Techniques for security artifacts management

• US 10,171,437 B2
• Filed: 04/22/2016
• Issued: 01/01/2019
• Est. Priority Date: 04/24/2015
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Agarwal, Amit, Tirumalai, Srikant Krishnapuram
• Primary Examiner(s): Okeke, Izunna
• Assistant Examiner(s): Khan, Sher A
• Application Number:
  US15/136,734
• Publication Number:
  US 20160315926A1
• Time in Patent Office: 984 Days
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Techniques are provided to manage security artifacts. Specifically, a security management system is disclosed for implementing security artifact archives to manage security artifacts. A security artifact archive may include information for managing one or more security artifacts that can be referenced or included in the security artifact archive. The security management system can create, edit, read, send, and perform other management operations for security artifact archives. Objects can be bundled in an object-specific security artifact archive. Security artifact archives may be named, versioned, tagged and/or labeled for identification. Security artifact archives may be transmitted to a destination (e.g., a service provider or a client system) that provides access to an object whose access is dependent on security artifacts. The destination may can manage access to the object using a security artifact archive that includes relevant and current security artifacts for the object.

Claims

1. A method comprising:

receiving a request to manage security of an application;

identifying, by a computer system of a security management system, a plurality of security artifacts related to security for accessing the application, wherein the computer system is in a secure zone protected by one or more security measures;

determining, by the computer system, security access for accessing the application;

generating, by the computer system, a security artifact archive for the application, the security artifact archive including security data and security artifact data, wherein the security data is based on the security access, wherein the security data includes an access policy that indicates the security access and the security data includes attribute data indicating one or more attributes of the application, and wherein the security artifact data identifies one or more of the plurality of security artifacts;

storing the security artifact archive in association with an application identifier that identifies the application and a version identifier corresponding to the application, wherein the version identifier indicates a version of the security artifact archive, and wherein different versions of the security artifact archive correspond to changes in security access based on a different version of the application; and

responsive to the request, transmitting, by the computer system, the security artifact archive to the application, wherein the application operates to manage security for accessing the application based on the security artifact data and the security access in the security data of the security artifact archive, and wherein the application is outside the secure zone.

2. The method of claim 1, wherein a first security artifact of the plurality of security artifacts includes an access credential, and wherein a second security artifact of the plurality of security artifacts includes a security access key.

3. The method of claim 1, wherein the security artifact archive is generated for a plurality of objects including the application and a data object, and wherein the security data indicates a type of each of the objects.

4. The method of claim 3, wherein the security artifact data includes the plurality of security artifacts, and wherein at least one of the plurality of security artifacts relates to security for accessing the data object.

5. The method of claim 1, wherein identifying the plurality of security artifacts includes:

sending a query on security artifacts stored in a security artifact data store, wherein the query is sent to identify security artifacts for managing access to the application.

6. The method of claim 1, further comprising:

determining that the security artifacts enable the security access to one or more applications, the one or more applications being different from the application;

storing the security artifact archive in association with the version identifier and a distinct application identifier for each of the one or more applications; and

transmitting the security artifact archive to each of the one or more applications, wherein each of the one or more applications operates to manage security for accessing each of the one or more applications based on the security artifact data and the security access in the security data of the security artifact archive.

7. A security management system comprising:

one or more processors; and

a memory accessible to the one or more processors, the memory storing instructions which, upon execution by the one or more processors, cause the one or more processors to;

receive a request to manage security of an application;

identify a plurality of security artifacts related to security for accessing the application, wherein the security management system is in a secure zone protected by one or more security measures;

determine security access for accessing the application;

generate a security artifact archive for the application, the security artifact archive including security data and security artifact data, wherein the security data is based on the security access, wherein the security data includes an access policy that indicates the security access and the security data includes attribute data indicating one or more attributes of the application, and wherein the security artifact data identifies one or more of the plurality of security artifacts;

store the security artifact archive in association with an application identifier that identifies the application and a version identifier corresponding to the application, wherein the version identifier indicates a first version of the security artifact archive, and wherein different versions of the security artifact archive correspond to changes in security access for the application; and

responsive to the request, transmit the security artifact archive to the application, wherein the application operates to manage security for accessing the application based on the security artifact data and the security access in the security data of the security artifact archive, and wherein the application is outside the secure zone.

8. The security management system of claim 7, wherein the instructions which, upon execution by the one or more processors, further cause the one or more processors to:

detect a change in the security access for accessing the application;

modify the security artifact archive based on the detected change to generate a second version of the security artifact archive; and

transmit the second version of the security artifact archive to the application.

9. The security management system of claim 8, wherein the change includes an additional security artifact for accessing the application, and wherein modifying the security artifact archive includes modifying the security artifact data to identify the additional security artifact.

10. The security management system of claim 8, wherein detecting the change in the security access for accessing the application includes determining a change in a life cycle of a product for the application, and wherein the change in the security access is detected based on the change in the life cycle of the product.

11. The security management system of claim 7, wherein the request is for a subscription for security artifacts for the application, and wherein the security artifact archive is provided to the application based on a schedule according to the subscription.

12. The security management system of claim 7, wherein the instructions which, upon execution by the one or more processors, further cause the one or more processors to:

determine that the security artifacts enable the security access to one or more applications, the one or more applications being different from the application;

store the security artifact archive in association with the version identifier and a distinct application identifier for each of the one or more applications; and

transmit the security artifact archive to each of the one or more applications, wherein each of the one or more applications operates to manage security for accessing each of the one or more applications based on the security artifact data and the security access in the security data of the security artifact archive.

13. A method comprising:

identifying, by a computer system of a security management system, a first security artifact archive stored in association with a first version identifier for a plurality of applications, wherein the first security artifact archive includes security data and security artifact data, wherein the security data identifies security access information about managing security access to the plurality of applications, wherein the security data includes an access policy that indicates the security access and the security data includes attribute data indicating one or more attributes of the application, wherein the security artifact data includes a security artifact shared by the plurality of applications, and wherein the computer system is in a secure zone protected by one or more security measures;

detecting a change in the security access to the plurality of applications;

generating a second security artifact archive associated with a second version for the plurality of applications, wherein the second security artifact archive is generated for the detected change based on the first security artifact archive;

storing the second security artifact archive in association with a second version identifier for the plurality of applications; and

transmitting the second security artifact archive to a computing system providing access to the plurality of applications, wherein the application is outsize the secure zone.

14. The method of claim 13, wherein the change in the security access to the plurality of applications includes a change in a level of authentication.

15. The method of claim 13, wherein the change in the security access to the plurality of applications includes a change in a security artifact identified by the security artifact data for the first security artifact archive.

16. The method of claim 13, wherein the change in the security access to the plurality of applications includes a change in an access policy indicated by the security data, and wherein the second security artifact archive is generated to include the change in the access policy.

17. The method of claim 13, further comprising:

identifying a data object that shares security artifacts with the plurality of applications;

storing the second security artifact archive in association with a second version identifier for the data object; and

sending a message to the computing system to indicate that security access to the data object is to be controlled using the second security artifact archive.

18. The method of claim 13, wherein detecting the change in the security access to the plurality of applications includes determining a change in a life cycle of a product for the plurality of applications, and wherein the change in the security access to the plurality of is detected based on the change in the life cycle of the product.