Security model for network information service

Patent metadata

Field	Value
Publication number	US-9710626-B2
Application number	US-201213543628-A
Country	US
Kind code	B2
Filing date	Jul 6, 2012
Priority date	Jul 6, 2012
Publication date	Jul 18, 2017
Grant date	Jul 18, 2017

Abstract

Systems and methods for providing information security in a network environment are disclosed. The method includes initiating processing, invoked by a user, of at least one of a plurality of objects in a processing unit of a hardware layer, wherein the plurality of objects is hosted for a tenant. The method further includes determining that the processing of the at least one of the plurality of objects by the processing unit is authorized by the tenant based on a security map provided by the tenant and accessible by the processing unit within the hardware layer. The method further includes allowing the processing of the object based on a result of the determining.

First claim

What is claimed:

1. A method, comprising:
initiating processing, invoked by a user having a dynamically varying credential, by a security processor comparing instructions of at least one of a plurality of objects in a processing unit of a hardware layer with information in a security map, wherein the plurality of objects is hosted by a tenant that provided the dynamically varying credential to the user;
determining that the processing of the at least one of the plurality of objects by the processing unit is authorized by the tenant based on the security map provided by the tenant and accessible by the processing unit within the hardware layer; and
allowing the processing of the object based on a result of the determining,
wherein the determining comprises:
determining that the security map includes an association between the at least one of the plurality of objects and a security code;
sending a message to the tenant requesting the security code;
comparing a response from the tenant with the security code in the security map; and
determining that the security map includes an association between the object and a geographic region.

2. The method of claim 1 , wherein the determining comprises determining that the at least one of the plurality of objects is identified in the security map.

3. The method of claim 1 , wherein the determining comprises determining that the security map includes an association between the at least one of the plurality of objects and the credential of the user.

4. The method of claim 1 , wherein the determining that the processing of the object by the CPU is authorized by the tenant is performed at more than one step of an instruction cycle.

5. The method of claim 1 , wherein the initiating processing comprises initiating an instruction cycle by the processing unit comprising a fetch, a decode, and an execute.

6. The method of claim 1 , wherein invoking the at least one of the plurality of objects includes compiling the object into machine language.

7. The method of claim 1 , wherein the steps of claim 1 are at least one of created, maintained, deployed and supported by a service provider.

8. The method of claim 1 , wherein steps of claim 1 are provided by a service provider on a subscription, advertising, and/or fee basis.

9. A system for providing an information service to a tenant comprising:
a security processor comprising an external communication interface; and
a computer-readable memory storing a security map of the tenant and accessible by the security processor,
wherein the security processor is configured to:
access the security map;
match credentials of a user with the security map;
receive authorization by the tenant for access by the user;
ignore a cloud based security mapping when processing a security code of the tenant;
determine that the security map includes an association between an object and the security code;
send a message to the tenant requesting the security code via the external communication interface;
compare a response received from the tenant with the security code in the security map; and
determine whether the security map includes an association between an object and a geographic region.

10. The system of claim 9 , wherein the security processor is configured to determine whether an object is identified in the security map.

11. The system of claim 9 , wherein the security processor is configured to determine whether the security map includes an association between an object and a credential of the user.

12. The system of claim 9 , wherein the security processor is configured to determine whether processing of an object by a CPU is authorized by the tenant at more than one step of an instruction cycle.

13. The system of claim 9 , wherein the security processor and the computer-readable memory are located at a hardware layer.

14. The system of claim 9 , further comprising:
a service layer comprising a plurality of services, wherein a first of the plurality of services is hosted for a first tenant of the plurality of tenants;
a hardware layer comprising:
a central processing unit (CPU);
the security processor having the external communication interface; and
the computer-readable memory addressable by the security processor;

wherein the external communication interface is configured to:
receive the security map from the tenant via the external communication interface, the security map associating an object of the tenant with a credential of the user; and
store the security map in the computer-readable memory.

15. The system of claim 14 , wherein
the credentials of the user dynamically vary and are provided by the tenant, and
the security code dynamically varies and corresponds to a part of an object.

16. The system of claim 15 , wherein the security processor is configured to:
determine whether a response received from the tenant via the external communication interface matches the security code in the security map; and
halt execution of an object by the CPU.

17. A computer program product comprising a computer readable storage medium having readable program code embodied in the storage medium, the computer program product being operable to:
provide access to one or more objects stored within a library by receiving dynamically varying security codes, at a hardware layer, of an owner of the one or more objects, each security code corresponding to a part of the one or more objects; and
determine that a processing of the one or more objects is authorized by the owner based on a security map provided by the owner,
wherein the determining comprises:
determining that the security map includes an association between the one or more objects and the security codes;
sending a message to the owner requesting the security codes;
comparing a response from the owner to the security codes in the security map; and
determining that the security map includes an association between the one or more objects and a geographic region.

18. A computer system comprising:
a CPU, a computer readable memory and a computer readable storage media;
first program instructions to provide a user with dynamically varying credentials for accessing a tenant service;
second program instructions to initiate processing of at least one of a plurality of objects in a processing unit of a hardware layer by executing at least one of the plurality of objects, wherein the plurality of objects is hosted by a tenant in the tenant service;
third program instructions to determine that the processing of the at least one of the plurality of objects by the processing unit is authorized by the tenant based on a security map provided by the tenant and accessible by the processing unit within the hardware layer; and
fourth program instructions to halt the processing of the one object,
wherein the first, second, third and fourth program instructions are stored on the computer readable storage media for execution by the CPU via the computer readable memory, and the determining comprises:
determining that the security map includes an association between the at least one of the plurality of objects and a security code;
sending a message to the tenant requesting the security code;
comparing a response from the tenant with the security code in the security map; and
determining that the security map includes an association between the object and a geographic region.

19. A method of deploying a system for providing an information service to a tenant, comprising:
providi

Assignees

• Jain Bhushan P
• Patil Sandeep R
• Ramanathan Sri
• Sivakumar Gandhi
• Trevathan Matthew B
• Wijayakumaran Wijayaratnam
• IBM

Inventors

• Jain Bhushan P
• Patil Sandeep R
• Ramanathan Sri
• Sivakumar Gandhi
• Trevathan Matthew B
• Wijayakumaran Wijayaratnam

Classifications

• G06F21/31 Primary

  User authentication · CPC title