Patent ID: 8024565
Filing Date: 2011-09-20
Classification: G06F

Abstract:
1. A method, in a data processing system, for authorizing information flows between devices of the data processing system, the method comprising: receiving an information flow request from a first device to authorize an information flow from the first device to a second device, wherein the information flow request includes an identifier of the second device; retrieving, based on an identification of the first device and the identifier of the second device, security information identifying an authorization level of the first device and second device; determining a sensitivity of an information object that is to be transferred in the information flow; and authorizing or denying the information flow based only on the sensitivity of the information object and the authorization level of the first and second devices irregardless of the particular action being performed on the information object as part of the information flow, wherein: the security information comprises a first labelset associated with the identifier of the first device and a second labelset associated with the identifier of the second device, the first and second labelsets identify authorization levels of the first and second devices, respectively, the sensitivity of the information object comprises a third labelset associated with the information object, authorizing or denying the information flow based only on the sensitivity of the information object and the authorization level of the first and second devices comprises performing at least one set theory operation on the first, second and third labelsets, and authorizing or denying the information flow based on results of the at least one set theory operation.