US5446903A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method and apparatus for controlling access to data elements in a data processing system based on status of an industrial process by mapping user's security categories and industrial process steps
Assignee: International Business Machines Corp
•
Filing: 1993-05-04
•
Granted: 1995-08-29
•
Expires: 2013-05-04
Abstract
Abstract The security of data elements which represent an industrial process, which are manipulated by users on a data processing system and in which the industrial process includes a series of industrial process steps, are controlled by permitting groups of users to access predetermined data elements based on the industrial process step at which the industrial process is currently active. A user is prevented from accessing the requested element if the industrial process is not at an industrial process step corresponding to one of the industrial process steps for which the user has authority to access the data element. Thus, access to data is prevented based on the status of the data, in addition to the type of data. When selected database elements are associated with one of many locations, access is also denied to a user based on the location. Security access based on status and location may be provided in response to a change in the current industrial process step. Access authority to the data elements is changed compared to the access authority at the immediately preceding industrial process step based on mappings in one or more tables. Improved security of data elements which represent an industrial process is thereby provided.
Inventors
- 👤 Robert L. Abraham
- 👤 Herman Mitchell
- 👤 Badari N. Panuganti
- 👤 Laura A. Stowers
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-03 09:59
CPC Classifications
G; G06; G06F; G06F12/00; G06F12/14; G06F12/1458; G06F12/1483; G06F21/00; G06F21/60; G06F21/62; G06F21/6218; G06F2221/00; G06F2221/21; G06F2221/2113
Claims Analysis
Total Claims: 25
Claim 1
Independent Claim
239 words
A method for controlling security of data elements which represent an industrial process and which are manipulated by a plurality of users on a data processing system, said industrial process comprising a plurality of industrial process steps, said data security method comprising the steps of: assigning predetermined groups of said plurality of users to access predetermined groups of said data elements at predetermined ones of said industrial process steps; accepting a request from a user to access a data element; and preventing the access requesting user from accessing the requested data element if the access requesting user is not a member of one of said predetermined groups of said users which has been assigned access to a predetermined group of data elements which includes the requested data element or if the industrial process is not at an industrial process step corresponding to said predetermined ones of said industrial process steps; wherein said assigning step comprises the steps of: providing a first table executing on said data processing system, which maps said predetermined groups of users to corresponding security categories; providing a second table executing on said data processing system, which maps said plurality of industrial process steps to at least one old security category and to a corresponding at least one new security category; and in response to operator input, entering into said first and second tables user groups, industrial process steps and corresponding old and new security categories.
Claim 2
Independent Claim
239 words
A method for controlling security of data elements which represent an industrial process and which are manipulated by a plurality of users on a data processing system, said industrial process comprising a plurality of industrial process steps, said data security method comprising the steps of: assigning predetermined groups of said plurality of users to access predetermined groups of said data elements at predetermined ones of said industrial process steps; accepting a request from a user to access a data element; and preventing the access requesting user from accessing the requested data element if the access requesting user is not a member of one of said predetermined groups of said users which has been assigned access to a predetermined group of data elements which includes the requested data element or if the industrial process is not at an industrial process step corresponding to said predetermined ones of said industrial process steps; wherein said assigning step comprises the steps of: providing a first table executing on said data processing system, which maps said predetermined groups of users to corresponding security categories; providing a second table executing on said data processing system, which maps said plurality of industrial process steps to at least one old security category and to a corresponding at least one new security category; and in response to operator input, entering into said first and second tables user groups, industrial process steps and corresponding old and new security categories.
Claim 3
Dependent Claim
145 words
The method of claim 1 wherein said accepting step is preceded by the steps of: accepting an indication that said industrial process has progressed from a first industrial process step to a second industrial process step; identifying from said second table, old security categories and new security categories corresponding to said second industrial process step; identifying occurrences of security categories corresponding to said old security category in said first table; identifying data elements which include an associated security category corresponding to said old security category in said first table; and replacing the identified security category occurrences associated with said identified data elements, with the corresponding new security category from said second table; and wherein said access preventing step comprises the step of preventing the access requesting user from accessing the requested data elements based upon the replaced new security categories associated with said data elements.
Claim 4
Dependent Claim
128 words
The method of claim 1 wherein at least one of said predetermined user groups is associated with a plurality of locations, wherein selected data elements are associated with each of said locations, and wherein said access preventing step further comprises the step of: preventing an access requesting user associated with a predetermined location from accessing said selected database elements if the access requesting user is not a member of one of said predetermined groups of said users which has been assigned access to a predetermined group of data elements which includes said data element, if the industrial process is not at an industrial process step corresponding to said predetermined ones of said industrial process steps, and if said selected database elements are not associated with the predetermined location.
Claim 5
Dependent Claim
119 words
The method of claim 3 wherein said assigning step comprises the steps of: providing a first table executing on said data processing system, which maps said predetermined groups of users including user location to corresponding security categories; providing a second table executing on said data processing system, which maps said plurality of industrial process steps to at least one old security category and to a corresponding at least one new security category and at least one old location and a corresponding at least one new location; and in response to operator input, entering into said first and second tables user groups including user location, industrial process steps, corresponding old and new security categories and corresponding old and new locations.
Claim 6
Dependent Claim
153 words
The method of claim 4 wherein said accepting step is preceded by the steps of: accepting an indication that said industrial process has progressed from a first industrial process step to a second industrial process step; identifying from said second table, old security categories and new security categories and old locations and new locations corresponding to said second industrial process step; identifying occurrences of security categories and user locations corresponding to said old security category in said-first table; identifying data elements which include an associated security category corresponding to said old security category in said first table; and replacing the identified security category occurrences associated with said identified data elements with the corresponding new security category from said second table; and wherein said access preventing step comprises the step of preventing the access requesting user from accessing the requested data elements based upon the replaced new security categories associated with said data elements.
Claim 7
Dependent Claim
33 words
The method of claim 1 wherein said industrial process is a computer automated design and manufacturing process, and wherein each of said industrial process steps is a computer automated design or manufacturing step.
Claim 8
Dependent Claim
36 words
The method of claim 1 wherein said industrial process is an engineering change order process for a manufacturing process, and wherein said industrial process steps comprise steps for designing, revising and approving an engineering change order.
Claim 9
Dependent Claim
32 words
The method of claim 1 wherein said access preventing step comprises one of preventing reading, preventing writing and preventing both reading and writing of the requested data element by the requesting user.
Claim 10
Independent Claim
266 words
A method for controlling security of data elements which are manipulated by a plurality of users on a data processing system, said data security method comprising the steps of: assigning one of a series of status values to predetermined groups of said data elements, said series of status values representing progression of processing of said data elements through a series of processing steps on said data processing system; associating predetermined groups of said plurality of users with predetermined groups of said data elements and predetermined ones of said series of status values; accepting a request from a user to access a data element; and preventing the access requesting user from accessing the requested data element if the access requesting the user is not a member of one of said predetermined groups of said users associated with a predetermined group of data elements which includes the requested data element or if the status value associated with said predetermined group of data elements is not one of said predetermined ones of status values associated with said predetermined group of said users; wherein said assigning step comprises the steps of: providing a first table executing on said data processing system, which maps said predetermined groups of users to corresponding security categories; providing a second table executing on said data processing system, which maps said series of status values to at least one old security category and to a corresponding at least one new security category; and in response to operator input, entering into said first and second tables user groups, status values and corresponding old and new security categories.
Claim 11
Independent Claim
266 words
A method for controlling security of data elements which are manipulated by a plurality of users on a data processing system, said data security method comprising the steps of: assigning one of a series of status values to predetermined groups of said data elements, said series of status values representing progression of processing of said data elements through a series of processing steps on said data processing system; associating predetermined groups of said plurality of users with predetermined groups of said data elements and predetermined ones of said series of status values; accepting a request from a user to access a data element; and preventing the access requesting user from accessing the requested data element if the access requesting the user is not a member of one of said predetermined groups of said users associated with a predetermined group of data elements which includes the requested data element or if the status value associated with said predetermined group of data elements is not one of said predetermined ones of status values associated with said predetermined group of said users; wherein said assigning step comprises the steps of: providing a first table executing on said data processing system, which maps said predetermined groups of users to corresponding security categories; providing a second table executing on said data processing system, which maps said series of status values to at least one old security category and to a corresponding at least one new security category; and in response to operator input, entering into said first and second tables user groups, status values and corresponding old and new security categories.
Claim 12
Dependent Claim
126 words
The method of claim 9 further comprising the steps of: reassigning the status value which is associated with at least one of said predetermined groups of data elements; accepting a request from a user to access a data element which is associated with a reassigned group of data elements; and preventing the access requesting user from accessing the requested data element if the access requesting user is not a member of one of said predetermined groups of said users which is associated with the reassigned group of data elements or if the reassigned status value associated with said reassigned group of data elements is not one of said predetermined ones of status values associated with said predetermined group of said users including the access requesting user.
Claim 13
Dependent Claim
143 words
The method of claim 10 wherein said accepting step is preceded by the steps of: accepting an indication that said status value has progressed from a first status value to a second status value; identifying from said second table, old security categories and new security categories corresponding to said second status value; identifying occurrences of security categories corresponding to said old security category in said first table; identifying data elements which include an associated security category corresponding to said old security category in said first table; and replacing the identified security category occurrences associated with said identified data elements with the corresponding new security category from said second table; and wherein said access preventing step comprises the step of preventing the access requesting user from accessing the requested data elements based upon the replaced new security categories associated within said first data elements.
Claim 14
Dependent Claim
137 words
The method of claim 9 wherein at least one of said predetermined user groups is associated with a plurality of locations, wherein selected data elements are associated with each of said locations, and wherein said access preventing step further comprises the step of: preventing an access requesting user associated with a predetermined location from accessing said selected database elements if the access requesting user is not a member of one of said predetermined groups of said users which has been assigned access to a predetermined group of data elements which includes said data element, if the status value associated with said predetermined group of data elements is not one of said predetermined ones of status values associated with said predetermined group of data elements, and if said selected database elements are not associated with the predetermined location.
Claim 15
Dependent Claim
117 words
The method of claim 12 wherein said assigning step comprises the steps of: providing a first table executing on said data processing system, which maps said predetermined groups of users including user location to corresponding security categories; providing a second table executing on said data processing system, which maps said series of status values to at least one old security category and to a corresponding at least one new security category and at least one old location and a corresponding at least one new location; and in response to operator input, entering into said first and second tables user groups including user location, status values, corresponding old and new security categories and corresponding old and new locations.
Claim 16
Dependent Claim
151 words
The method of claim 13 wherein said accepting step is preceded by the steps of: accepting an indication that said status value has progressed from a first status value to a second status value; identifying from said second table, old security categories and new security categories and old locations and new locations corresponding to said second status value; identifying occurrences of security categories and user locations corresponding to said old security category in said first table; identifying data elements which include an associated security category corresponding to said old security category in said first table; and replacing the identified security category occurrences associated with said identified data elements with the corresponding new security category from said second table; and wherein said access preventing step comprises the step of preventing the access requesting user from accessing the requested data elements based upon the replaced new security categories associated with said data elements.
Claim 17
Dependent Claim
21 words
The method of claim 9 wherein each status value represents one of a series of computer automated design and manufacturing steps.
Claim 18
Dependent Claim
21 words
The method of claim 10 wherein each status value represents a step for designing revising and approving an engineering change order.
Claim 19
Dependent Claim
32 words
The method of claim 10 wherein said access preventing step comprises one of preventing reading, preventing writing and preventing both reading and writing of the requested data element by the requesting user.
Claim 20
Dependent Claim
234 words
A data security control system for data elements which represent an industrial process and which are manipulated by a plurality of users on a data processing system, said industrial process comprising a plurality of industrial process steps, said data security control system comprising: means for assigning predetermined groups of said plurality of users to access predetermined groups of said data elements at predetermined ones of said industrial process steps; and means, responsive to a user request to access a data element, for preventing the access requesting user from accessing the requested data element if the access requesting user is not a member of one of said predetermined groups of said users which has been assigned access to a predetermined group of data elements which includes the requested data element or if the industrial process is not at an industrial process step corresponding to said predetermined ones of said industrial process steps; wherein said assigning means comprises: a first table executing on said data processing system, which maps said predetermined groups of users to corresponding security categories; a second table executing on said data processing system, which maps said plurality of industrial process steps to at least one old security category and to a corresponding at least one new security category; and means for accepting operator entry into said first and second tables user groups, industrial process steps and corresponding old and new security categories.
Claim 21
Dependent Claim
234 words
A data security control system for data elements which represent an industrial process and which are manipulated by a plurality of users on a data processing system, said industrial process comprising a plurality of industrial process steps, said data security control system comprising: means for assigning predetermined groups of said plurality of users to access predetermined groups of said data elements at predetermined ones of said industrial process steps; and means, responsive to a user request to access a data element, for preventing the access requesting user from accessing the requested data element if the access requesting user is not a member of one of said predetermined groups of said users which has been assigned access to a predetermined group of data elements which includes the requested data element or if the industrial process is not at an industrial process step corresponding to said predetermined ones of said industrial process steps; wherein said assigning means comprises: a first table executing on said data processing system, which maps said predetermined groups of users to corresponding security categories; a second table executing on said data processing system, which maps said plurality of industrial process steps to at least one old security category and to a corresponding at least one new security category; and means for accepting operator entry into said first and second tables user groups, industrial process steps and corresponding old and new security categories.
Claim 22
Dependent Claim
150 words
The system of claim 20 further comprising: means for accepting an indication that said industrial process has progressed from a first industrial process step to a second industrial process step; means, responsive to said indication accepting means, for identifying from said second table, old security categories and new security categories corresponding to said second industrial process step, for identifying occurrences of security categories corresponding to said old security category in said first table and for identifying data elements which include an associated security category in said first table; and means, responsive to said identifying means, for replacing the identified security category occurrences associated with said identified data elements with the corresponding new security category from said second table; and wherein said access preventing means comprises means for preventing the access requesting user from accessing the requested data elements based upon the replaced new security categories associated with said data elements.
Claim 23
Dependent Claim
127 words
The system of claim 18 wherein at least one of said predetermined user groups is associated with a plurality of locations, wherein selected data elements are associated with each of said locations, and wherein said access preventing means further comprises means for preventing an access requesting user associated with a predetermined location from accessing said selected database elements if the access requesting user is not a member of one of said predetermined groups of said users which has been assigned access to a predetermined group of data elements which includes said data element, if the industrial process is not at an industrial process step corresponding to said predetermined ones of said industrial process steps, and if said selected database elements are not associated with the predetermined location.
Claim 24
Dependent Claim
113 words
The system of claim 20 wherein said assigning means comprises: a first table executing on said data processing system, which maps said predetermined groups of users including user location to corresponding security categories; a second table executing on said data processing system, which maps said plurality of industrial process steps to at least one old security category and to a corresponding at least one new security category and at least one old location and a corresponding at least one new location; and means for accepting operator entry into said first and second tables user groups including user location, industrial process steps, corresponding old and new security categories and corresponding old and new locations.
Claim 25
Dependent Claim
165 words
The system of claim 21 further comprising: means for accepting an indication that said industrial process has progressed from a first industrial process step to a second industrial process step; means, responsive to said indication accepting means, for identifying from said second table, old security categories and new security categories and old locations and new locations corresponding to said second industrial process step, for identifying occurrences of security categories and user locations corresponding to said old security category in said first table and for identifying data elements which include an associated security category corresponding to said old security category in said first table; and means, responsive to said identifying means, for replacing the identified security category occurrences associated with said identified data elements with the corresponding new security category from said second table; and wherein said access preventing means comprises means for preventing the access requesting user from accessing the requested data elements based upon the replaced new security categories associated with said data elements.
References Cited (Backward Citations)
US4525780A
Cited
US4698752A
Cited
US4713753A
Cited
US4807108A
Cited
US4807108B1
Cited
US5008853A
Cited
US5133075A
Cited
US5161225A
Cited
US5161223A
Cited
US5191534A
Cited
US5151987A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 1998-08-28 | 1999-02-27 | 1999-08-29 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2002-08-28 | 2003-02-27 | 2003-08-29 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2006-08-28 | 2007-02-27 | 2007-08-29 | $7700.00 | Window Closed / Lapsed |