Method and system for implementing changes to security policies in a distributed security system
IPC분류정보
국가/구분
United States(US) Patent
등록
국제특허분류(IPC7판)
G06F-021/00
G06F-015/16
G06F-009/445
출원번호
UP-0186203
(2002-06-26)
등록번호
US-7565683
(2009-07-29)
발명자
/ 주소
Huang, Weiqing
Supramaniam, Senthilvasan
Vainstein, Klimenty
대리인 / 주소
Sterne, Kessler, Goldstein & Fox PLLC
인용정보
피인용 횟수 :
36인용 특허 :
306
초록▼
Improved approaches for effectuating changes to security policies in a distributed security system are disclosed. The changes to security policies are distributed to those users (e.g., user and/or computers) in the security system that are affected. The distribution of such changes to security polic
Improved approaches for effectuating changes to security policies in a distributed security system are disclosed. The changes to security policies are distributed to those users (e.g., user and/or computers) in the security system that are affected. The distribution of such changes to security policies can be deferred for those affected users that are not activated (e.g., logged-in or on-line) with the security system.
대표청구항▼
What is claimed is: 1. A method for distributing a security policy change within a security system distributed over a computer network, the computer network having at least a server machine and a plurality of user computers, said method comprising: (a) receiving a security policy change at a server
What is claimed is: 1. A method for distributing a security policy change within a security system distributed over a computer network, the computer network having at least a server machine and a plurality of user computers, said method comprising: (a) receiving a security policy change at a server machine of the computer network; (b) determining those one or more users that are affected by the security policy change; (c) preparing a security policy change message for the one or more users that are determined to be affected by the security policy change; (d) delivering the one or more security policy change messages to the user computers associated with the affected users who are logged into the system in such a manner as to be able to receive the security policy change message, and (e) caching the security policy changing messages for users not logged into the system in such a manner so as to be able to receive the security policy change messages. 2. The method as recited in claim 1, whereby only the user computers associated with the affected users receive the security policy change messages. 3. The method as recited in claim 1, wherein the security policy change alters at least one of an access rule or a group's membership. 4. The method as recited in claim 1, wherein the computer network is an enterprise computer network. 5. The method as recited in claim 1, wherein the security policy change, when effectuated, affects restrictive access to files secured by the security system. 6. The method as recited in claim 1, wherein the security policy change messages cause an action at the user computers that receive the security policy change messages. 7. The method as recited in claim 6, wherein the action is a forced logout of at least one of the user computers from the security system. 8. The method as recited in claim 1, wherein said delivering comprises: deferring delivery of at least one the one or more security policy change messages that are destined for the user computers associated with the affected users. 9. The method as recited in claim 1, wherein said delivering (d) comprises: (d1) determining whether the affected users are logged into the security system, and (d2) deferring delivery of the one or more security policy change messages that are destined for the user computers associated with the affected users that are not logged into the security system. 10. The method as recited in claim 9, further comprising (e) subsequently delivering one or more of the security policy change messages that have been deferred and cached to the corresponding affected users when the corresponding affected users subsequently log into the security system. 11. The method as recited in claim 9, wherein said deferring (d2) operates to store the one or more security policy change messages being deferred into a delivery queue. 12. The method as recited in claim 1, wherein said delivering (d) comprises: (d1) determining locations for the affected users within the security system, and (d2) forwarding the one or more security policy change messages to corresponding ones of the users' computers at the determined locations for the affected users. 13. The method as recited in claim 1, wherein said caching (e) comprises: (e1) identifying at least one of the one or more security policy change messages that is to be delivered on a deferred basis; (e2) determining whether the identified security policy change message affects any other security policy changes messages resident in a delivery queue; and (e3) modifying one or more of the other security policy change messages in the delivery queue based at least in part on the identified security policy change message. 14. The method as recited in claim 13, wherein said caching (e) further comprises: (e4) storing the identified security policy change message into the delivery queue, whereby the identified security policy change message is thereafter delivered on a deferred basis. 15. The method as recited in claim 13, wherein said caching (e) further comprises: (e4) storing the identified security policy change message into the delivery queue; and (e5) subsequently delivering one or more of the security policy change messages that have been stored in the delivery queue to the corresponding affected users when the corresponding affected users subsequently log into the security system. 16. A tangible computer readable storage medium having computer program code recorded thereon, that when executed by a processor, causes a processor to distribute a security policy change within a security system distributed over a computer network, the computer network having at least a server machine and a plurality of user computers, the computer readable storage medium comprising: computer program code that enables the processor to receive a security policy change at a server machine of the computer network; computer program code that enables the processor to determine those one or more users that are affected by the security policy change; computer program code that enables the processor to prepare a security policy change message for the one or more users that are determined to be affected by the security policy change; and computer program code that enables the processor to (a) deliver the one or more security policy change messages to the user computers associated with the affected users who are logged into the system in such a manner as to be able to receive such policy change message, and (b) cache policy changing messages for users not logged into the system in such a manner so as to be able to receive such policy change messages. 17. The computer readable storage medium as recited in claim 16, wherein said computer program code for delivering comprises: computer program code that enables the processor to defer delivery of at least one the one or more security policy change messages that are destined for the user computers associated with the affected users. 18. The computer readable storage medium as recited in claim 16, wherein the computer program code that enables the processor to deliver for delivering comprises: computer program code that enables the processor to determine whether the affected users are logged into the security system, and computer program code that enables the processor to defer delivery of the one or more security policy change messages that are destined for the user computers associated with the affected users that are not logged into the security system. 19. The computer readable storage medium as recited in claim 18, wherein said computer program code for delivering further comprises: computer program code that enables the processor to subsequently deliver one or more of the security policy change messages that have been deferred to the corresponding affected users when the corresponding affected users subsequently log into the security system. 20. The computer storage readable medium as recited in claim 16, wherein said computer program code for delivering comprises: computer program code that enables the processor to determine locations for the affected users within the security system, and computer program code that enables the processor to forward the one or more security policy change messages to corresponding ones of the users' computers at the determined locations for the affected users. 21. The computer readable storage medium as recited in claim 16, wherein the computer program code for delivering comprises: computer program code that enables the processor to identify at least one of the one or more security policy change messages that is to be delivered on a deferred basis; computer program code that enables the processor to determine whether the identified security policy change message affects any other security policy changes messages resident in a delivery queue; and computer program code that enables the processor to modify one or more of the other security policy change messages in the delivery queue based at least in part on the identified security policy change message. 22. The computer readable storage medium as recited in claim 21, wherein the computer program code that enables the processor to deliver further comprises: computer program code that enables the processor to store the identified security policy change message into the delivery queue; and computer program code for subsequently delivering one or more of the security policy change messages that have been stored in the delivery queue to the corresponding affected users when the corresponding affected users subsequently log into the security system.
연구과제 타임라인
LOADING...
LOADING...
LOADING...
LOADING...
LOADING...
이 특허에 인용된 특허 (306)
Edward M. Scheidt ; Ersin L. Domangue, Access control and authorization system.
Just, Michael K.; Van Oorschot, Paul, Apparatus and method for reducing transmission bandwidth and storage requirements in a cryptographic security system.
Bahl, Paramvir; Venkatachary, Srinivasan; Balachandran, Anand, Authentication methods and systems for accessing networks, authentication methods and systems for accessing the internet.
Strickler Gary E. ; Knapp Herbert William ; Holenstein Bruce D. ; Holenstein Paul J., Bidirectional database replication scheme for controlling ping-ponging.
Peinado,Marcus, Binding a digital license to a portable device or the like in a digital rights management (DRM) system and checking out/checking in the digital license to/from the portable device or the like.
Brownlie,Michael; Hillier,Stephen; Van Oorschot,Paul C., Computer network security system and method having unilateral enforceable security policy provision.
Reed Drummond Shattuck ; Heymann Peter Earnshaw ; Mushero Steven Mark ; Jones Kevin Benard ; Oberlander Jeffrey Todd ; Banay Dan, Computer-based communication system and method using metadata defining a control structure.
Reed Drummond Shattuck ; Heymann Peter Earnshaw ; Mushero Steven Mark ; Jones Kevin Benard ; Oberlander Jeffrey Todd, Computer-based communication system and method using metadata defining a control-structure.
Auerbach Joshua Seth (Ridgefield CT) Chow Chee-Seng (Cupertino CA) Kaplan Marc Adam (Katonah NY) Crigler Jeffrey Charles (McLean VA), Creation and distribution of cryptographic envelope.
Ehrsam William F. (Kingston NY) Elander Robert C. (Saugerties NY) Matyas Stephen M. (Poughkeepsie NY) Meyer Carl H. W. (Kingston NY) Sahulka Richard J. (Woodstock NY) Tuchman Walter L. (Woodstock NY), Cryptographic file security for multiple domain networks.
Yoshino, Kenji; Ishibashi, Yoshihito; Akishita, Toru; Shirai, Taizo; Ito, Takeshi; Hayashi, Shigekazu, Data processing device, data storage device, data processing method, and program providing medium for storing content protected under high security management.
Hecht Matthew S. (Potomac MD) Johri Abhai (Gaithersburg MD) Wei Tsung T. (Gaithersburg MD) Steves Douglas H. (Austin TX), Distributed security auditing subsystem for an operating system.
Ohtsu Toshiyuki,JPX, Dynamic adding system for memory files shared among hosts, dynamic adding method for memory files shared among hosts, and computer-readable medium recording dynamic adding program for memory files sh.
Downs Edgar ; Gruse George Gregory ; Hurtado Marco M. ; Lehman Christopher T. ; Milsted Kenneth Louis ; Lotspiech Jeffrey B., Electronic content delivery system.
Kuroda, Yasutsugu; Kamada, Jun; Iwase, Shoko; Noda, Bintatsu; Ono, Etsuo, Electronic data storage apparatus with key management function and electronic data storage method.
Smith Jeffrey C. ; Bandini Jean-Christophe, Electronic document delivery system in which notification of said electronic document is sent to a recipient thereof.
Tozawa,Jun; Nogami,Hiroshi; Shibayama,Tetsuya; Kataoka,Tomohiro; Fujio,Hiroshi, Encryption and decryption communication semiconductor device and recording/reproducing apparatus.
Elmer Thomas I. (Sunnyvale CA) Nguyen Tuan T. (Milpitas CA) Lin Rung-Pan (San Jose CA), Encryption of streams of addressed information to be used for program code protection.
Shimbo Atsushi,JPX ; Takahashi Toshinari,JPX ; Tomoda Ichiro,JPX ; Murota Masao,JPX, File editing system and shared file editing system with file content secrecy, file version management, and asynchronous.
Eshel Marc M. (Tarrytown NY) Hunt Guerney D. H. (Ithaca NY) Jones Donald N. (Vestal NY) Meyer Christopher (Vestal NY) Schwartz Frederick A. (Binghamton NY), File manager for files shared by heterogeneous clients.
Kumar,Sanjay; Thomas,Stanton L.; Deshpande,Gaurav M.; Murty,Venkataesh V., Fulfillment management system for managing ATP data in a distributed supply chain environment.
Bonn, David Wayne; Marvais, Nick Takaski, Generalized network security policy templates for implementing similar network security policies across multiple networks.
Shimizu Hideo,JPX ; Hori Satomi,JPX ; Endoh Naoki,JPX ; Saisho Toshiaki,JPX, Information processing system having function of securely protecting confidential information.
Asano,Tomoyuki; Osawa,Yoshitomo, Information recording device, information playback device, information recording method, information playback method, and information recording medium and program providing medium used therewith.
Pensak David A. ; Cristy John J. ; Singles Steven J., Information security architecture for encrypting documents for remote access while maintaining access control.
Law,Gary K.; Deitz,David L.; Schleiss,Trevor Duncan; Naidoo,Julian, Integrated electronic signatures for approval of process control and safety system software objects.
Phillips,Robert S.; Davis,Scott H.; Dietterich,Daniel J.; Nyman,Scott E.; Porter,David, Internet-based shared file service with native PC client access and semantics.
Phillips,Robert S.; Davis,Scott H.; Dietterich,Daniel J.; Nyman,Scott E.; Porter,David, Internet-based shared file service with native PC client access and semantics and distributed access control.
Thomsen,Daniel Jay; O'Brien,Richard; Bogle,Jessica; Payne,Charles, Locally adaptable central security management in a heterogeneous network environment.
John E. Parsons, Jr. ; Bradley J. Graziadio ; Oshoma Momoh, Maintaining a first session on a first computing device and subsequently connecting to the first session via different computing devices and adapting the first session to conform to the different com.
Zavalkovsky,Arthur; Elfassy,Nitsan, Method and apparatus for communicating network quality of service policy information to a plurality of policy enforcement points.
McLaughlin Michael D. (San Jose CA) Signa John C. (Sunnyvale CA) Greicar Richard K. (Moss Beach CA) Taylor John M. (London GB2), Method and apparatus for display calibration and control.
Batten-Carew Mark,CAX ; Buchler Marek,CAX ; Hiller Stephen William,CAX ; Otway Josanne Mary,CAX, Method and apparatus for processing administration of a secured community.
Basani, Vijay R.; Mangiapudi, Krishna; Murach, Lynne M.; Karge, Leroy R.; Revsin, Vitaly S.; Bestavros, Azer; Crovella, Mark E.; LaRosa, Domenic J., Method and apparatus for reliable and scalable distribution of data files in distributed networks.
Sames, David L.; Whitmore, Brent S.; Niebuhr, Brian S.; Tally, Gregg W., Method and apparatus for securely and dynamically modifying security policy configurations in a distributed system.
DeMello, Marco A.; Keely, Leroy B.; Byrum, Frank D.; Yaacovi, Yoram; Hughes, Kathryn E., Method and system for binding enhanced software features to a persona.
Hauser Ralf,CHX ; Janson Philippe,CHX ; Molva Refik,FRX ; Tsudik Gene,CHX ; Van Herreweghen Elsie,CHX, Method and system for changing an authorization password or key in a distributed communication network.
Halter Bernard J. (Longmont CO) Bracco Alphonse M. (Reston VA) Johnson Donald B. (Manassas VA) Le An V. (Manassas VA) Matyas Stephen M. (Manassas VA) Prymak ; deceased Rostislaw (late of Dumfries VA , Method and system for multimedia access control enablement.
Krueger, Scott; Goodman, Daniel, Method and system for seamless integration of preprocessing and postprocessing functions with an existing application program.
Chan, Shannon; Jensenworth, Gregory; Goertzel, Mario C.; Shah, Bharat; Swift, Michael M.; Ward, Richard B., Method and system for secure running of untrusted content.
Komuro Teruyoshi,JPX ; Osawa Yoshitomo,JPX ; Shima Hisato ; Asano Tomoyuki,JPX, Method and system for transferring information using an encryption mode indicator.
Lambert Howard Shelton,GBX ; Orchard James Ronald Lewis,GBX, Method for controlling access to electronically provided services and system for implementing such method.
Bala,Vasanth; Smith,Michael D., Method for protecting digital content from unauthorized use by automatically and dynamically integrating a content-protection agent.
Skarbo Rune A. ; Clitheroe Cameron J. ; Lawless Christopher C. ; Kukkal Puneet ; Hochman Stephen D., Method for web based storage and retrieval of documents.
Richard Patrick,CAX ; Csinger Andrew,CAX ; Knipe Bruce,CAX ; Woodward Bruce,CAX, Method of and apparatus for providing secure distributed directory services and public key infrastructure.
Shamoon,Talal G.; Hill,Ralph D.; Radcliffe,Chris D.; Hwa,John P.; Sibert,W. Olin; Van Wie,David M., Methods and apparatus for persistent control and protection of content.
Arlein,Robert M.; Jai,Ben; Jakobsson,Bjorn Markus; Monrose,Fabian; Reiter,Michael Kendrick, Methods and apparatus for providing privacy-preserving global customization.
Beattie,Douglas D.; Creighton, Jr.,Neal Lewis; Bailey,Christopher T. M.; Remy,David L.; Hamandi,Hani, Methods and systems for automated authentication, processing and issuance of digital certificates.
Schmuck Frank B. ; Zlotek Anthony J. ; Shmueli Boaz,ILX ; Mandler Benjamin,ILX ; Yehudai Zvi Yosef,ILX ; Kish William A., Parallel file system with method using tokens for locking modes.
Matyas, Jr., Stephen Michael; Peyravian, Mohammad; Roginsky, Allen Leonid; Zunic, Nevenko, Secure data storage and retrieval with key management and user authentication.
Rose Anthony M. (66 Drumalbyn Road Bellevue Hill ; Sydney AUX 2023), Securing a computer against undesired write operations to or read operations from a mass storage device.
Davis, Mark C.; Hind, John R.; Peters, Marcia L.; Topol, Brad B., Selective data encryption using style sheet processing for decryption by a group clerk.
William J. Bolosky ; John R. Douceur ; Scott M. Cutshall ; Richard F. Rashid ; Nathan P. Myhrvold ; David A. Goebel, Single instance store for file systems.
Takahashi Toshinari,JPX ; Nogami Hiroyasu,JPX, Software distribution system and software utilization scheme for improving security and user convenience.
Barlow, Doug; Dillaway, Blair; Fox, Barbara; Lipscomb, Terry; Spies, Terrence, System and method for configuring and managing resources on a multi-purpose integrated circuit card using a personal computer.
Rusnak David J. ; Zientara John T., System and method for controlling access rights to and security of digital content in a distributed information system, e.g., Internet.
Carman David W. ; Balenson David M. ; Tajalli Homayoon ; Walker Stephen T., System and method for controlling access to a user secret using a key recovery field.
Richard R. Viets ; David G. Motes ; Paula Budig Greve ; Wayne W. Herberg, System and method for controlling access to documents stored on an internal network.
Viets, Richard R.; Motes, David G.; Greve, Paula Budig; Herberg, Wayne W., System and method for controlling access to documents stored on an internal network.
Lipner Steven B. (Oakton VA) Balenson David M. (Olney MD) Ellison Carl M. (Baltimore MD) Walker Stephen T. (Glenwood MD), System and method for data recovery.
Olsen, Theis; Bundesen, Rune Windfeld; Hougaard, Claes Christian; Nordly, Trygve Thor, System and method for ensuring secure transfer of a document from a client of a network to a printer.
Dennis, Michael W.; Freed, Michele L.; Plastina, Daniel; Flo, Eric R.; Kays, Jr., David E.; Corrington, Robert E., System and method for implementing group policy.
Michael W. Dennis ; Michele L. Freed ; Daniel Plastina ; Eric R. Flo ; David E. Kays, Jr. ; Robert E. Corrington, System and method for implementing group policy.
Kiessig,Rick; Yost,David A.; Mathon,John D., System and method for managing content with event driven actions to facilitate workflow and other features.
Sakurai Hiroshi (Tokyo JPX) Ikeda Nobuyuki (Tokyo JPX) Watabe Akehiro (Tokyo JPX), System and method for processing document information using password protected icons that represent document content.
Premkumar Thomas Devanbu ; Stuart Gerald Stubblebine, System and method for providing assurance to a host that a piece of software possesses a particular property.
Dixon Peggy PakFan ; Shi Danling ; Verburg Richard Lee ; Wood Donald Edwin, System and method for transferring a session from one application server to another without losing existing resources.
Bess, Dwayne Lamarr; Brischke, Harold Allan; Keller, Andrew Charles; Wagner-Krankel, Dale Alan; Tijerina, Jacob Garza; Connolly, Jr., Billy Ray; O'Connor, Karen Ann; McDaniel, James William; Lewis, R, System and method of providing electronic access to one or more documents.
McDonnal William D. (Tigard OR) Lohstroh Shawn (Beaverton OR) Grawrock David (Aloha OR), System for automatic decryption of file data on a per-use basis and automatic re-encryption within context of multi-thre.
Bacha, Hamid; Carroll, Robert Bruce; Mirlas, Lev; Tchao, Sung Wei, System for electronic repository of data enforcing access control on data search and retrieval.
Riedel,Erik; Karamanolis,Christos; Kallahalla,Mahesh; Swaminathan,Ram, System for ensuring data privacy and user differentiation in a distributed file system.
Hahn Samuel S. ; LeGault Kenn ; Wheeler Maxon ; Degenhardt Jon R., System for organizing document icons with suggestions, folders, drawers, and cabinets.
Donaghey, Robert J.; Carielli, Sandra E.; Helinek, Pamela, System for selecting and disseminating active policies to peer device and discarding policy that is not being requested.
Krishnaswamy, Sridhar; Elliott, Isaac K.; Reynolds, Tim E.; Forgy, Glen A.; Solbrig, Erin M., System, method and article of manufacture for a communication system architecture including video conferencing.
Ginter Karl L. ; Shear Victor H. ; Sibert W. Olin ; Spahn Francis J. ; Van Wie David M., Systems and methods for secure transaction management and electronic rights protection.
Ginter Karl L. ; Shear Victor H. ; Spahn Francis J. ; Van Wie David M., Systems and methods for the secure transaction management and electronic rights protection.
Davis Mark Charles ; Gray Steve D. ; Kuehr-McLaren David Gerard ; Morrison Ian A. ; Shoriak Timothy G., Systems, methods and computer program products for authenticating client requests with client certificate information.
Bly Sara A. (Mountain View CA) Hodges Jeffrey D. (Newark CA) Kupfer Michael D. (Mountain View CA) Lewis Brian T. (Palo Alto CA) Tallan Michael L. (Mountain View CA) Tom Stephen B. (San Francisco CA), Updating local copy of shared data in a collaborative system.
Okamoto Toshio,JPX ; Shimbo Atsushi,JPX ; Ishiyama Masahiro,JPX, User identification data management scheme for networking computer systems using wide area network.
Vainstein, Klimenty; Nath, Satyajit; Ouye, Michael Michio, Method and apparatus for transitioning between states of security policies used to secure electronic documents.
Vainstein, Klimenty; Nath, Satyajit; Ouye, Michael Michio, Method and apparatus for transitioning between states of security policies used to secure electronic documents.
Huang, Weiqing; Supramaniam, Senthilvasan; Vainstein, Klimenty, Method and system for implementing changes to security policies in a distributed security system.
Siklos, Robert E.; Kashepava, Stanislav; Marchand, Troy A., Methods and systems for providing a discussion thread to key performance indicator information.
Garcia, Denis Jacques Paul; Ouye, Michael Michio; Rossmann, Alain; Crocker, Steven Toye; Gilbertson, Eric; Huang, Weiqing; Humpich, Serge; Vainstein, Klimenty; Ryan, Nicholas Michael, Methods and systems for providing access control to secured data.
Garcia, Denis Jacques Paul; Ouye, Michael Michio; Rossmann, Alain; Crocker, Steven Toye; Gilbertson, Eric; Huang, Weiqing; Humpich, Serge; Vainstein, Klimenty; Ryan, Nicholas Michael, Methods and systems for providing access control to secured data.
Garcia, Denis Jacques Paul; Ouye, Michael Michio; Rossmann, Alain; Crocker, Steven Toye; Gilbertson, Eric; Huang, Weiqing; Humpich, Serge; Vainstein, Klimenty; Ryan, Nicholas Michael, Methods and systems for providing access control to secured data.
Garcia, Denis Jacques Paul; Ouye, Michael Michio; Rossmann, Alain; Crocker, Steven Toye; Gilbertson, Eric; Huang, Weiqing; Humpich, Serge; Vainstein, Klimenty; Ryan, Nicholas Michael, Methods and systems for providing access control to secured data.
Marchand, Troy A.; Bhavnani, Ravindar A.; Dobrin, Adrian Serban; Sheflin, Terrence Eugene; Siklos, Robert E., Systems and methods for generating data visualization dashboards.
Marchand, Troy A.; Sheflin, Terrence Eugene; Bhavnani, Ravindar A.; Dobrin, Adrian Serban; Siklos, Robert E., Systems and methods for generating data visualization dashboards.
Lauter, Kristin Estella; Bellare, Mihir; Benaloh, Josh; Chase, Melissa E.; Horvitz, Erik J.; Karkanias, Chris Demetrios, User-specified sharing of data via policy and/or inference from a hierarchical cryptographic store.
※ AI-Helper는 부적절한 답변을 할 수 있습니다.