# US 2017/0286652 A1 · Security model for network information service > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2017/0286652 A1 - Document ID: US20170286652A1 - Status: Published application - Kind: A1 - Application number: 15/630,248 - Filed: 2017-06-22 - Published: 2017-10-05 - Earliest claimed: 2012-07-06 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Bhushan P. JAIN; Sandeep R. PATIL; Sri RAMANATHAN; Gandhi SIVAKUMAR; Matthew B. TREVATHAN; Wijayaratnam WIJAYAKUMARAN - Web page: https://patentgrep.com/patent/US20170286652A1 ## CPC - G06F 21/31: User authentication - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems and methods for providing information security in a network environment are disclosed. The method includes initiating processing, invoked by a user, of at least one of a plurality of objects in a processing unit of a hardware layer, wherein the plurality of objects is hosted for a tenant. The method further includes determining that the processing of the at least one of the plurality of objects by the processing unit is authorized by the tenant based on a security map provided by the tenant and accessible by the processing unit within the hardware layer. The method further includes allowing the processing of the object based on a result of the determining. ## Claims ### Claim 1 A method, comprising: initiating processing of an object, invoked by a user having a dynamically varying credential, by a security processor comparing instructions of a plurality of objects in a processing unit of a hardware layer with information in a security map provided by a tenant; determining that the processing of the plurality of objects is authorized by the tenant based on the security map by determining the security map includes an association between at least one of the plurality of objects and a security code and an association between the object and a geographic region; sending a message to the tenant requesting the security code; comparing a response from the tenant with the security code in the security map; and allowing the processing of the object based on results of the determining that the processing of the plurality of objects is authorized by the tenant. ### Claim 2 (depends on 1) The method of claim 1, wherein the determining that the processing of the plurality of objects is authorized by the tenant comprises determining that the at least one of the plurality of objects is identified in the security map. ### Claim 3 (depends on 1) The method of claim 1, wherein the determining that the processing of the plurality of objects is authorized by the tenant comprises determining that the security map includes an association between the at least one of the plurality of objects and the credential of the user. ### Claim 4 (depends on 1) The method of claim 1, wherein the plurality of objects is hosted by the tenant that provided the dynamically varying credential to the user. ### Claim 5 (depends on 1) The method of claim 1, wherein the determining that the processing of the plurality of objects is authorized by the tenant is performed at more than one step of an instruction cycle. ### Claim 6 (depends on 1) The method of claim 1, wherein the initiating processing of an object comprises initiating an instruction cycle by the processing unit comprising a fetch, a decode, and an execute. ### Claim 7 (depends on 1) The method of claim 1, wherein invoking the initiating processing of an object includes compiling the object into a machine language. ### Claim 8 (depends on 1) The method of claim 1, wherein the steps of claim 1 are at least one of created, maintained, deployed and supported by a service provider. ### Claim 9 (depends on 1) The method of claim 1, wherein steps of claim 1 are provided by a service provider on a subscription, advertising, and/or fee basis. ### Claim 10 A system for providing an information service to a tenant comprising: a security processor comprising an external communication interface; and a computer-readable memory storing a security map of a tenant and accessible by the security processor, wherein the security processor is configured to: access the security map; receive authorization by the tenant for access to the security map by a user; send a message to the tenant requesting a security code via the external communication interface; compare a response received from the tenant with the security code in the security map; determine that the security map includes an association between an object and the security code; and determine whether the security map includes an association between an object and a geographic region. ### Claim 11 (depends on 10) The system of claim 10, wherein the security processor is configured to determine whether the object is identified in the security map. ### Claim 12 (depends on 10) The system of claim 10, wherein the security processor is configured to determine whether the security map includes an association between an object and a credential of the user. ### Claim 13 (depends on 10) The system of claim 10, further comprising the security processor is configured to determine that processing of the object is authorized by the tenant based on the security map. ### Claim 14 (depends on 13) The system of claim 13, wherein the security processor is configured to determine whether processing of the object is authorized by the tenant occurs at more than one step of an instruction cycle. ### Claim 15 (depends on 10) The system of claim 10, wherein the security processor and the computer-readable memory are located at a hardware layer. ### Claim 16 (depends on 10) The system of claim 10, further comprising: a service layer comprising a plurality of services, wherein a first of the plurality of services is hosted for a first tenant of the plurality of tenants; a hardware layer comprising: a central processing unit (CPU); the security processor having the external communication interface; and the computer-readable memory addressable by the security processor; wherein the external communication interface is configured to: receive the security map from the tenant via the external communication interface; and store the security map in the computer-readable memory. ### Claim 17 (depends on 16) The system of claim 16, wherein the security map associates an object of the tenant with a credential of the user. ### Claim 18 (depends on 17) The system of claim 17, wherein the credentials of the user dynamically vary and are provided by the tenant, and the security code dynamically varies and corresponds to a part of an object. ### Claim 19 (depends on 18) The system of claim 18, wherein the security processor is configured to: determine whether a response received from the tenant via the external communication interface matches the security code in the security map; and halt execution of the object. ### Claim 20 A computer program product comprising a computer readable storage medium having readable program code embodied in the storage medium, the computer program product being operable to: provide access to one or more objects stored within a library by receiving dynamically varying security codes corresponding to the one or more objects, at a hardware layer; determine that a processing of the one or more objects is authorized by an owner of the one or more objects based on a security map provided by the owner by determining that the security map includes an association between the one or more objects and the security codes and an association between the one or more objects and a geographic region; sending a message to the owner requesting the security codes; and comparing a response from the owner to the security codes in the security map.