Embeddable security service module

• US 20050097352A1
• Filed: 10/08/2004
• Published: 05/05/2005
• Est. Priority Date: 10/10/2003
• Status: Abandoned Application

• Current Assignee: BEA Systems Incorporated (Oracle Corporation)
• Original Assignee: BEA Systems Incorporated (Oracle Corporation)
• Inventors: Xu, Mingde, Byrne, David, Howes, Jason, Patrick, Paul, Riendeau, Richard J., Yagen, Kenneth D., Falco, Mark A.
• Application Number:
  US10/961,701
• Publication Number:
  US 20050097352A1
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system and method for a dynamically configurable security system, comprising, a process having one or more resources to be protected, and a security service module coupled to the process, one or more plugin security provider modules that are compatible with and extend the security service module, wherein the security service module is capable of receiving security information updates, and wherein the security service module is capable of controlling access to the one or more resources based on the security information updates through the use of the one or more plugin security provider modules.

Claims

1. A dynamically configurable security system, comprising:

a process having one or more resources to be protected; and

a security service module coupled to the process;

one or more plugin security provider modules that are compatible with and extend the security service module;

wherein the security service module is capable of receiving security information updates; and

wherein the security service module is capable of controlling access to the one or more resources based on the security information updates through the use of the one or more plugin security provider modules.

2. The system of claim 1, further comprising:

a distributed provisioning system capable of delivering the security information updates.

3. The system of claim 1 wherein:

the process can be one of;

     1) a web application server;

     2) an application;

     3) a network firewall;

     4) a web server;

     5) a data store; and

     6) an operating system.

4. The system of claim 1 wherein:

a plugin security module can be dynamically installed.

5. The system of claim 1 wherein:

a plugin security provider module implements an interface that is compatible with the security service module.

6. The system of claim 1 wherein:

one or more services of a plugin security provider module become available after the plugin security provider module extends the security service module.

7. The system of claim 1 wherein:

a plugin security provider module is capable of providing one of the following services;

authentication, authorization, auditing, role mapping and credential mapping.

8. The system of claim 1 wherein:

the security information updates include one or more policies.

9. The system of claim 8 wherein:

a policy is an association between a resource, and action or a role, and a subject.

10. The system of claim 1 wherein:

the security service module is dynamically configurable.

12. The method of claim 11, further comprising:

distributing the security information updates to the security service module.

11. A method for a dynamically configurable security system, comprising:

coupling a security service module to a process having one or more resources to be protected;

coupling to the security service module to one or more plugin security provider modules that are compatible with and extend the security service module;

receiving security information updates and providing the updates to the security service module; and

controlling access to the one or more resources via the security service module based on the security information updates through use of the one or more plugin security provider modules.

13. The method of claim 11 wherein:

the process can be one of;

     1) a web application server;

     2) an application;

     3) a network firewall;

     4) a web server;

     5) a data store; and

     6) an operating system.

14. The method of claim 11 wherein:

a plugin security module can be dynamically installed.

15. The method of claim 11 wherein:

a plugin security provider module implements an interface that is compatible with the security service module.

16. The method of claim 11 wherein:

one or more services of a plugin security provider module become available after the plugin security provider module extends the security service module.

17. The method of claim 11 wherein:

a plugin security provider module is capable of providing one of the following services;

authentication, authorization, auditing, role mapping and credential mapping.

18. The method of claim 11 wherein:

the security information updates include at least one policy.

19. The method of claim 18 wherein:

a policy is an association between a resource, and action or a role, and a subject.

20. The method of claim 11 wherein:

the security service module is dynamically configurable.

21. A machine readable medium having instructions stored thereon to cause a system to:

couple a security service module to a process having one or more resources to be protected;

couple to the security service module to one or more plugin security provider modules that are compatible with and extend the security service module;

receive security information updates and providing the updates to the security service module; and

control access to the one or more resources via the security service module based on the security information updates through use of the one or more plugin security provider modules.

22. The machine readable medium of claim 21, further comprising instructions stored thereon to cause the system to:

distribute the security information updates to the security service module.

23. The machine readable medium of claim 21 wherein:

the process can be one of;

1) a web application server;

     2) an application;

     3) a network firewall;

     4) a web server;

     5) a data store; and

     6) an operating system.

24. The machine readable medium of claim 21 wherein:

a plugin security module can be dynamically installed.

25. The machine readable medium of claim 21 wherein:

a plugin security provider module implements an interface that is compatible with the security service module.

26. The machine readable medium of claim 21 wherein:

one or more services of a plugin security provider module become available after the plugin security provider module extends the security service module.

27. The machine readable medium of claim 21 wherein:

a plugin security provider module is capable of providing one of the following services;

authentication, authorization, auditing, role mapping and credential mapping.

28. The machine readable medium of claim 21 wherein:

the security information updates include at least one policy.

29. The machine readable medium of claim 28 wherein:

a policy is an association between a resource, and action or a role, and a subject.

30. The machine readable medium of claim 21 wherein:

the security service module is dynamically configurable.

31. A computer signal embodied in a transmission medium, comprising:

a code segment including instructions for coupling a security service module to a process having one or more resources to be protected;

a code segment including instructions for coupling to the security service module to one or more plugin security provider modules that are compatible with and extend the security service module;

a code segment including instructions for receiving security information updates and providing the updates to the security service module; and

a code segment including instructions for controlling access to the one or more resources via the security service module based on the security information updates through use of the one or more plugin security provider modules.