Distributed enterprise security system

• US 20050081062A1
• Filed: 10/08/2004
• Published: 04/14/2005
• Est. Priority Date: 10/10/2003
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: BEA Systems Incorporated (Oracle Corporation)
• Inventors: Xu, Mingde, Byrne, David, Howes, Jason, Patrick, Paul, Riendeau, Richard J., Yagen, Kenneth D., Falco, Mark A.
• Granted Patent: US 7,594,224 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system and method for distributed enterprise security, comprising, a server operable to update information, wherein the information can include one or more of a policy and configuration information, a security control module (SCM) operable to accept the information, at least one security service module (SSM) operable to accept the information from the SCM, and herein the information accepted by the SCM is relevant to one or more of the at least one SSMs.

Claims

1. A system for distributed enterprise security, comprising:

a server operable to update information, wherein the information can include one or more of;

a policy and configuration information;

a security control module (SCM) operable to accept the information;

at least one security service module (SSM) operable to accept the information from the SCM; and

wherein the information accepted by the SCM is relevant to one or more of the at least one SSMs.

2. The system of claim 1, further comprising:

a modular and dynamically configurable security service module coupled to the at least one SSM.

3. The system of claim 2 wherein:

the SCM and the at least one SSM execute on the same computing device.

4. The system of claim 2 wherein:

the at least one SSM can accept security service module configuration information from the SCM.

5. The system of claim 1 wherein:

information is provided and accepted over at least one secure communication link.

6. The system of claim 1 wherein:

the SCM is operable to provide only policies and configuration information that have changed.

7. The system of claim 1 wherein:

the at least one SSM can be part of one of;

     1) a web application server;

     2) an application;

     3) a network firewall;

     4) a web server;

     5) a data store; and

     6) an operating system.

8. The system of claim 1 wherein:

the at least one SSM can perform at least one of;

     1) authentication;

     2) authorization;

     3) role mapping;

     4) auditing; and

     5) credential mapping.

9. The system of claim 1, wherein the SCM further comprises:

a cache for the information.

10. The system of claim 1 wherein:

the SCM provides the information for the at least one SSMs on a given computing device.

11. The system of claim 1 wherein:

a policy can be delegated.

12. A method for providing distributed enterprise security, comprising:

distributing information to a first process, wherein the information can include one or more of;

a policy and configuration information;

distributing the information from the first process to at least one second process on the same computing device as the first process; and

wherein the information distributed to the first process is relevant to one or more of the at least one second processes.

13. The method of claim 12 wherein:

a modular and dynamically configurable Security Service Module (SSM) is coupled to the at least one second process.

14. The method of claim 12 wherein:

the at least one second process can accept security service module configuration information from the first process.

15. The method of claim 12 wherein:

the first process is operable to provide only policies and configuration information that have changed.

16. The method of claim 12 wherein:

the at least one second process can part of;

     1) a web application server;

     2) an application;

     3) a network firewall;

     4) a web server;

     5) a data store; and

     6) an operating system.

17. The method of claim 12 wherein:

the at least one second process can perform at least one of;

     1) authentication;

     2) authorization;

     3) role mapping;

     4) auditing; and

     5) credential mapping.

18. The method of claim 12, wherein the first process further comprises:

a cache for the information.

19. The method of claim 12 wherein:

a policy can be delegated.

20. The method of claim 12 wherein:

the information is distributed over a communication link.

21. A machine readable medium having instructions stored thereon to cause a system to:

distribute the information to a first process, wherein the information can include one or more of;

a policy and configuration information;

distribute the information from the first process to at least one second process on the same computing device as the first process; and

wherein the information distributed to the first process is relevant to one or more of the at least one second processes.

22. The machine readable medium of claim 21 wherein:

a modular and dynamically configurable security service module is coupled to the at least one second process.

23. The machine readable medium of claim 21 wherein:

the at least one second process can accept security service module configuration information from the first process.

24. The machine readable medium of claim 21 wherein:

the first process is operable to provide only policies and configuration information that have changed.

25. The machine readable medium of claim 21 wherein:

the at least one second process can part of;

     1) a web application server;

     2) an application;

     3) a network firewall;

     4) a web server;

     5) a data store; and

     6) an operating system.

26. The machine readable medium of claim 21 wherein:

the at least one second process can perform at least one of;

     1) authentication;

     2) authorization;

     3) role mapping;

     4) auditing; and

     5) credential mapping.

27. The machine readable medium of claim 21 wherein:

a policy can be delegated.

28. The machine readable medium of claim 21 wherein:

the information is distributed over a communication link.

29. A computer signal embodied in a transmission medium, comprising:

a code segment including instructions for distributing information to a first process, wherein the information can include one or more of;

a policy and configuration information;

a code segment including instructions for distributing the information from the first process to at least one second process on the same computing device as the first process; and

wherein the information distributed to the first process is relevant to one or more of the at least one second processes.