Dynamically configurable distributed security system

• US 20050081055A1
• Filed: 10/08/2004
• Published: 04/14/2005
• Est. Priority Date: 10/10/2003
• Status: Abandoned Application

• Current Assignee: BEA Systems Incorporated (Oracle Corporation)
• Original Assignee: BEA Systems Incorporated (Oracle Corporation)
• Inventors: Xu, Mingde, Byrne, David, Howes, Jason, Patrick, Paul, Riendeau, Richard J., Yagen, Kenneth D., Falco, Mark A.
• Application Number:
  US10/961,850
• Publication Number:
  US 20050081055A1
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system and method for a dynamically configurable security system, comprising, a security service module capable of dynamically instantiating one or more plugin security provider modules, the one or more security provider modules are coupled to the security service module wherein the one or more security provider modules are capable of responding dynamically to changes in configuration information, wherein the security service module is capable of receiving one or more security information updates, and wherein the security service module is capable of controlling access to one or more resources based on the one or more security information updates.

Claims

1. A dynamically configurable security system, comprising:

a security service module capable of dynamically instantiating one or more plugin security provider modules;

the one or more security provider modules are coupled to the security service module wherein the one or more security provider modules are capable of responding dynamically to changes in configuration information;

wherein the security service module is capable of receiving one or more security information updates; and

wherein the security service module is capable of controlling access to one or more resources based on the one or more security information updates.

2. The system of claim 1, further comprising:

a first process capable of modifying the configuration information.

3. The system of claim 1, further comprising:

a distributed provisioning system capable of delivering the one or more security information updates.

4. The system of claim 1 wherein:

a plugin security provider module implements an interface that is compatible with the service provider interface.

5. The system of claim 1 wherein:

a plugin security provider module is capable of providing at least one of the following services;

authentication, authorization, auditing, role mapping and credential mapping.

6. The system of claim 1 wherein:

the one or more security information updates include at least one of;

a policy and configuration information.

7. The system of claim 6 wherein:

a policy is an association between a resource and at least one of;

an action and a role.

8. The system of claim 1 wherein:

the configuration information includes a set of parameters; and

wherein a parameter includes a name and a type.

9. A method for a dynamically configurable security system, comprising:

dynamically instantiating one or more plugin security provider modules wherein the one or more plugin security provider modules is capable of responding dynamically to changes in configuration information;

coupling the one or more plugin security provider modules to a security service module;

receiving one or more security information updates; and

controlling access to one or more resources based on the one or more security information updates.

10. The method of claim 9, further comprising:

modifying the configuration information.

11. The method of claim 9, further comprising:

delivering a security information update.

12. The method of claim 9 wherein:

a plugin security provider module implements an interface that is compatible with the service provider interface.

13. The method of claim 9 wherein:

a plugin security provider module is capable of providing at least one of the following services;

authentication, authorization, auditing, role mapping and credential mapping.

14. The method of claim 9 wherein:

the one or more security information updates include at least one of;

a policy and configuration information.

15. The method of claim 14 wherein:

a policy is an association between a resource and at least one of;

an action and a role.

16. The method of claim 9 wherein:

the configuration information includes a set of parameters; and

wherein a parameter includes a name and a type.

17. A machine readable medium having instructions stored thereon to cause a system to:

instantiate one or more plugin security provider modules wherein the one or more plugin security provider modules is capable of responding dynamically to changes in configuration information;

couple the one or more plugin security provider modules to a security service module;

receive one or more security information updates; and

control access to one or more resources based on the one or more security information updates.

18. The machine readable medium of claim 17, further comprising instructions stored thereon to cause the system to:

modify the configuration information.

19. The machine readable medium of claim 17, further comprising instructions stored thereon to cause the system to:

deliver a security information update.

20. The machine readable medium of claim 17 wherein:

a plugin security provider module implements an interface that is compatible with the service provider interface.

21. The machine readable medium of claim 17 wherein:

a plugin security provider module is capable of providing at least one of the following services;

authentication, authorization, auditing, role mapping and credential mapping.

22. The machine readable medium of claim 17 wherein:

the one or more security information updates include at least one of;

a policy and configuration information.

23. The machine readable medium of claim 22 wherein:

a policy is an association between a resource and at least one of;

an action and a role.

24. The machine readable medium of claim 17 wherein:

the configuration information includes a set of parameters; and

wherein a parameter includes a name and a type.

25. A computer signal embodied in a transmission medium, comprising:

a code segment including instructions for dynamically instantiating one or more plugin security provider modules wherein the one or more plugin security provider modules is capable of responding dynamically to changes in configuration information;

a code segment including instructions for coupling the one or more plugin security provider modules to a security service module;

a code segment including instructions for receiving one or more security information updates; and

a code segment including instructions for controlling access to one or more resources based on the security information.