defined in the access control policy is in the acquired document; and refusing, by the second computing device, the service in response to the determining.

2 . The method of claim 1 , wherein the determining further comprises adding a subject, resource or action annotation to a term in response to the results of natural language analysis having a term associated with the access control policy.

3 . The method of claim 2 , wherein the determining further comprises matching a term having a predetermined relationship to an item defined in the access control policy in response to at least two terms with a subject, resource or action annotation having the predetermined relationship.

4 . The method of claim 3 , wherein the predetermined relationship includes at least two terms with a subject, resource or action annotation in the same item of the document.

5 . The method of claim 3 , wherein the predetermined relationship links at least one of a term having a subject annotation and a term having a resource annotation to a term having an action annotation in one sentence of the document.

6 . The method of claim 1 , wherein the item specifies the refusing is accordance with access control content defined in the access control policy.

7 . The method of claim 1 , wherein the item allows providing some of the service in accordance with access control content defined in the access control policy.

8 . The method of claim 1 , wherein the item specifies the refusing in accordance with an access control policy application priority defined in the access control policy.

9 . The method of claim 1 , wherein the item specifies a time period defined by the access control policy.

10 . The method of claim 1 further comprising the computer executing the receiving a start request for the service, the acquiring the document being performed in response to receiving the start request.

11 . An apparatus for controlling access to a service provided by a first computing device using computer processing, the method comprising:
a processor coupled to a second computing device requesting a service from the first computing device; a non-transitory computer-readable recording medium coupled to the processor; and logic, stored on the computer-readable recording medium and executed on the processor, for:
acquiring, by the second computing device, a document provided by the first computing device, wherein the document comprises specified conditions required for access to the service;
performing, by the second computing device, natural language analysis on the acquired document, the natural language processing comprising:
annotating a term in the document with an attribute value; and
matching the attribute value with an attribute value of an access control policy;

determining, by the second computing device, from the results of the natural language analysis that an item defined in the access control policy is in the acquired document; and
refusing access by the second computing device to the service on the. first computing device in. response to the determining,

12 . The apparatus of claim 11 , wherein the logic for determining further comprises logic for adding a subject, resource or action annotation to a term in response to the results of natural language analysis having a term associated with the access control policy.

13 . The apparatus of claim 12 , wherein the logic for determining further comprises logic for matching a term having a predetermined relationship to an item defined in the access control policy in response to at least two terms with a subject, resource or action annotation having the predetermined relationship.

14 . The apparatus of claim 13 , wherein the predetermined relationship includes at least two terms with a subject, resource or action annotation in the same item of the document.

15 . The apparatus of claim 13 , wherein the predetermined relationship links at least one of a term having a subject annotation and a term having a resource annotation to a term having an action annotation in one sentence of the document.

16 . A computer programming product for controlling access to a service using computer processing, the computer programming product comprising:
a non-transitory computer-readable recording medium; and logic, stored on the computer-readable recording medium for execution on a processor coupled to a first computing device requesting a service from a second computing device, for:
acquiring, by the first computing device, a document provided by the second computing device, wherein the document comprises specified conditions required for access to the service;
performing, by the first computing device, natural language analysis on the acquired document, the natural language processing comprising:
annotating a term in the document with an attribute value; and
matching the attribute value with an attribute value of an access control policy;

determining, by the first computing device, from the results of the natural language analysis that an item defined in the access control policy is in the acquired document; and
refusing access by the first computing device to the service on the second computing device in response to the determining.

17 . The computer programming product of claim 16 , wherein the logic for determining further comprises logic for adding a subject, resource or action annotation to a term in response to the results of natural language analysis having a term associated with the access control policy.

18 . The computer programming product of claim 17 , wherein the logic for determining further comprises logic for matching a term having a predetermined relationship to an item defined in the access control policy in response to at least two terms with a subject, resource or action annotation having the predetermined relationship.

19 . The computer programming product of claim 18 , wherein the predetermined relationship includes at least two terms with a subject, resource or action annotation in the same item of the document.

Assignees

• IBM

Inventors

• Aratsu Taku
• Hayashi Daisuke
• Shimizu Tomohiro

Classifications

• G06F21/6209

  to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself · CPC title

• G06F21/60

  Protecting data · CPC title

• G06F17/27

  Physics · mapped topic

• G06F17/277 Primary

  Physics · mapped topic

• G06F40/237 Primary

  Lexical tools · CPC title