International Business Machines Corporation

Guenter Karjoth

Thomas R Gross

Jan Leonard Camenisch

Paul Andrew Moskowitz

Robert J Von Gutfeld

Birgit Monika Pfitzmann

John C Dayka

Mark A Nelson

Matthias Schunter

Luke James O'Connor

Richard Henry Guski

Michael P Waidner

Linda Nancy Betz

Michael Backes

Walter Barlett Farrell

Gregory Neven

Andreas Schade

Michael Waidner

Christian Cachin

Christopher J Giblin

Christopher Mark Kenyon

Franz-Stefan Preiss

Charles Campbell Palmer

Klaus Julisch

Steven B Adler

Arthur Miles Gilbert

Elsie A Van Herreweghen

Martin Joseph Clayton Presler-Marshall

Nigel Howard Julian Brown

Endre Felix Bangerter

Dogan Kesdogan

Adam Charles Nelson

Michael Schnyder

Michael Robert McCullough

Joy Algesheimer

Elsie Van Herreweghen

A method for controlling access to a resource of an owner of the resource is provided. The owner can be a user of a resource computer system. The access control can be based on social network data of a social network system and/or on an owner token relating to the owner or a requester token relating to a requester requesting access to the resource and an access control policy. The owner token and the requester token can be received by the system to determine by the social networking system whether access to the resource is to be granted based on the content of the owner token and the requester token. A social network identity of the owner and a social network identity of the requester may only be determinable by the social network system.

Anonymously sharing resources based on social network user data

A policy data structure defines predetermined authorizations, each relating to authorization of at least one user to access at least one resource as well as to dynamic access requests. Each dynamic access request indicates a condition to be satisfied by a respective set of attributes associated with a user request to access a resource and for the request to be granted in absence of an authorization determinative of the request. If the structure does not define an authorization for a request to access a resource, it is determined whether the structure defines a dynamic access requirement determinative for the request, and if so, whether to grant the request in accordance with the respective set of attributes associated with the request. For at least one request, after determining whether to grant the request, a dynamic authorization relating to authorization to access the resource within the request is added to the structure.

Access control in data processing systems

Access control in data processing system

Given a new user U or a user whose role in the organization changed, an automated method of the present disclosure in one aspect determines the new or revised access permissions the user should have. In one aspect, the method of the present disclosure automatically determines access rights based on the access rights held by similar users. This general idea, including a formalization of similarity between users, the details of how access rights are determined, and an algorithm to test if the presented methods are safe to use are provided.

Method and apparatus for automated assignment of access permissions to users

The present invention relates to a privacy method for responding to read request. The present invention further relates to a device for generating a response signal and a computer program product. Methods and systems in accordance with embodiments of the invention validate, whether a read request is directed at a target tag to be protected, and, upon a match, respond to the read request by sending a response signal.

Privacy method, device and computer program

A system for anonymous separation of duties with credentials includes an identity provider, the identity provider configured to issue anonymous credentials to a user based on one or more attributes of the user; a service provider, the service provider configured to issue a pseudonym to the user based on the user's anonymous credentials, and to associate the user's pseudonym with a step of an instance of a business process hosted on the service provider, the step being completed by the user; and an auditor, the auditor configured to determine if the completion of the step of the instance of the business process by the user is compliant with a separation of duties policy.

Anonymous separation of duties with credentials

A computer implemented access control system, the system includes a database for storing a serialized version of an XACML permissions hierarchy. The system also includes a memory for storing an original version of the XACML permissions hierarchy, and an XACML serialization engine configured to convert the XACML permissions hierarchy into the serialized version, wherein the serialized version contains a listing of at least a portion of the predicates possible in the XACML permission hierarchy and the effect on each of the portion of the predicates.

Serialization of XACML policies

Methods and apparatus are provided for generating an access control policy data structure for a single-authorization-query access control system from a source policy data structure of an access control system in which primary authorizations can be subject to auxiliary constraints. Authorizations in the data structures are defined in terms of subject, resource and action elements. For each resource in a set of resources in the source policy data structure, the data structure is analyzed to identify primary authorizations relating to that resource. For each primary authorization, policy data which represents a policy defining an access rule expressing that authorization is generated and stored in system memory and analyzed to identify any auxiliary constraints associated with that primary authorization. For each auxiliary constraint so identified, policy data is generated and stored in system memory.

Access control policy conversion

The present invention relates to a tag identification system comprising: a plurality of tags, each tag being identifiable by an associated tag identifier, and at least one tag comprising at least one link to at least one other tag in said group.

Tag identification system

For detecting a blocker RFID tag, the following steps are conducted. First, a random identifier of a given bit length is created. Alternatively, an identifier is selected out of a probing set, which is stored on a data storage device. The probing set comprises of identifiers, which are not being used as identifiers for a given set of RFID tags. In a second step, a response from all RFID tags is requested having an identifier matching the random identifier or, respectively, the selected identifier. In a third step, it is determined, depending on receiving or not receiving a response, whether the blocker RFID tag is present.

Detecting a blocker RFID tag

The invention provides methods, apparatus and systems for securely processing an originator request of a customer. This originator request can be sent to at least one first entity. An example of a method for processing the originator request comprises the steps of a) sending from the customer the originator request to each first entity; b) connecting each first entity to a computation entity; c) each first entity, adding, on receipt of the originator request, information concerning the originator request thereby forming a first-modified request; d) sending at least part of the first-modified request to at least the computation entity; e) the computation entity having received at least part of the first-modified request deriving a computation-entity result from the at least part of the first-modified request; f) sending at least part of the computation-entity result to each first entity; g) each first entity having received at least part of the computation-entity result deriving therefrom a first-entity result and forwarding it at least in part; and h) the customer having received at least part of the first-entity result, deriving therefrom a customer result.

Method and system for processing a request of a customer

The invention provides protection to wireless portable transponders from unauthorized interrogation by employing a mechanical means for disabling reception by or from the antenna of the transponder. Transponders include RFID tags that are attached to items that a persons may purchase or carry. Such transponders generally have means for receiving and storing electronic and other information, commonly in binary form using memories as in electronic circuits, etc. The invention is designed to provide privacy of electronic information. The tags can be protected from receiving or providing unauthorized or unwanted information. The invention provides the mechanical means that permit the owner to decide when reception/interrogation of personal or other information is not desired by employing the provided mechanical disable control means.

System and method for disabling RFID tags

A data access control facility is implemented by assigning personally identifying information (PII) classification labels to PII data objects, with each PII data object having one PII classification label assigned thereto. The control facility further includes at least one PII purpose serving function set (PSFS) comprising a list of application functions that read or write PII data objects. Each PII PSFS is also assigned a PII classification label. A PII data object is accessible via an application function of a PII PSFS having a PII classification label that is identical to or dominant of the PII classification label of the PII object. A user of the control facility is assigned a PII clearance set which contains a list of at least one PII classification label, which is employed in determining whether the user is entitled to access a particular function.

Implementation and use of PII data access control facility employing personally identifying information labels and purpose serving function sets

Growing community of inventors

Waedenswil, Switzerland

Guenter Karjoth