Filing Information

Inventor(s)	Daniel Jay Thomsen · Richard O'Brien · Jessica Bogle · Charles Payne ·
Assignee(s)	Secure Computing Corporation ·  View assignee updates
Attorney/Agent(s)	Schwegman, Lundberg & Woessner, P.A. ·
Primary Examiner	Kambiz Zand ·
Assistant Examiner	Michael J Simitoski ·
Application Number	US9483164
Filing date	01/14/2000
Issue date	12/11/2007
Predicted expiration date	01/14/2020
U.S. Classifications	726/1  · 707/9  · 726/6  ·
International Classifications	G06F1516  · G06F1700  · G06F1730  · G06F700  · H04K100  · H04L900  ·
Kind Code	B1

Patent Family

Abstract

A system and method for defining and enforcing a security policy. Security mechanism application specific information for each security mechanism is encapsulated as a key and exported to a semantic layer. Keys are combined to form key chains within the semantic layer. The key chains are in turn encapsulated as keys and passed to another semantic layer. A security policy is defined by forming key chains from keys and associating users with the key chains. The security policy is translated and exported to the security mechanisms. The security policy is then enforced via the security mechanisms.

Independent Claims | See all claims (34)

1. 1. In a system having a computer and one or more security mechanisms, a computer-implemented method of defining and enforcing a security policy, the method comprising: encapsulating security mechanism application specific information for each security mechanism, wherein encapsulating includes forming a key for each security mechanism using an application layer; combining keys to form key chains; encapsulating key chains as keys and passing the key chain keys to another semantic layer; defining the security policy, wherein defining includes forming key chains from keys and associating users with key chains; importing a key from the semantic layer to a local policy layer; executing, within a computer, translation software, wherein the translation software translates the security policy and exports the translated security policy to the security mechanisms; and enforcing the security policy via the security mechanisms.
2. 7. A computer-based security system for a computer network, the computer-based security system comprising: a computer; a plurality of security mechanisms; a plurality of semantic layers within a model implemented on the computer network, wherein the two or more of the semantic layers include keys combinable into key chains, the key chains are able to be encapsulated as key chain keys, and the key chain keys are exportable to another semantic layer, wherein the model also includes an application layer to encapsulate a security mechanism into a key and a local policy layer to associate a user to a key wherein each key encapsulates security mechanism application specific information for a security mechanism; a user interface for defining a security policy as a function of keys received from a lower semantic layer; and a translator, implemented on the computer, for translating the security policy to the security mechanisms.
3. 12. A computer-based security system for a computer network, the computer-based security system comprising: a computer; a model implemented on the computer network, the model comprising semantic layers for defining different security policies and constraints for each type of user, wherein the model comprises a static application policy layer, two or more semantic policy layers, and a dynamic local policy layer; a tool for manipulating the model, wherein the tool is configured to: encapsulate security mechanism application specific information for each security mechanism, wherein encapsulating includes forming a key for each security mechanism; combine keys to form key chains; encapsulate key chains as key chain keys within two or more semantic layers; pass the key chain keys to other semantic layers; form user key chains from the key chain keys; and associate users with the user key chains; and a translator, implemented on the computer, for translating security policies from the model to security mechanisms in one or more computer resources.
4. 14. A computer-implemented method of defining a security policy, the method comprising: defining an application policy layer and a plurality of semantic policy layers, including a first semantic policy layer and a second semantic layer; encapsulating a set of access rights for a computer resource as a key; combining keys to form one or more key chains within the application policy layer; executing software within a computer to export key chains in the application policy layer as a key; importing at least one key from the application policy layer into the first semantic policy layer; combining one or more keys in the first semantic policy layer to form a key chain; exporting key chains in the first semantic policy layer as keys; importing at least one key into the second semantic policy layer; combining one or more keys in the second semantic policy layer to form a key chain; exporting key chains in the second semantic policy layer as keys; importing at least one key from the second semantic policy layer to a local policy layer; combining one or more keys in the local policy layer to form one or more local policy key chains; and assigning users to local policy key chains in the local policy layer.
5. 23. A computer-implemented method of defining a security policy, the method comprising: defining an application policy layer and a semantic policy layer; encapsulating a set of access rights for a computer resource as a key; combining keys to form one or more key chains within the application policy layer; executing software within a computer to export key chains in the application policy layer as a key; importing at least one key from the application policy layer into the semantic policy layer; combining one or more keys in the semantic policy layer to form a key chain; exporting key chains in the semantic policy layer as keys; importing at least one key from the semantic policy layer to a local policy layer; combining one or more keys in the local policy layer to form one or more local policy key chains; and assigning users to local policy key chains in the local policy layer.
6. 33. A computer-implemented method of modifying a security policy, the method comprising: defining an application policy layer and a semantic policy layer; encapsulating a set of access rights for a computer resource as a key; combining keys to form one or more key chains within the application policy layer; executing software within a computer to export key chains in the application policy layer as a key; importing at least one key from the application policy layer into the semantic policy layer; combining one or more keys in the semantic policy layer to form a key chain; exporting key chains in the semantic policy layer as keys; importing at least one key from the semantic policy layer to a local policy layer; combining one or more keys in the local policy layer to form one or more local policy key chains; assigning users to local policy key chains in the local policy layer; constructing a role hierarchy by sorting the key chains into a partial ordering based on set containment; displaying the partial ordering as a role hierarchy graph; and adding and deleting keys from the role hierarchy graph.