Post data processing

• US 20020120599A1
• Filed: 02/26/2001
• Published: 08/29/2002
• Est. Priority Date: 07/10/2000
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Thiyagarajan, Lakshmi Velandai, Knouse, Charles W.
• Granted Patent: US 7,249,369 B2
• Time in Patent Office: Days
• US Class Current: 707/1
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 16/955 using information identifiers, e.g. uniform resource locators [URL]
• CPC Class Codes: G06F 16/958 Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce
• CPC Class Codes: H04L 61/4523 using lightweight directory access protocol [LDAP]
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

The present invention matches sets of authentication, authorization, and auditing rules to resources in an Access System based on the contents of POST data received in HTTP POST requests. The system of the present invention receives a POST request and matches a set of rules to a resource using POST data referenced by the HTTP request. In one embodiment, the matching is performed by accessing required matching data. A portion of the POST data is selected and compared with the required data. If all of the required data is matched to the POST data, then the resource is successfully matched. The present invention further authorizes a user to access resources in an Access System based on the contents of POST data. An authorization rule is retrieved and authorization is performed using the POST data. If the authorization is successful, the system grants the user access to the resource.

Claims

1. A method for matching a policy to a resource in an Access System, comprising the steps of:

receiving an HTTP POST request; and

matching said policy to said resource using POST data referenced by said HTTP request.

2. The method of claim 1, wherein:

said step of matching comprises the steps of;

accessing required policy matching data;

selecting a portion of said POST data;

comparing said portion of POST data with said required data;

repeating said steps of selecting and comparing for all portions of said POST data; and

returning a successful match of said policy to said resource if all of said required data was matched to said POST data in said step of comparing.

3. The method of claim 2, further comprising the steps of:

receiving a flag, said flag indicating whether said HTTP request contains POST data;

requesting said POST data if said HTTP request does not contain POST data; and

receiving said POST data.

4. The method of claim 2, wherein:

said policy comprises a policy authentication rule specifying a challenge method for verifying user identities to authenticate users for resources matched to said policy.

5. The method of claim 2, wherein:

said policy comprises a policy authorization rule for granting user access to a subset of resources in said Access System.

6. The method of claim 2, wherein:

said policy comprises a policy auditing rule specifying a set of information logged in response to an access system event pertaining to resources matched to said policy.

7. A method for authorizing user access to a resource in an Access System, comprising the steps of:

receiving an HTTP POST request, said request containing POST data;

retrieving an authorization rule;

authorizing said resource using said POST data; and

granting said user access to said resource if said step of authorizing is successful.

8. The method of claim 7, wherein:

said step of authorizing comprises the steps of;

selecting a portion of said POST data;

determining whether said portion is of a data type defined in said authorization rule;

matching said portion with data required by said authorization rule if said step of determining returns an affirmative answer;

repeating said steps of selecting, determining, and matching until all portions of said POST data have been considered; and

returning a successful authorization if all of said steps of matching are successful.

9. The method of claim 7, further comprising the step of:

performing authorization success actions if said step of authorizing is successful.

10. The method of claim 7, further comprising the step of:

performing authorization failure actions if said step of authorizing is unsuccessful.

11. The method of claim 7, wherein:

said step of retrieving retrieves said authorization rule from an LDAP Directory Server.

12. The method of claim 7, wherein:

said authorization rule is a first level authorization rule for granting user access to resources in said Access System.

13. The method of claim 7, wherein:

said authorization rule is a second level authorization rule for granting user access to a subset of resources in said Access System.

15. One or more processor readable storage devices according to claim 14, wherein:

said step of matching comprises the steps of;

accessing required policy matching data;

selecting a portion of said POST data;

comparing said portion of POST data with said required data;

repeating said steps of selecting and comparing for all portions of said POST data; and

returning a successful match of said policy to said resource if all of said required data was matched to said POST data in said step of comparing.

16. One or more processor readable storage devices according to claim 15, wherein said method further comprises the steps of:

receiving a flag, said flag indicating whether said HTTP request contains POST data;

requesting said POST data if said HTTP request does not contain POST data; and

receiving said POST data.

18. One or more processor readable storage devices according to claim 17, wherein:

said step of authorizing comprises the steps of;

selecting a portion of said POST data;

determining whether said portion is of a data type defined in said authorization rule;

matching said portion with data required by said authorization rule if said step of determining returns an affirmative answer;

repeating said steps of selecting, determining, and matching until all portions of said POST data have been considered; and

returning a successful authorization if all of said steps of matching are successful.

20. An apparatus according to claim 19, wherein:

said step of matching comprises the steps of;

accessing required policy matching data;

selecting a portion of said POST data;

comparing said portion of POST data with said required data;

repeating said steps of selecting and comparing for all portions of said POST data; and

returning a successful match of said policy to said resource if all of said required data was matched to said POST data in said step of comparing.

21. An apparatus according to claim 20, wherein said method further includes the steps of:

receiving a flag, said flag indicating whether said HTTP request contains POST data;

requesting said POST data if said HTTP request does not contain POST data; and

receiving said POST data.

14. One or more processor readable storage devices having processor readable code embodied on said processor readable storage devices, said processor readable code for programming one or more processors to perform a method comprising the steps of:

receiving an HTTP POST request; and

matching said policy to said resource using POST data referenced by said HTTP request.

17. One or more processor readable storage devices having processor readable code embodied on said processor readable storage devices, said processor readable code for programming one or more processors to perform a method comprising the steps of:

receiving an HTTP POST request, said request containing POST data;

retrieving an authorization rule;

authorizing said resource using said POST data; and

granting said user access to said resource if said step of authorizing is successful.

19. An apparatus, comprising:

a communication interface;

one or more storage devices; and

one or more processors in communication with said one or more storage devices and said communication interface, said one or more processors programmed to preform a method comprising the steps of;

receiving an HTTP POST request, and

matching said policy to said resource using POST data referenced by said HTTP request.

22. An apparatus, comprising:

a communication interface;

one or more storage devices; and

one or more processors in communication with said one or more storage devices and said communication interface, said one or more processors programmed to preform a method comprising the steps of;

receiving an HTTP POST request, said request containing POST data,

retrieving an authorization rule,

authorizing said resource using said POST data, and

granting said user access to said resource if said step of authorizing is successful.

23. An apparatus according to claim 22, wherein:

said step of authorizing comprises the steps of;

selecting a portion of said POST data;

determining whether said portion is of a data type defined in said authorization rule;

matching said portion with data required by said authorization rule if said step of determining returns an affirmative answer;

repeating said steps of selecting, determining, and matching until all portions of said POST data have been considered; and

returning a successful authorization if all of said steps of matching are successful.