Method for controlling access to electronically provided services and system for implementing such method

Claim 3

A method according to claim 1 , wherein said user key is an hierarchical key including data for generating a different access key for each of a plurality of different access levels for each of the authority levels which the user possesses.

Claim 4

A method according to claim 2 , wherein the storing step comprises storing the objects in an encrypted form and said generated access keys are decryption keys.

Claim 5

A data processing system including means for controlling user access to data or services, the system including: means for storing said data or services in applets of an object oriented programming language in a form accessible only under the control of one or more access keys; smartcard means containing a key generator for generating, using a user ID entered by the user and key data contained in the smartcard means, a user key representing a user's authority levels for accessing data or services; and means, responsive to a user request for access to stored data or services, accompanied by the user key, for determining the access level of the requested data or services; and means for generating from said user key an access key for accessing the requested data or services if one of the user's authority levels as represented by the user key matches the determined access level.

Claim 6

A data processing system including means for controlling user access to data or services, the system including: means for storing said data or services in applets of an object oriented programming language in a form accessible only under the control of one or more access keys; smartcard means containing a key generator for generating, using a user ID entered by the user and key data contained in the smartcard means, a user key representing a user's authority levels for accessing data or services; and means, responsive to a user request for access to stored data or services, accompanied by the user key, for determining the access level of the requested data or services; and means for generating from said user key an access key for accessing the requested data or services if one of the user's authority levels as represented by the user key matches the determined access level.

Claim 7

A data processing system according to claim 4 , wherein said means for generating user keys is adapted to generate a hierarchical key string including data for generating a separate access key for each of a plurality of different access levels.

Claim 8

A data processing system according to claim 5 , wherein said means for storing includes means for encrypting said applets providing said data or services and wherein said means for generating an access key comprises means for generating a decryption key.

Claim 9

An article of manufacture comprising a computer usable medium having computer readable program code means embodied therein for causing the control of user access to data or services via a computer system, the computer readable program code means in said article of manufacture comprising computer readable program code for performing the steps of: storing said data or services as encrypted applets of an object oriented programming language in a form accessible only under the control of one or more access keys said applets containing a security level encoded therein; providing a decryption algorithm for responding to a user key from a smartcard generator for generating from a user input identifying the user and key data contained in the smartcard, the user key representing a user's authority level or levels for accessing specific encrypted applets containing data or services; in response to a user request for access to stored data or services in an encrypted applet, determining the access level contained in that applet with the decryption algorithm and then interrogating the user key for that authority level, if the user's authority level as represented by the user key matches the determined access level, generating from said user key an access key for accessing said data or services.

Claim 10

An article of manufacture comprising a computer usable medium having computer readable program code means embodied therein for causing the control of user access to data or services via a computer system, the computer readable program code means in said article of manufacture comprising computer readable program code for performing the steps of: storing said data or services as encrypted applets of an object oriented programming language in a form accessible only under the control of one or more access keys said applets containing a security level encoded therein; providing a decryption algorithm for responding to a user key from a smartcard generator for generating from a user input identifying the user and key data contained in the smartcard, the user key representing a user's authority level or levels for accessing specific encrypted applets containing data or services; in response to a user request for access to stored data or services in an encrypted applet, determining the access level contained in that applet with the decryption algorithm and then interrogating the user key for that authority level, if the user's authority level as represented by the user key matches the determined access level, generating from said user key an access key for accessing said data or services.

Claim 11

An article of manufacture as recited in claim 7 , wherein said user key is an hierarchical key including data for generating a separate access key for each of a plurality of different access levels.

Claim 12

A program storage device readable by machine, tangibly embodying a program of instructions executable by the machine to perform method steps for controlling user access to data or services via a computer system, said method steps comprising: storing said data or services as a hierarchy of applets of an object oriented programming language, the applets at each level of the hierarchy accessible only under the control of a different access key for each of the levels; providing users with a user key representing the user's authority level for accessing specific data or services; and in response to a user request for access to said stored data or services, accompanied by said user key, determining the access level of the applet of the requested data or services and, if the user's has an authority level, represented in the user key, that matches the determined access level, generating from said user key an access key for accessing said data or services wherein said user key is a hierarchical key string including data for generating a separate access key for each of a plurality of different access levels.

Claim 13

A program storage device readable by machine, tangibly embodying a program of instructions executable by the machine to perform method steps for controlling user access to data or services via a computer system, said method steps comprising: storing said data or services as a hierarchy of applets of an object oriented programming language, the applets at each level of the hierarchy accessible only under the control of a different access key for each of the levels; providing users with a user key representing the user's authority level for accessing specific data or services; and in response to a user request for access to said stored data or services, accompanied by said user key, determining the access level of the applet of the requested data or services and, if the user's has an authority level, represented in the user key, that matches the determined access level, generating from said user key an access key for accessing said data or services wherein said user key is a hierarchical key string including data for generating a separate access key for each of a plurality of different access levels.

Claim 14

A program storage device readable by machine as recited in claim 9 , wherein the storing step comprises storing data and/or application modules in an encrypted form and said generated access keys are decryption keys.

Claim 15

A program storage device readable by machine as recited in claim 9 , wherein said user key is dynamically generated on a smartcard of the user in response to a user request initiated by presentation of a token by a user, from token data read from said token and personal data provided by the user to the smartcard.

Claim 16

The method of claim 1 including providing a decoding means in said smartcard for decoding the data.

Claim 17

The method of claim 3 including providing a user key with a fixed number of bit positions irrespective of the authority level or levels of the user with certain of the bit positions being unused and the remaining bit positions forming different combinations each combination of bit positions being for a different authority level.

Claim 18

The method of claim 13 including embedding in each of the encrypted objects the security level allocated to that particular object.

Claim 19

The method of claim 14 including having the decryption algorithm select the combination of bit positions from the user key assigned to the authority level of the particular object.

Claim 20

The method of claim 15 including providing an audit trail at the time of generating of the access key including information identifying the user and any operator involved in the transaction together with the date of the transaction.

Claim 21

The data processing system of claim 4 , wherein said smartcard means provides a user key with a fixed number of bit positions irrespective of the authority level or levels of the user with certain of the bit positions being unused and the remaining bit positions forming different combinations each combination of bit positions being for a different authority level.

Claim 22

The data processing system of claim 4 , wherein the encrypted applets contain encoded therein the security level allocated to the particular applet.

Claim 23

The data processing system of claim 17 including a decryption algorithm that selects the bit positions from the user key assigned to the authority level of the particular applet.

Claim 24

The article of manufacture of claim 7 , wherein the decryption algorithm is responsive to a user key with a fixed number of bit positions irrespective of the authority level or levels of the user with certain of the bit positions being unused and the remaining bit positions forming different combinations each combination of bit positions being for a different authority level.

Claim 25

The article of manufacture of claim 19 including having the decryption algorithm select the combination of bit positions from the user key assigned to the authority level of the particular object.

Claim 26

The article of manufacture of claim 20 including providing an audit trail at the time of generating of the access key including information identifying the user and any operator involved in the transaction together with the date of the transaction.

Claim 27

The article of manufacture of claim 9 , wherein the decryption algorithm is responsive to a user key with a fixed number of bit Positions irrespective of the authority level or levels of the user with certain of the bit positions being unused and the remaining bit positions; forming different combinations each combination of bit positions being assigned to a different authority level.

Claim 28

The article of manufacture of claim 22 including having the decryption algorithm select the combination of bit positions from the user key assigned to the authority level of the particular object.