Patent ID: 7647630
Filing Date: 2010-01-12
Classification: G06F

Abstract:
1. A method, in a data processing system, for authorizing information flows between devices of the data processing system, the method comprising: generating a hash key based on an information object; performing a lookup operation in a hash table based on the hash key; determining if an entry in the hash table at an index corresponding to the hash key identifies a labelset for the information object; storing a labelset, identifying a sensitivity of the information object, in the entry at the index corresponding to the hash key for the information object if a labelset for the information object is not identified in the entry in the hash table; and receiving a request for authorization of an information flow involving the information object from a first device to a second device; retrieving contents of the information object from a source of the information object; generating a hash key based on the contents of the information object; performing a lookup operation in the hash table based on the hash key to identify a labelset associated with the information object; and performing one or more authorization operations based on the labelset associated with the information object, wherein performing one or more authorization operations comprises comparing the labelset associated with the information object and a labelset of a source of the information object with a labelset associated with a target of the information flow, wherein comparing the labelset associated with the information object and the labelset of the source with a labelset associated with a target of the information flow comprises performing at least one set theory operation on the labelsets, and wherein the at least one set theory operation is performed by at least one security policy module identified in the labelset associated with the information object and the labelset associated with the target of the information flow, and wherein results generated by each of the at least one security policy module are combined to generate a single result indicating whether the information flow is authorized.