Determining and applying assurance levels for application operations security

A system and method of providing security for an application. A request to use an application to perform an operation using information is received from an operator by a computer system. In response to receiving the request, an operator identity assurance level of the operator and characteristics of the operation using the information are determined. An operation assurance level for the operation is determined based on the characteristics of the operation using the information. It is determined whether the operator identity assurance level of the operator satisfies the operation assurance level for the operation. The operator is allowed to use the application to perform the operation using the information in response to a determination that the operator identity assurance level of the operator satisfies the operation assurance level for the operation.

BACKGROUND INFORMATION

The present disclosure relates generally to systems and methods for providing security for an application by controlling who may use the application to perform an operation. More particularly, the present disclosure relates to a method and apparatus for providing security for an application using assurance levels for an operator and for an operation using information that the operator requests to perform using the application.

Businesses and other organizations may provide or make use of various computer-implemented applications for performing various operations. Operators may access the functionality of such applications through application programming interfaces, APIs. Application programming interfaces enable the integration of applications internally, between applications of a particular organization, and externally, between applications of more than one different organizations.

Operators may use applications to perform operations that access or manipulate various types of information. Such information may range from public information to confidential organization and personal information. Access to and manipulation of confidential information via an application should be properly secured. One important aspect of securing an application is operator identify assurance. Operator identity assurance includes ensuring that an operator using an application is authorized to use the application to perform an operation.

Operator identity assurance may be provided by assigning assurance levels to various different operator roles. Authorizations to access applications to perform various operations may be assigned to each role. A role that has a greater set or higher level of assigned authorizations may require a greater level of identity assurance. Operator authentication requirements and methods may be established that are appropriate for the level of identity assurance associated with a particular role.

Accordingly, it would be beneficial to have a method and apparatus that take into account one or more of the issues discussed above as well as possibly other issues.

SUMMARY

An embodiment of the present disclosure provides a method of providing security for an application. A request to use an application to perform an operation using information is received from an operator by a computer system. In response to receiving the request, an operator identity assurance level of the operator and characteristics of the operation using the information are determined. An operation assurance level for the operation is determined based on the characteristics of the operation using the information. It is determined whether the operator identity assurance level of the operator satisfies the operation assurance level for the operation. The operator is allowed to use the application to perform the operation using the information in response to a determination that the operator identity assurance level of the operator satisfies the operation assurance level for the operation.

Another embodiment of the present disclosure provides a method of providing security for an application. A request to use an application to perform an operation using information is received from an operator by a computer system. In response to receiving the request, an operator identity assurance level of the operator and characteristics of the operation using the information are determined. Determining the characteristics of the operation using the information comprises determining a sensitivity level of the information, determining how the information will be used by the operation, determining an owner of the information, and determining a relationship between the operator and the owner of the information. An operation assurance level for the operation is determined based on the characteristics of the operation using the information. It is determined whether the operator identity assurance level of the operator satisfies the operation assurance level for the operation. The operator is allowed to use the application to perform the operation using the information in response to a determination that the operator identity assurance level of the operator satisfies the operation assurance level for the operation.

Yet another embodiment of the present disclosure provides an apparatus for providing security for an application comprising a receiver, an operator identifier, an operation assurance level identifier, and an assurance level verifier. The receiver is configured to receive a request from an operator to use an application to perform an operation using information. The operator identifier is configured to determine an operator identity assurance level of the operator in response to receiving the request. The operation assurance level identifier is configured to determine characteristics of the operation using the information in response to receiving the request and an operation assurance level for the operation based on the characteristics of the operation using the information. The assurance level verifier is configured to determine whether the operator identity assurance level of the operator satisfies the operation assurance level for the operation and to allow the operator to use the application to perform the operation using the information in response to a determination that the operator identity assurance level of the operator satisfies the operation assurance level for the operation.

DETAILED DESCRIPTION

The illustrative embodiments recognize and take into account one or more different considerations. For example, the illustrative embodiments recognize and take into account that a current method of providing application security comprises assigning assurance levels to operator roles. In this case, an operator in a particular role may be allowed to access all applications and perform all operations that are authorized for the particular role. Individual specific operations performed by a specific operator currently are not assessed to ensure that the assurance level of the operator meets the required assurance level for a particular operation.

The illustrative embodiments provide a system and method for verifying that the identity assurance level of an operator satisfies the required identity assurance level for a particular operation that the operator desires to perform using a particular application. Illustrative embodiments derive and assign an operation assurance level for a particular operation to be performed at run-time, in response to a request from an operator to perform the operation. The operation assurance level is compared to the operator identity assurance level of the operator that is requesting to perform the operation. The operator is allowed to use the application to perform the requested operation only if it is verified that the operator identity assurance level of the operator satisfies the operation assurance level of the operation to be performed.

In accordance with an illustrative embodiment, the operation assurance level of an operation to be performed may be determined at run-time by determining various characteristics of the operation. Such characteristics may include the sensitivity level of the information to be used by the operation, how the information will be used by the operation, the owner of the information, and the relationship between the owner of the information and the operator that is requesting to perform the operation.

In accordance with one example of an illustrative embodiment, the characteristics of the operation may be used to classify the operation into a use case profile. The operation assurance level for the operation then may be assigned as a pre-determined required operation assurance level for the use case profile.

With reference now to the figures and, in particular, with reference toFIG. 1, a pictorial representation of a network of data processing systems is depicted in which illustrative embodiments may be implemented. Network data processing system100is a network of computers in which the illustrative embodiments may be implemented. Network data processing system100contains network102, which is the medium used to provide communications links between various devices and computers connected together within network data processing system100. Network102may include connections, such as wire, wireless communication links, or fiber optic cables.

In the depicted example, server computer104and server computer106connect to network102along with storage unit108. In addition, client devices110connect to network102. In the depicted example, server computer104provides information, such as boot files, operating system images, and applications to client devices110. As depicted, client devices110include client computer112, client computer114, and client computer116. Client devices110can be, for example, computers, workstations, or network computers. Further, client devices110can also include other types of client devices such as mobile phone118, tablet computer120, and smart glasses122. In this illustrative example, server computer104, server computer106, storage unit108, and client devices110are network devices that connect to network102in which network102is the communications media for these network devices. Some or all of client devices110may form an Internet of things (IoT) in which these physical devices can connect to network102and exchange information with each other over network102.

Client devices110are clients to server computer104in this example. Network data processing system100may include additional server computers, client computers, and other devices not shown. Client devices110connect to network102utilizing at least one of wired, optical fiber, or wireless connections.

Program code located in network data processing system100can be stored on a computer-recordable storage medium and downloaded to a data processing system or other device for use. For example, program code can be stored on a computer-recordable storage medium on server computer104and downloaded to client devices110over network102for use on client devices110.

Turning toFIG. 2, an illustration of a block diagram of an application security system is depicted in accordance with an illustrative embodiment. Application security system200may be implemented in a computer system, such as network data processing system100inFIG. 1.

For example, without limitation, application security system200may be implemented in computer system202that is operated by or for organization204. Organization204may be a business206or any other appropriate entity. For example, computer system202may be operated by organization204for use by business206or another organization.

Computer system202may provide various applications208. Applications208may be configured to perform various operations using various types of information. For example, without limitation, applications208may be used to perform various operations that are related to the operation of business206or another organization204.

Applications208may be accessed and used by operator210via user interface212on operator device214. Operator210may be a human operator. User interface212may be implemented in any appropriate manner to allow operator210to interact with computer system202, including applications208. Operator device214may include any appropriate device on which user interface212may be implemented. For example, without limitation, operator device214may be implemented as one of client devices110in network data processing system100inFIG. 1.

Application security system200is configured to provide security for applications208by controlling access to use of applications208by operator210. Application security system200comprises receiver216, operator identifier218, operation assurance level identifier220, and assurance level verifier222.

Receiver216is configured to receive request224from operator210to use application226in applications208. Request224may indicate operation228that is to be performed using application226and information230that is to be used in performing operation228.

Receiver216also may be configured to receive credential information232. Credential information232may include any appropriate information that may be provided by operator210or from another source that may be used to validate the identity of operator210.

Operator identifier218is configured to determine operator identity assurance level234for operator210. Operator identity assurance level234indicates a level of information that operator210may access or modify. Operator identifier218may use credential information232for operator210to determine operator identity assurance level234for operator210.

Operator identity assurance level234may be based on role236of operator210. For example, without limitation, role236of operator210may be employee238, manager240, administrator242, or other244appropriate role236. Each different role236may be associated with a different appropriate operator identity assurance level234.

Operation assurance level identifier220is configured to determine operation assurance level246for operation228using information230that is requested by operator210to be performed using application226. In accordance with an illustrative embodiment, operation assurance level246may be determine at run-time, in response to receiving request224from operator210to use application226. Operation assurance level246may be determined based on characteristics of operation228using information230. A more detailed example of operation assurance level identifier220is described below with reference toFIG. 3.

Assurance level verifier222is configured to determine whether operator identity assurance level234of operator210satisfies operation assurance level246for operation228. Operator210is allowed to use application226to perform operation228only if operator identity assurance level234of operator210satisfies operation assurance level246.

Turning toFIG. 3, an illustration of a block diagram of an operation assurance level identifier is depicted in accordance with an illustrative embodiment. Operation assurance level identifier300is an example of one implementation of operation assurance level identifier220inFIG. 2.

Operation assurance level identifier300is configured to determine operation assurance level302for an operation using information that is requested to be performed by an operator. In accordance with an illustrative embodiment, operation assurance level302is determined based on characteristics304of the requested operation using information. Characteristics304may include one or more of sensitivity level306of the information, how the information will be used308by the operation, owner310of the information, and relationship312of the operator to the owner of the information. In one example, characteristics304may include all of sensitivity level306of the information, how the information will be used308by the operation, owner310of the information, and relationship312of the operator to the owner of the information.

Sensitivity level306of the information may be selected from public314, internal use only316, confidential318, and restricted320. For example, information that is confidential318may include personal information322. Both sensitive324and non-sensitive326personal information322may be classified as confidential318.

Sensitivity level306may be determined by processing the request that is received from an operator to perform an operation using information. For example, the request may comprise a request message that includes a message body and a number of parameters. The message body may comprise the information to be processed by the requested operation. The parameters may be any variables that are communicated as part of the message but are not part of the message body. The contents of the message body and message parameters may be processed using a rule or database that defines data sensitivities to identify the sensitivity level of the contents of the message body and message parameters and, therefore, sensitivity level306of the request from the request message.

Sensitivity level306also may take into account the sensitivity level of information in the response to the request that will be provided by an application performing the requested operation. For example, the response may comprise a response message that includes a message body and a number of parameters. The contents of the message body and message parameters of the response message may be processed in the same manner as the request message, to identify the sensitivity level of the contents of the message body and message parameters and, therefore, the sensitivity level of the response from the response message. Sensitivity level306of the information for the requested operation as a whole then may be selected as the more sensitive of the sensitivity level of the request or the sensitivity level of the response.

How the information will be used308by the operation may be selected from using the operation to change328the information or using the operation to view only330the information without changing the information. Owner310of the information may be, for example, individual332or organization334. Relationship312of the operator to the owner of the information may be, for example, operator is individual owner336of the information, operator is not individual owner338of the information, operator is member of organization owner340of the information, or operator is not member of organization owner342of the information.

Operation assurance level identifier300may include operation classifier344and assurance level assignor346. Operation classifier344may be configured to use characteristics304of the operation to classify the operation into use case profile348. Assurance level assignor346may be configured to determine operation assurance level302for the operation by using pre-generated mapping348of use case profiles350to corresponding required operation assurance levels352to identify required operation assurance level354for use case profile348. Required operation assurance level354then may be assigned as operation assurance level302for the operation.

Turning toFIG. 4, an illustration of a flowchart of a process for providing security for an application is depicted in accordance with an illustrative embodiment. Process400may be implemented, for example, in application security system200inFIG. 2.

Process400may begin with receiving a request from an operator to use an application to perform an operation using information (operation402). An operator identity assurance level for the operator is determine (operation404). Characteristics of the requested operation using the information also are determined (operation406). An operation assurance level for the operation then is determined based on the characteristics of the operation using the information (operation408).

It then is determined whether the operator identity assurance level for the operator satisfies the operation assurance level for the operation (operation410). If the operator identity assurance level for the operator does satisfy the operation assurance level for the operation, the operator is allowed to use the requested application to perform the operation using the information (operation412), with the process terminating thereafter. If the operator identity assurance level for the operator does not satisfy the operation assurance level for the operation, the operator is prevented from using the requested application (operation414), with the process terminating thereafter.

Turning toFIG. 5, an illustration of a flowchart of a process for determining an operator identity assurance level of an operator is depicted in accordance with an illustrative embodiment. Process500is an example of one implementation of operation404inFIG. 4.

Process500begins with receiving credential information for identifying an operator (operation502). The credential information is then used to determine the operator identity assurance level of the operator (operation504), with the process terminating thereafter.

Turning toFIG. 6, an illustration of a flowchart of a process for determining an operation assurance level of an operation is depicted in accordance with an illustrative embodiment. Process600is an example of one implementation of operation408inFIG. 4.

Process600begins with using the characteristics of the operation using the information to classify the operation into a use case profile (operation602). A required operation assurance level for the use case profile is then assigned as the operation assurance level for the operation (operation604), with the process terminating thereafter.

Turning now toFIG. 7, an illustration of a block diagram of a data processing system is depicted in accordance with an illustrative embodiment. Data processing system500may be used to implement one or more of server computer104inFIG. 1, server computer106inFIG. 1, client devices110inFIG. 1, computer system202inFIG. 2, and operator device214inFIG. 2. In this illustrative example, data processing system700includes communications framework702, which provides communications between processor unit704, memory706, persistent storage708, communications unit710, input/output unit712, and display714. In this example, communications framework702may take the form of a bus system.

Processor unit704serves to execute instructions for software that may be loaded into memory706. Processor unit704may be a number of processors, a multi-processor core, or some other type of processor, depending on the particular implementation. In an embodiment, processor unit704comprises one or more conventional general purpose central processing units (CPUs). In an alternate embodiment, processor unit704comprises one or more graphical processing units (CPUs).

Memory706and persistent storage708are examples of storage devices716. A storage device is any piece of hardware that is capable of storing information, such as, for example, without limitation, at least one of data, program code in functional form, or other suitable information either on a temporary basis, a permanent basis, or both on a temporary basis and a permanent basis. Storage devices716may also be referred to as computer-readable storage devices in these illustrative examples. Memory706, in these examples, may be, for example, a random access memory or any other suitable volatile or non-volatile storage device. Persistent storage708may take various forms, depending on the particular implementation.

For example, persistent storage708may contain one or more components or devices. For example, persistent storage708may be a hard drive, a flash memory, a rewritable optical disk, a rewritable magnetic tape, or some combination of the above. The media used by persistent storage708also may be removable. For example, a removable hard drive may be used for persistent storage708.

Communications unit710, in these illustrative examples, provides for communications with other data processing systems or devices. In these illustrative examples, communications unit710is a network interface card.

Input/output unit712allows for input and output of data with other devices that may be connected to data processing system700. For example, input/output unit712may provide a connection for user input through at least one of a keyboard, a mouse, or some other suitable input device. Further, input/output unit712may send output to a printer. Display714provides a mechanism to display information to a user.

Instructions for at least one of the operating system, applications, or programs may be located in storage devices716, which are in communication with processor unit704through communications framework702. The processes of the different embodiments may be performed by processor unit704using computer-implemented instructions, which may be located in a memory, such as memory706.

These instructions are referred to as program code, computer-usable program code, or computer-readable program code that may be read and executed by a processor in processor unit704. The program code in the different embodiments may be embodied on different physical or computer-readable storage media, such as memory706or persistent storage708.

Program code718is located in a functional form on computer-readable media720that is selectively removable and may be loaded onto or transferred to data processing system700for execution by processor unit704. Program code718and computer-readable media720form computer program product722in these illustrative examples. In one example, computer-readable media720may be computer-readable storage media724or computer-readable signal media726.

In these illustrative examples, computer-readable storage media724is a physical or tangible storage device used to store program code718rather than a medium that propagates or transmits program code718. Alternatively, program code718may be transferred to data processing system700using computer-readable signal media726.

Computer-readable signal media726may be, for example, a propagated data signal containing program code718. For example, computer-readable signal media726may be at least one of an electromagnetic signal, an optical signal, or any other suitable type of signal. These signals may be transmitted over at least one of communications links, such as wireless communications links, optical fiber cable, coaxial cable, a wire, or any other suitable type of communications link.

Further, as used herein, “computer-readable media” can be singular or plural. For example, program code718can be located in computer-readable media720in the form of a single storage device or system. In another example, program code718can be located in computer-readable media720that is distributed in multiple data processing systems. In other words, some instructions in program code718can be located in one data processing system while other instructions in program code718can be located in another data processing system. For example, a portion of program code718can be located in computer-readable media720in a server computer while another portion of program code718can be located in computer-readable media720located in a set of client computers.

The description of the different illustrative embodiments has been presented for purposes of illustration and description and is not intended to be exhaustive or limited to the embodiments in the form disclosed. The different illustrative examples describe components that perform actions or operations. In an illustrative embodiment, a component may be configured to perform the action or operation described. For example, the component may have a configuration or design for a structure that provides the component an ability to perform the action or operation that is described in the illustrative examples as being performed by the component.