Trusted services broker for web page fine-grained security labeling

Abstract

Arbitrarily fine-grained limitation of access to information stored in a resource of a data processor network is provided in a manner compatible with existing network browsers by mapping user identity and credentials with randomly assigned security cookie information which thus serves as a surrogate credential accompanying each user request during a session. Labels are imbedded within HTML files / text which may embody any desired security policy, including mandatory access control (MAC) arrangements which are not available through native browser functions. Data is retrieved in response to a user request which includes a security cookie from a location in the resource which is not directly accessible through use of a URL; the location being stored in a configuration file which is hidden from users. The retrieved data is then filtered in accordance with labels provided for each page and / or embedded in the text and used to build a response which may include hypertext links or other user interfaces for transmission to the user. Provision is made for viewing or changing of labels, credentials and passwords.

Description

[0001] 1. Field of the Invention[0002] The present invention generally relates to computer networks including shared resources and, more particularly, to computer networks selectively providing access to information to a plurality of users through a web browser / server interface in accordance with user credentials.[0003] 2. Description of the Prior Art[0004] With the growing familiarity and ubiquity of the Internet and World Wide Web for exchange of information, similarly styled and functioning information exchange systems are being provided on more or less private intranet (e.g. within a business or organization) and extranet (among a select group of cooperating businesses or organizations) network systems for exchange of data among, for example, employees of an organization or company connected thereto. The familiarity of users with internet browsers enhances their efficiency and comfort with using systems which operate similarly and provide similar interfaces in intranet and extra...

AI Technical Summary

Benefits of technology

[0019] It is another object of the invention to provide the service by limiting installation of invention items to web server machines, avoiding the need to install anything on web browser clients.

[0021] It is yet another object of the invention to provide a convenient arrangement for changing credentials, viewing and changing of fine-grained labels, changing of passwords and ensuring a logout function.

[0022] It is another further object of the invention to enhance known web server functions by supporting user authentication through CGI scripts, to map MAC and DAC credentials to users, embed security labels within HTML files and provide for changes of password, labels, credentials, MAC ranges and / or DAC role lists.

Problems solved by technology

Such systems can employ firewalls, virtual private network technology, or other technologies to limit access to computing resources to some subset of users, and thus completely deny access to others.

Such capabilities are not supported by native web server security.

Strictly speaking, even this is not necessarily true, if a user alters the cookie value as stored in the disk cookie file.

In fact, cookie names and values can never be used as the basis for providing security features, unless they are utterly hidden from users, to prevent cookie inspection or alteration.

Images