Methods and apparatus for facilitating security in a network

• US 20030154401A1
• Filed: 02/13/2002
• Published: 08/14/2003
• Est. Priority Date: 02/13/2002
• Status: Active Grant

• Current Assignee: Hitachi Computer Products America Incorporated (Hitachi, Ltd.)
• Original Assignee: Hitachi Computer Products America Incorporated (Hitachi, Ltd.)
• Inventors: Hartman, Bret A., Burghart, Theodore R. Jr., Flinn, Donald J.
• Granted Patent: US 6,807,636 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system, method, apparatus, means, and computer program code for facilitating security in a network, particularly a distributed network. According to embodiments of the present invention an apparatus or system may include a manager in communication with one or more mappers and one or more adapters for facilitating security requests that may be associated with an application or its environment. An adapter may be associated with an application to identify security requests associated with the application. Similarly, a mapper may be associated with a security service to facilitate communication to and from the security service regarding security requests.

Claims

1. A method for facilitating security in a system, wherein the system includes a manager module used in routing a security request associated with an application to a security service module, comprising:

receiving data indicative of a security request from a module associated with an application that identified said security request;

selecting a security service module capable of processing said security request; and

providing at least some of said data indicative of said security request to a module capable of calling said security service module to process said security request.

2. The method of claim 1, further comprising:

receiving from said module associated with said security service module data indicative of a response from said security service module regarding said security request, wherein said data indicative of a response is in a format independent of said security service module.

3. The method of claim 2, further comprising:

providing at least some of said data indicative of said response to said module associated with said application, wherein said data indicative of said response is in a format independent of said application.

4. The method of claim 1, further comprising:

initiating a module capable of configuring said manager module.

5. The method of claim 4, wherein said configuring adds said manager module to said system.

6. The method of claim 1, wherein said data indicative of a security request is in a format independent of said application.

7. A computer readable storage media having computer readable code implementing a method for facilitating security in a system, wherein said code includes statements for performing the method of claim 1.

8. A method for facilitating security in a system, wherein the system includes an adapter module associated with an application, comprising:

identifying a security request associated with said application; and

providing data indicative of said security request to a module in said system that can select a security service module to process said security request, wherein said data indicative of said security request is in a format independent of said application.

9. The method of claim 8, further comprising:

receiving from said module data indicative of a response to said security request, wherein said data indicative of a response is independent of said security service module.

10. The method of claim 9, further comprising:

providing a response regarding said security request to said application, wherein said response is based on said data indicative of a response.

11. The method of claim 8, further comprising:

initiating a module capable of configuring said adapter module and associating said adapter module with said application.

12. The method of claim 11, wherein said configuring adds said adapter module to said system.

13. A computer readable storage media having computer readable code implementing a method for facilitating security in a system, wherein said code includes statements for performing the method of claim 8.

14. A method for facilitating security in a system, wherein the system includes a mapper module associated with a security service module, comprising:

receiving data indicative of a security request associated with an application from a module capable of selecting said security service module to process said security request, wherein said data associated with said security request is in a format independent of said application; and

providing data indicative of said security request to said security service module.

15. The method of claim 14, further comprising:

receiving a response regarding said security request from said security service module.

16. The method of claim 15, further comprising:

providing data indicative of said response to said module, wherein said data indicative of said response is in a format independent of said security service module.

17. The method of claim 14, further comprising:

initiating a module capable of configuring said mapper module and associating said mapper module with said security service module.

18. The method of claim 17, wherein said configuring adds said mapper module to said system.

19. A computer readable storage media having computer readable code implementing a method for facilitating security in a system, wherein said code includes statements for performing the method of claim 14.

20. A method for facilitating security in system that includes an adapter module associated with an application, at least one mapper module associated with at least one respective security service module, and a manager module in communication with the adapter module and the at least one mapper module, comprising the steps of:

identifying a security request associated with an application;

determining a security service module that can process said security request;

calling said security service module;

receiving a response to said security request from said security service module; and

providing said response to said application.

21. The method of claim 20, further comprising:

extracting data from said security request.

22. The method of claim 21, further comprising:

translating said data using a designated protocol.

23. The method of claim 22, wherein said protocol is independent of said application.

24. The method of claim 22, wherein said protocol is independent of said security service module.

25. The method of claim 20, wherein said adapter module does said identifying a security request associated with said application.

26. The method of claim 20, wherein said mapper module does said calling said first security service module.

27. The method of claim 26, wherein said mapper module does said receiving said response.

28. The method of claim 20, wherein said manager module does said determining a security service module that can process said security request in light of said security requirement.

29. The method of claim 20, further comprising:

mapping an attribute of one security domain to an attribute in another security domain.

30. The method of claim 20, further comprising:

determining a security requirement associated with said security request.

31. A computer readable storage media having computer readable code implementing a method for facilitating security in a system, wherein said code includes statements for performing the method of claim 20.

32. A method for facilitating security in a system that includes an adapter module associated with an application, at least one mapper module associated with at least one respective security service module, and a manager module in communication with the adapter module and the at least one mapper module, comprising the steps of:

identifying a first security request associated with an application;

translating said first security request to create data indicative of said first security request;

determining a security service module that can process said first security request;

creating a second security request directed to said security service module and based on said data indicative of said first security request;

calling said security service module;

receiving a first response from said security service module regarding said second security request;

translating said first response to create data indicative of said first response;

creating a second response regarding said first security request based on said data indicative of said first response; and

providing said second response to said application.

33. A computer readable storage media having computer readable code implementing a method for facilitating security in a system, wherein said code includes statements for performing the method of claim 32.

34. The method of claim 32, further comprising:

determining a security requirement associated with said security request.

35. A system for facilitating security in a system, comprising:

an adapter module associated with an application;

a mapper module associated with a security service module;

a manager module in communication with said adapter module and said mapper module;

wherein said adapter module can identify a security request associated with said application, provide data indicative of said security request to said manager module, and provide a response to said application regarding said security request after receiving data indicative of said response from said manager module;

wherein said manager module can receive said data indicative of said security request from said adapter module, provide said data indicative of said security request to said mapper module if said security service module associated with said mapper module can process said security request, and provide data indicative of said response to said adapter module after receiving said data indicative of said response from said mapper module; and

wherein said mapper module can receive said data indicative of said security request from said manager module, prepare a security service module version of said security request, calls said security service module to process said security service module version of said security request, receives a response to said security service module version of said security request from said security service module, and provide data indicative of said response to said manager module.

37. The adapter module of claim 35, wherein said adapter module includes an application generic portion and an application specific portion.

38. The adapter module of claim 37, wherein said application specific portion identifies said security request, extracts said data indicative of said security request, and provides said response regarding said security request to said application.

39. The adapter module of claim 38, wherein said application generic portion of said adapter module provides said data indicative of said security request to said manager module and receives said data indicative of said response from said manager module.

36. A module for facilitating security in a network, comprising:

an adapter module, wherein said adapter module is operative to identify a security request associated with an application, provide data indicative of said security request to a manager module capable of selecting a security service module to process said security request, and provide a response to said application regarding said security request after receiving data indicative of said response from said manager module.

40. A module for facilitating security in a system, comprising:

a manager module, wherein said manager module is operative to receive data indicative of a security request associated with an application from an adapter module associated with said application, determine a security service module to process said security request, provide data indicative of said security request to a mapper module associated with said security service module, and provide data indicative of a response regarding said security request to said adapter module after receiving said data indicative of said response from said mapper module.

41. The manager module of claim 40, wherein said manager module includes an application generic portion.

42. The manager module of claim 41, wherein said application generic portion of said manager is in communication with an application generic portion of said adapter module and a security service generic portion of said mapper module.

43. The manager module of claim 42, wherein said application generic portion of said manager module receives said data indicative of said security request from said application generic portion of said adapter module and provides said data indicative of said response to said application generic portion of said adapter module.

44. The manager module of claim 42, wherein said application generic portion of said manager module provides said data indicative of said security request to said security service module generic portion of said mapper module and receives said data indicative of said response from said security service module generic portion of said mapper module.

45. The manager module of claim 40, wherein said manager module includes a decision object.

46. The manager module of claim 45, wherein said decision object selects said security service module to process said security request.

47. A module for facilitating security in a system, comprising:

a mapper module associated with a security service module, wherein said mapper module is operative to receive from a manager module data indicative of a security request associated with an application, prepare a version of said security request specific to a security service module selected by said manager module, call said security service module to process said security service module specific version of said security request, receive a response to said security service module version of said security request from said security service module, and provide data indicative of said response to said manager module.

48. The mapper module of claim 47, wherein said mapper module includes a security service module generic portion and a security service module specific portion.

49. The mapper module of claim 48, wherein said security service module specific portion of said mapper module prepares said security specific version of said security request and receives said response to said security service module version of said security request from said security service module.

50. The mapper module of claim 48, wherein said security service module generic portion of said mapper module receives said data indicative of said security request from said manager module and provides said data indicative of said response to said manager module.

51. An apparatus for facilitating security in a system, wherein the system includes a manager module used in routing a security request associated with an application to a security service module, comprising:

means for obtaining data indicative of a security request from a module associated with an application that identified said security request;

means for identifying a security service module capable of processing said security request; and

means for sending at least some of said data indicative of said security request to a module capable of calling said security service module to process said security request.