US6311269B2
Expired / Lapsed
US
⏱️ 0.0 years remaining
Trusted services broker for web page fine-grained security labeling
Assignee: Leidos Innovations Technology Inc.
•
Filing: 1998-06-15
•
Granted: 2001-10-30
•
Expires: 2018-06-15
Abstract
Abstract Arbitrarily fine-grained limitation of access to information stored in a resource of a data processor network is provided in a manner compatible with existing network browsers by mapping user identity and credentials with randomly assigned security cookie information which thus serves as a surrogate credential accompanying each user request during a session. Labels are imbedded within HTML files/text which may embody any desired security policy, including mandatory access control (MAC) arrangements which are not available through native browser functions. Data is retrieved in response to a user request which includes a security cookie from a location in the resource which is not directly accessible through use of a URL; the location being stored in a configuration file which is hidden from users. The retrieved data is then filtered in accordance with labels provided for each page and/or embedded in the text and used to build a response which may include hypertext links or other user interfaces for transmission to the user. Provision is made for viewing or changing of labels, credentials and passwords.
Inventors
- 👤 Gary L. Luckenbaugh
- 👤 Forrest E. Stoakes
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-07 12:39
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/60; G06F21/62; G06F21/6218; G06F21/6227; G06F16/00; G06F16/90; G06F16/95; G06F2211/00; G06F2211/009; G06F2221/00; G06F2221/21; G06F2221/2113
Claims Analysis
Total Claims: 18
Claim 1
Independent Claim
229 words
A method of limiting access to information stored in HTML files on a fine-grained basis and independent of HTML contents, accessible by a web server through a CGI script, according to security label constructs imbedded within web-server stored HTML, said information comprising a definition of HTML label structures recognizable by said CGI script, said method comprising steps of dynamically storing at said web server a mapping of a web cookie value to user credentials retrieved from CGI accessible registry storage, thereby establishing said web cookie as a security cookie in said mapping, creating a set of said credentials by prompting a user for authentication information, validating said authentication information against user information retrieved from said CGI accessible registry storage, performed in response to a request for retrieval of a stored HTML file that was not accompanied by a recognized web cookie name and value as contained within said mapping, retrieving said stored HTML file in response to a request from a user accompanied by said security cookie value, filtering said stored HTML file with said CGI scripts as a function of security label constructs embedded in the HTML file in accordance with a comparison to said user credentials associated with said security cookie value to form filtered information in the form of standard HTML in accordance with said HTML label structures, and returning said filtered information to said user.
Claim 2
Independent Claim
229 words
A method of limiting access to information stored in HTML files on a fine-grained basis and independent of HTML contents, accessible by a web server through a CGI script, according to security label constructs imbedded within web-server stored HTML, said information comprising a definition of HTML label structures recognizable by said CGI script, said method comprising steps of dynamically storing at said web server a mapping of a web cookie value to user credentials retrieved from CGI accessible registry storage, thereby establishing said web cookie as a security cookie in said mapping, creating a set of said credentials by prompting a user for authentication information, validating said authentication information against user information retrieved from said CGI accessible registry storage, performed in response to a request for retrieval of a stored HTML file that was not accompanied by a recognized web cookie name and value as contained within said mapping, retrieving said stored HTML file in response to a request from a user accompanied by said security cookie value, filtering said stored HTML file with said CGI scripts as a function of security label constructs embedded in the HTML file in accordance with a comparison to said user credentials associated with said security cookie value to form filtered information in the form of standard HTML in accordance with said HTML label structures, and returning said filtered information to said user.
Claim 3
Dependent Claim
64 words
A method as recited in claim 1 , including the further steps of supporting credential formats corresponding to any of a plurality of modes of access control with a definition within CGI accessible registry storage, storing credential information in forms which support said CGI accessible registry storage definitions, and providing said HTML security label structures which correspond to said CGI accessible registry storage definitions.
Claim 4
Dependent Claim
33 words
A method as recited in claim 2 , wherein said credential formats include a discretionary access control mode and a mandatory access control mode for defining user credentials and HTML embedded security labels.
Claim 5
Dependent Claim
35 words
A method as recited in claim 1 , wherein said HTML label structure identifies text within said HTML file and provides authorization control for access and alteration of the HTML label structure by the user.
Claim 6
Dependent Claim
25 words
A method as recited in claim 1 , wherein said HTML security label structure includes a coarse-grained option controlling access to the entire HTML file.
Claim 7
Dependent Claim
43 words
A method as recited in claim 1 , wherein said web cookie value is set without specification of a lifetime of said web cookie value, whereby said web cookie value is destroyed upon termination of a web session in which it is set.
Claim 8
Dependent Claim
17 words
A method as recited in claim 1 , wherein said request including said security cookie is encrypted.
Claim 9
Dependent Claim
26 words
A method as recited in claim 1 , including the further step of adding function information to said filtered information to be sent to said user.
Claim 10
Dependent Claim
36 words
A method as recited in claim 8 , wherein said function information includes a hypertext link to a CGI program which supplies a web HTML form containing current credentials and allows change of said current credentials.
Claim 11
Dependent Claim
35 words
A method as recited in claim 8 , wherein said function information includes a hypertext link to a CGI program which supplies a web HTML form which allows change of user password of said user.
Claim 12
Dependent Claim
25 words
A method as recited in claim 8 , wherein said function information includes a hypertext link to a CGI program which provides a logout function.
Claim 13
Dependent Claim
27 words
A method as recited in claim 8 , wherein said function information includes image information indicating the location of a label in text of said HTML file.
Claim 14
Dependent Claim
33 words
A method as recited in claim 8 , wherein said function information includes a hypertext link to a CGI program which allows change of said HTML label structures in accordance with user credentials.
Claim 15
Dependent Claim
92 words
A method as recited in claim 1 , wherein said CGI scripts convert HTML hypertext links to a CGI format to the web client and wherein said filtering step includes the further step of converting said hypertext link to a CGI URL upon selection of said hypertext link by a user to invoke further CGI filtering functions such that accessing other HTML though such hypertext links will be subject to the same CGI script security label filtering mechanism, whereby a web administrator may include non-CGI hypertext links within the security labelled HTML.
Claim 16
Dependent Claim
25 words
A method as recited in claim 1 , including the further step of validating user passwords using cryptographic password representations within said CGI accesssible registry.
Claim 17
Dependent Claim
50 words
A method as recited in claim 1 , wherein said CGI scripts are configurable to return enhanced information to the user, said enhanced information including an indication of label existence and icon-visible hypertext links allowing view or change of label information in the web page in accordance with user credentials.
Claim 18
Dependent Claim
50 words
A method as recited in claim 8 , wherein said CGI scripts are configurable to return enhanced information to the user, said enhanced information including an indication of label existence and icon-visible hypertext links allowing view or change of label information in the web page in accordance with user credentials.
References Cited (Backward Citations)
US5940591A
Cited
US5375244A
Cited
US5590199A
Cited
US5606668A
Cited
US5416842A
Cited
US5623601A
Cited
US5550984A
Cited
US5623656A
Cited
US5657390A
Cited
US5638446A
Cited
US5602918A
Cited
US5862325A
Cited
US5961601A
Cited
US6006228A
Cited
US5889958A
Cited
US5875296A
Cited
US6041357A
Cited
US6049877A
Cited
US6052785A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2004-10-29 | 2005-04-30 | 2005-10-30 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2008-10-29 | 2009-04-30 | 2009-10-30 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2012-10-29 | 2013-04-30 | 2013-10-30 | $7700.00 | Window Closed / Lapsed |