Dynamically configurable distributed security system

• US 20050102536A1
• Filed: 10/08/2004
• Published: 05/12/2005
• Est. Priority Date: 10/10/2003
• Status: Abandoned Application

• Current Assignee: BEA Systems Incorporated (Oracle Corporation)
• Original Assignee: BEA Systems Incorporated (Oracle Corporation)
• Inventors: Xu, Mingde, Byrne, David, Howes, Jason, Patrick, Paul, Riendeau, Richard J., Yagen, Kenneth D., Falco, Mark A.
• Application Number:
  US10/961,544
• Publication Number:
  US 20050102536A1
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system and method for a configurable distributed security system, comprising, a security service module capable of dynamically instantiating one or more plugin security provider modules, the one or more security provider modules are coupled to the security service module wherein the one or more security provider modules are capable of responding to one or more changes in configuration information, a first process capable of modifying the configuration information, wherein the security service module is capable of accepting at least one of, security information and the configuration information, and wherein the security service module is capable of controlling access to one or more resources based on the security information.

Claims

1. A configurable distributed security system, comprising:

a security service module capable of dynamically instantiating one or more plugin security provider modules;

the one or more security provider modules are coupled to the security service module wherein the one or more security provider modules are capable of responding to one or more changes in configuration information;

a first process capable of modifying the configuration information;

wherein the security service module is capable of accepting at least one of;

security information and the configuration information; and

wherein the security service module is capable of controlling access to one or more resources based on the security information.

2. The system of claim 1, further comprising:

a distributed provisioning system capable of delivering the security information and the configuration information to the security service module.

3. The system of claim 1, further comprising:

a second process capable of providing the security information and the configuration information to the security service module.

4. The system of claim 3 wherein:

the first process is capable of associating the security service module with the second process, wherein the security service module is capable of receiving security information and configuration information from the second process.

5. The system of claim 1 wherein:

the response to one or more changes in the configuration information is dynamic.

6. The system of claim 1 wherein:

the first process has an user interface.

7. The system of claim 1 wherein:

the first process is capable of controlling which security provider modules are coupled to the security service module.

8. The system of claim 1 wherein:

a plugin security provider module implements an interface that is compatible with the security service module.

9. The system of claim 1 wherein:

a plugin security provider module is capable of providing at least one of the following services;

authentication, authorization, auditing, role mapping and credential mapping.

10. The system of claim 1 wherein:

the security information includes at least one of;

a role policy and an authorization policy.

11. The system of claim 1 wherein:

the configuration information includes a set of parameters; and

wherein a parameter includes a name and a type.

12. A configurable distributed security method, comprising:

instantiating one or more plugin security provider modules wherein the one or more plugin security provider modules is capable of responding to changes in configuration information;

coupling the one or more plugin security provider modules to a security service module;

modifying the configuration information wherein the modification is by a first process;

receiving at least one of;

security information and the configuration information;

wherein the security service module is capable of accepting the security information and the configuration information; and

wherein the security service module is capable of controlling access to one or more resources based on the security information.

13. The method of claim 12, further comprising:

controlling access to the one or more resources based on the security information.

14. The method of claim 12, further comprising:

modifying at least one of the security information by the first process.

15. The method of claim 12, further comprising:

delivering at least one of the security information and the configuration information to the security service module; and

wherein the delivering is by a second process.

16. The method of claim 15 wherein:

associating the security service module with the second process wherein the security service module can receive security information and configuration information from the second process.

17. The method of claim 12 wherein:

the responding to changes in the configuration information is dynamic.

18. The method of claim 12 wherein:

the first process has an user interface.

19. The method of claim 12 wherein:

the first process is capable of controlling which security provider modules are coupled to the security service module.

20. The method of claim 12 wherein:

a plugin security provider module implements an interface that is compatible with the security service module.

21. The method of claim 12 wherein:

a plugin security provider module is capable of providing at least one of the following services;

authentication, authorization, auditing, role mapping and credential mapping.

22. The method of claim 12 wherein:

the security information includes at least one of;

a role policy and an authorization policy.

23. The method of claim 12 wherein:

the configuration information includes a set of parameters; and

wherein a parameter includes a name and a type.

24. A machine readable medium having instructions stored thereon to cause a system to:

instantiate one or more plugin security provider modules wherein the one or more plugin security provider modules is capable of responding to changes in configuration information;

couple the one or more plugin security provider modules to a security service module;

modify the configuration information wherein the modification is by a first process;

receive at least one of;

security information and the configuration information;

wherein the security service module is capable of accepting the security information and the configuration information; and

wherein the security service module is capable of controlling access to one or more resources based on the security information.

25. The machine readable medium of claim 24, further comprising instructions stored thereon to cause the system to:

control access to the one or more resources based on the security information.

26. The machine readable medium of claim 24, further comprising instructions stored thereon to cause the system to:

modify at least one of the security information by the first process.

27. The machine readable medium of claim 24, further comprising instructions stored thereon to cause the system to:

deliver at least one of the security information and the configuration information to the security service module; and

wherein the delivering is by a second process.

28. The machine readable medium of claim 27 wherein:

associate the security service module with the second process wherein the security service module can receive security information and configuration information from the second process.

29. The machine readable medium of claim 24 wherein:

the responding to changes in the configuration information is dynamic.

30. The machine readable medium of claim 24 wherein:

the first process has an user interface.

31. The machine readable medium of claim 24 wherein:

the first process is capable of controlling which security provider modules are coupled to the security service module.

32. The machine readable medium of claim 24 wherein:

a plugin security provider module implements an interface that is compatible with the security service module.

33. The machine readable medium of claim 24 wherein:

a plugin security provider module is capable of providing at least one of the following services;

authentication, authorization, auditing, role mapping and credential mapping.

34. The machine readable medium of claim 24 wherein:

the security information includes at least one of;

a role policy and an authorization policy.

35. The machine readable medium of claim 24 wherein:

the configuration information includes a set of parameters; and

wherein a parameter includes a name and a type.

36. A computer signal embodied in a transmission medium, comprising:

a code segment including instructions for instantiate one or more plugin security provider modules wherein the one or more plugin security provider modules is capable of responding to changes in configuration information;

a code segment including instructions for couple the one or more plugin security provider modules to a security service module;

a code segment including instructions for modify the configuration information wherein the modification is by a first process;

a code segment including instructions for receive at least one of;

security information and the configuration information;

wherein the security service module is capable of accepting the security information and the configuration information; and

wherein the security service module is capable of controlling access to one or more resources based on the security information.