METHOD AND SYSTEM FOR DISTRIBUTED RETRIEVAL OF DATA OBJECTS USING TAGGED ARTIFACTS WITHIN FEDERATED PROTOCOL OPERATIONS

• US 20080010287A1
• Filed: 07/08/2006
• Published: 01/10/2008
• Est. Priority Date: 07/08/2006
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Hinton, Heather M., Duggan, Matthew P., Wardrop, Patrick R.
• Granted Patent: US 7,860,882 B2
• Time in Patent Office: Days
• US Class Current: 707/10
• CPC Class Codes: G06F 16/2471 Distributed queries
• CPC Class Codes: G06F 16/256 in federated or virtual databases
• CPC Class Codes: H04L 61/30 Managing network names, e.g. use of aliases or nicknames name-to-address mapping H04L61/45
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

A method is presented for transferring data objects between federated entities within a federated computational environment using artifacts. A first federated entity receives artifacts from a second federated entity that generates data objects, such as assertions, for use at or by the first federated entity. An artifact references a data object that is locally stored by the second federated entity, which is implemented as a distributed system having multiple data processing systems, each of which can generate artifacts and associated data objects and can proxy retrieval requests to systems within the second federated entity. Each artifact includes a tag that indicates the data processing system within the second federated entity that generated the artifact. When the second federated entity receives a retrieval request with an artifact from the first federated entity, the appropriate data object is retrieved from within the distributed data processing system using the artifact and the tag.

Claims

1. A method for transferring data objects between federated entities in a federated computational environment, the computer-implemented method comprising:

receiving a data object retrieval request from a first federated entity at a second federated entity, wherein the second federated entity issues artifacts for the first federated entity in accordance with a trust relationship between the second federated entity and the first federated entity, wherein services of the second federated entity are provided by a set of data processing systems within a distributed data processing system, and wherein each data processing system in the set of data processing systems generates artifacts;

extracting an artifact from the data object retrieval request by a first data processing system in the set of data processing systems, wherein the artifact references a data object that is stored by the second federated entity;

extracting a tag from the artifact, wherein each data processing system in the set of data processing systems is uniquely identifiable, wherein each artifact includes a tag, and wherein each tag has a value that indicates a data processing system within the set of data processing systems that generated a tag; and

employing the extracted tag to identity a data processing system within the set of data processing systems as having generated the artifact.

2. The method of claim 1 further comprising:

determining that the extracted tag identifies the first data processing system as having generated the artifact;

searching a local datastore of the first data processing system using the artifact;

retrieving the data object that is referenced by the artifact; and

returning a data object retrieval response including the data object from the first data processing system to the first federated entity.

3. The method of claim 1 further comprising:

determining that the extracted tag identifies a second data processing system as having generated the artifact;

sending a retrieval request from the first data processing system to the second data processing system, wherein the retrieval request contains the artifact;

receiving a retrieval response from the second data processing system at the first data processing system, wherein the retrieval response contains the data object; and

returning a data object retrieval response including the data object from the first data processing system to the first federated entity.

4. The method of claim 3 further comprising:

receiving a retrieval request from the first data processing system at the second data processing system, wherein the retrieval request contains the artifact; and

sending a retrieval response from the second data processing system to the first data processing system, wherein the retrieval response contains the data object.

5. The method of claim 4 further comprising:

searching a local datastore of the second data processing system using the artifact; and

retrieving the data object that is referenced by the artifact.

6. The method of claim 5 further comprising:

deleting the data object from the local datastore.

7. The method of claim 1 wherein the first federated entity is a service provider and the second federated entity is an identity provider.

8. The method of claim 1 wherein the first federated entity is an identity provider and the second federated entity is a service provider.

9. The method of claim 1 wherein the first federated entity is an issuing party and the second federated entity is a relying party.

10. The method of claim 1 wherein the first federated entity is a relying party and the second federated entity is an issuing party.

11. The method of claim 1 wherein the data object is an assertion.

12. The method of claim 1 wherein the data object is a security assertion.

13. The method of claim 1 wherein the data object is retrieved during an authentication operation.

14. A computer program product on a computer readable storage medium for transferring data objects between federated entities in a federated computational environment, the computer program product comprising:

instructions for receiving a data object retrieval request from a first federated entity at a second federated entity, wherein the second federated entity issues artifacts for the first federated entity in accordance with a trust relationship between the second federated entity and the first federated entity, wherein services of the second federated entity are provided by a set of data processing systems within a distributed data processing system, and wherein each data processing system in the set of data processing systems generates artifacts;

instructions for extracting an artifact from the data object retrieval request by a first data processing system in the set of data processing systems, wherein the artifact references a data object that is stored by the second federated entity;

instructions for extracting a tag from the artifact, wherein each data processing system in the set of data processing systems is uniquely identifiable, wherein each artifact includes a tag, and wherein each tag has a value that indicates a data processing system within the set of data processing systems that generated a tag; and

instructions for employing the extracted tag to identity a data processing system within the set of data processing systems as having generated the artifact.

15. The computer program product of claim 14 further comprising:

instructions for determining that the extracted tag identifies the first data processing system as having generated the artifact;

instructions for searching a local datastore of the first data processing system using the artifact;

instructions for retrieving the data object that is referenced by the artifact; and

instructions for returning a data object retrieval response including the data object from the first data processing system to the first federated entity.

16. The computer program product of claim 14 further comprising:

instructions for determining that the extracted tag identifies a second data processing system as having generated the artifact;

instructions for sending a retrieval request from the first data processing system to the second data processing system, wherein the retrieval request contains the artifact;

instructions for receiving a retrieval response from the second data processing system at the first data processing system, wherein the retrieval response contains the data object; and

instructions for returning a data object retrieval response including the data object from the first data processing system to the first federated entity.

17. The computer program product of claim 16 further comprising:

instructions for receiving a retrieval request from the first data processing system at the second data processing system, wherein the retrieval request contains the artifact; and

instructions for sending a retrieval response from the second data processing system to the first data processing system, wherein the retrieval response contains the data object.

18. The computer program product of claim 17 further comprising:

instructions for searching a local datastore of the second data processing system using the artifact; and

instructions for retrieving the data object that is referenced by the artifact.

19. The computer program product of claim 14 wherein the first federated entity is a service provider and the second federated entity is an identity provider.

20. The computer program product of claim 14 wherein the first federated entity is an identity provider and the second federated entity is a service provider.

21. The computer program product of claim 14 wherein the first federated entity is a relying party and the second federated entity is an issuing party.

22. The computer program product of claim 14 wherein the data object is a security assertion.

23. The computer program product of claim 14 wherein the data object is retrieved during an authentication operation.

24. An apparatus for transferring data objects between federated entities in a federated computational environment, the apparatus comprising:

means for receiving a data object retrieval request from a first federated entity at a second federated entity, wherein the second federated entity issues artifacts for the first federated entity in accordance with a trust relationship between the second federated entity and the first federated entity, wherein services of the second federated entity are provided by a set of data processing systems within a distributed data processing system, and wherein each data processing system in the set of data processing systems generates artifacts;

means for extracting an artifact from the data object retrieval request by a first data processing system in the set of data processing systems, wherein the artifact references a data object that is stored by the second federated entity;

means for extracting a tag from the artifact, wherein each data processing system in the set of data processing systems is uniquely identifiable, wherein each artifact includes a tag, and wherein each tag has a value that indicates a data processing system within the set of data processing systems that generated a tag; and

means for employing the extracted tag to identity a data processing system within the set of data processing systems as having generated the artifact.

25. The apparatus of claim 24 further comprising:

means for determining that the extracted tag identifies the first data processing system as having generated the artifact;

means for searching a local datastore of the first data processing system using the artifact;

means for retrieving the data object that is referenced by the artifact; and

means for returning a data object retrieval response including the data object from the first data processing system to the first federated entity.

26. The apparatus of claim 24 further comprising:

means for determining that the extracted tag identifies a second data processing system as having generated the artifact;

means for sending a retrieval request from the first data processing system to the second data processing system, wherein the retrieval request contains the artifact;

means for receiving a retrieval response from the second data processing system at the first data processing system, wherein the retrieval response contains the data object; and

means for returning a data object retrieval response including the data object from the first data processing system to the first federated entity.

27. The apparatus of claim 26 further comprising:

means for receiving a retrieval request from the first data processing system at the second data processing system, wherein the retrieval request contains the artifact; and

means for sending a retrieval response from the second data processing system to the first data processing system, wherein the retrieval response contains the data object.

28. The apparatus of claim 24 wherein the first federated entity is a service provider and the second federated entity is an identity provider.

29. The apparatus of claim 24 wherein the first federated entity is an identity provider and the second federated entity is a service provider.