# US 8,752,207 B2 · Security token and system and method for generating and decoding the security token > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,752,207 B2 - Document ID: US8752207B2 - Status: Granted - Kind: B2 - Application number: 12/600,792 - Filed: 2008-05-19 - Published: 2010-07-15 - Granted: 2014-06-10 - Earliest claimed: 2007-05-18 - Assignees: Secure Keys Pty Limited - Applicants: David Ian Finlayson; Mark Alexander Stocks - Inventors: David Ian Finlayson; Mark Alexander Stocks - Web page: https://patentgrep.com/patent/US8752207B2 ## CPC - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract The present invention provides a system and method for encoding and decoding security labels utilizable in a computing system. The method for encoding includes, in part, ascribing an integer value to each one of a set of characteristics. Thereafter, to encode a particular security label, the integer values for each of the set of characteristics that describe the label are combined to arrive at a single integer value. ## Claims ### Claim 1 A computerized method for encoding an information security label associated with a set of information in a database in a file and utilizable in a computing system for controlling read access to the set of information, the database being accessed by one or more users, the information security label containing characteristics describing the set of information, said method comprising: assigning, by the computing system, a unique integer value to each characteristic of a set of characteristics, the set comprising a plurality of characteristics; identifying, for each piece of information in the database, at least one characteristic describing the piece of information, wherein the set of characteristics comprises pieces of information having at least one characteristic that is identical; where a piece of information has more than one characteristic, combining, by the computing system, the integer values assigned to each characteristic of the set of characteristics that describe the information security label into an encoded information security label, said encoded information security label obfuscating each characteristic of the set of characteristics; and, decoding the information security label, said decoding comprising: (a) identifying a base for use in encoding the information security label; and (b) determining, by the computing system, a floor of a logarithm to the identified base of the encoded information security label to determine a value for a first characteristic of the set of characteristics. ### Claim 2 (depends on 1) The method of claim 1, wherein the integer value assigned to each characteristic of the set of characteristics is determined by an exponential in the form xy, where x and y are positive integer values. ### Claim 3 (depends on 2) The method of claim 2, wherein assigning an integer value to each characteristic of the set of characteristics further comprises incrementing the exponent y for each characteristic of the set of characteristics. ### Claim 4 (depends on 1) The method of claim 1, wherein the assigned integer values are combined by summing the assigned integer values. ### Claim 5 (depends on 4) The method of claim 4, wherein each assigned integer value is a unique prime number. ### Claim 6 (depends on 5) The method of claim 5, wherein the assigned integer values are combined by multiplying the assigned integer values. ### Claim 7 (depends on 5) The method of claim 5, further comprising decoding the information security label, said method comprising: performing, by the computing system, a modulo operation on a resulting integer; and determining, by the computing system, that a particular characteristic is inherent in the security label when the performed modulo operation has a zero remainder value. ### Claim 8 (depends on 1) The method of claim 1, wherein the set of characteristics is one of a permission level and a compartment. ### Claim 9 (depends on 1) The method of claim 1, wherein decoding the information security label further comprises: (c) subtracting, by the computing system, the floor of the log from the encoded information security label to produce a remainder integer value; (d) when the remainder integer value is non-zero, determining, by the computing system, the floor of the log of the remainder integer value to determine a further characteristic of the set of characteristics; and (e) subtracting, by the computer system, the floor of the log of the remainder integer value from the remainder integer value to produce a further remainder integer value; wherein the steps of (d) and (e) are repeated until the further remainder integer value is zero. ### Claim 10 A computerized method for providing, to a user of a computing system, read access to a plurality of discrete pieces of information in an information set in a database within a file in the computing system, said method comprising: encoding, by the computing system, an information security label associated with the set of information in the database in the file, said encoding comprising: assigning, by the computing system, a unique integer value to each characteristic of a set of characteristics, the set comprising a plurality of characteristics; identifying, for each piece of information in the database, at least one characteristic describing the piece of information, wherein the set of characteristics comprises pieces of information having at least one characteristic that is identical; where a piece of information has more than one characteristic, combining, by the computing system, the integer values assigned to each characteristic of the set of characteristics that describe the information security label into an encoded information security label, said encoded information security label obfuscating each characteristic of the set of characteristics; decoding the information security label, said decoding comprising: (a) identifying a base for use in encoding the information security label; and (b) determining, by the computing system, a floor of a logarithm to the identified base of the encoded information security label to determine a value for a first characteristic of the set of characteristics; assigning, by the computing system, each user of the computing system a user security label based on a security level assigned to said user; assigning, by the computing system, each software application residing on the computer system a corresponding application security label; receiving, by the computer system, a user request to access one or more particular discrete pieces of information within the database; and providing, by the computing system, read access to a set of one or more particular discrete pieces of information in the database when the user security label and the application security label dominate the encoded information security label associated with the set of one or more particular discrete pieces of information. ### Claim 11 (depends on 10) The method of claim 10, wherein: said computing system has a plurality of users; and said method further comprises constructing a user access list containing information pertaining to whether each one of the plurality of users has access to each piece of the plurality of pieces of information in the information set, said constructing comprising: determining a first security token for each of the users; determining a second security token for each of the plurality of discrete pieces of information in the information set; determining whether each of the plurality of users has access to each of the plurality of discrete pieces of information in the information set by comparing the first and second security tokens; and constructing the user access list of the security tokens and access permissions. ### Claim 12 A system for encoding an information security label associated with a set of information in a database in a file and utilizable in a computing system for controlling read access to the set of information, the database being accessed by one or more users, the information security label containing characteristics describing the set of information, said system comprising: one or more non-transitory computer-readable storage media having stored thereon computer-executable instructions for: assigning, by the computing system, a unique integer value to each characteristic of a set of characteristics, the set comprising a plurality of characteristics; identifying, for each piece of information in the database, at least one characteristic describing the piece of information, wherein the set of characteristics comprises pieces of information having at least one characteristic that is identical; where the piece of information has more than one characteristic, combining, by the computing system, the assigned integer values for each characteristic of the set of characteristics that describe the information security label into an encoded information security label, said encoded information security label obfuscating each characteristic of the set of characteristics; and decoding the information security label, said decoding comprising: (a) identifying a base used in encoding the information security label; and (b) determining, by the computing system, a floor of a logarithm to the identified base of the encoded information security label to determine a value for a first characteristic of the set of characteristics; and a computer for executing the computer-executable instructions stored on the computer-readable storage media. ### Claim 13 (depends on 12) The system of claim 12, wherein the integer value assigned to each characteristic of the set of characteristics is determined by an exponential in the form xy, where x and y are positive integer values. ### Claim 14 (depends on 13) The system of claim 13, wherein assigning an integer value to each characteristic of the set of characteristics further comprises incrementing the exponent y for each characteristic of the set of characteristics. ### Claim 15 (depends on 14) The system of claim 14, wherein decoding the information security label further comprises: (c) subtracting, by the computing system, the floor of the log from the encoded information security label to produce a remainder integer value; (d) when the remainder integer value is non-zero, determining, by the computing system, the floor of the log of the remainder integer value to determine a further characteristic of the set of characteristics; and (e) subtracting, by the computer system, the floor of the log of the remainder integer value to form the remainder integer value to produce a further remainder integer value; wherein the steps of (d) and (e) are repeated until the further remainder integer value is zero. ### Claim 16 (depends on 12) The system of claim 12, wherein the assigned integer values are combined by summing the assigned integer values. ### Claim 17 (depends on 16) The system of claim 16, wherein each assigned integer value is a unique prime number. ### Claim 18 (depends on 17) The system of claim 17, wherein the assigned integer values are combined by multiplying the assigned integer values. ### Claim 19 (depends on 17) The system of claim 17, wherein said computer-executable instructions further comprise decoding the information security label, said decoding comprising: performing, by the computing system, a modulo operation on a resulting integer; and determining, by the computing system, that a particular characteristic is inherent in the security label when the performed modulo operation has a zero remainder value. ### Claim 20 (depends on 12) The system of claim 12, wherein the set of characteristics is one of a permission level and a compartment.