Security model for a memory of a network information system

Patent metadata

Field	Value
Publication number	US-9692858-B2
Application number	US-201213550830-A
Country	US
Kind code	B2
Filing date	Jul 17, 2012
Priority date	Jul 17, 2012
Publication date	Jun 27, 2017
Grant date	Jun 27, 2017

Abstract

Systems and methods for providing information services are disclosed. A method includes passing an instance an object, invoked by a user, to a memory device at a hardware layer of a network information system, the object being hosted for a tenant of a network information service. The method further includes determining by a processing unit of the memory device that storage of the object is not authorized by the tenant based on a security map provided by the tenant and accessible by the processing unit within the hardware layer. The method further includes preventing storage of the instance in the memory device based on the result of the determining.

First claim

What is claimed:

1. A method, comprising:
passing an instance of an object, invoked by a user, to a memory device within a system memory at a hardware layer of a network information system, the object being one of a plurality of objects hosted for a tenant of a network information service;
determining, by a processing unit within the system memory, that storage of the object in the memory device is authorized by the tenant based on a security map provided by the tenant and accessible by the processing unit within system memory; and
preventing, by the processing unit, storage of the instance in the memory device based on the result of the determining,
wherein the memory device comprises a RAM and a heap memory,
wherein the processing unit is a security processor embedded within the heap memory, and
wherein the security map resides in memory directly accessible by the security processor.

2. The method of claim 1 , wherein the determining that the storing of the object is authorized comprises determining that a user credential received from the user and included in the instance of the object is identified in the security map.

3. The method of claim 1 , wherein determining that storing the object is authorized by the tenant comprises determining that that the security map includes an entry associating the user credential and a tenant security code.

4. The method of claim 3 , wherein the determining that the storing of the object is authorized comprises determining that the user credential and a tenant security code match information in the entry.

5. The method of claim 1 , wherein the security map associates the user with an allotted range of the memory device.

6. The method of claim 1 , further comprising:
receiving the user credential and the tenant security code from the user; and
incorporating the user credential and the tenant security code into the instance of the object.

7. The method of claim 1 , wherein the steps of claim 1 are at least one of created, maintained, deployed and supported by a service provider.

8. The method of claim 1 , wherein steps of claim 1 are provided by a service provider on a subscription, advertising, and/or fee basis.

9. The method of claim 1 , wherein:
the network information system includes a portal layer, a service layer, and the hardware layer;
the hardware layer includes a class loader, a library storing the object, the heap memory, the security processor, and the security map;
the method further comprises authenticating the user via the portal layer; and
the passing the instance of the object to the memory device comprises:
retrieving the object from the library in response to the user invoking the object via one of a plurality of services hosted for the tenant in the service layer;
creating an instance of the object by the class loader; and
initiating storage of the instance of the object in the heap memory; and

the determining by the processing unit that storage of the object in the memory device is authorized by the tenant comprises determining whether a credential or security code provided by the user via the portal layer matches information in the security map.

10. The method of claim 1 , wherein the network information system includes a service layer and a portal layer which are upper layers above the hardware layer, and wherein the security map is formed in the hardware layer.

11. A system for providing an information service to a tenant comprising:
a security processor within a system memory;
a computer-readable memory within the system memory, the computer-readable memory storing a security map that is accessible by the security processor within the system memory,
wherein the security processor accesses the security map and matches a user credential passed to the security processor in an instance with the security map and prevents the storing of information in a memory device,
wherein the computer-readable memory comprises a RAM and a heap memory,
wherein the security processor is embedded within the heap memory, and
wherein the security map resides in memory directly accessible by the security processor.

12. The system of claim 11 , wherein the memory device is a heap memory of the system.

13. The system of claim 12 , wherein the security map associates the user credential with a tenant security code.

14. The system of claim 13 , wherein the security map further associates the user credential with an allotted range of the heap memory.

15. The system of claim 13 , wherein the security processor is configured to determine that the user credential is included in the security map.

16. The system of claim 13 , wherein the security processor is configured to determine that the user credential and the tenant security code are associated in the security map.

17. The system of claim 16 , wherein the security processor is configured to determine that the user credential and the tenant security code match an entry of the security map.

18. The system of claim 11 , wherein the system is configured to:
receive the user credential and a tenant security code from the user; and
incorporate the user credential and the tenant security code in an instance of an object.

19. The system of claim 11 , wherein the security processor is configured to:
compare the user credential and a tenant security code incorporated in an instance of an object with one or more entries in the security map; and
determine that the user credential and the tenant security code incorporated in the instance of the object match one or more entries in the security map.

20. A computer program product comprising:
a security processor within a system memory;
a computer readable storage device having readable program code embodied in the storage device that, when executed by the security processor, causes the computer program product to store an instance of one or more objects retrieved from a library in a memory device within the system memory based on receiving a user credential and a token of an owner of the one or more objects in the instance,
wherein the computer readable storage device comprises a RAM and a heap memory,
wherein the security processor is embedded within the heap memory, and
wherein the readable program code resides in memory directly accessible by the security processor.

21. A computer system comprising:
a CPU;
a computer readable storage media;
a system memory including a security processor and a memory device;
first program instructions, executed by the CPU, that pass an instance of an object to the memory device of the system, the object being one of a plurality of objects hosted for a tenant that has been invoked by a user;
second program instructions, executed by the security processor, that determine that storage of the object in the memory device is not authorized by the tenant based on a security map provided by the tenant; and
third program instructions, executed by the security processor, that prevent storage of the instance in the memory device based on the result of the determining,
wherein the memory device comprises the security map, a RAM and a heap memory,
wherein the security processor is embedded within the heap memory, and
wherein the security map resides in memory directly accessible by the security processor.

22. A method for providing an information service to a tenant, comprising:
passing an instance of an object to a memory device within a system memory of a hardware layer of

Assignees

• Jain Bhushan P
• Patil Sandeep R
• Pfeiffer Dirk
• Ramanathan Sri
• Sivakumar Gandhi
• Trevathan Matthew B
• IBM

Inventors

• Jain Bhushan P
• Patil Sandeep R
• Pfeiffer Dirk
• Ramanathan Sri
• Sivakumar Gandhi
• Trevathan Matthew B

Classifications

• G06F2221/2141

  Access rights, e.g. capability lists, access control lists, access tables, access matrices · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F21/72

  in cryptographic circuits · CPC title

• H04L69/24 Primary

  Negotiation of communication capabilities · CPC title

• G06F12/1458

  by checking the subject access rights · CPC title