Application Server Object-level Security for Distributed Computing Domains

• US 20080222697A1
• Filed: 05/20/2008
• Published: 09/11/2008
• Est. Priority Date: 09/19/2002
• Status: Active Grant

• Current Assignee: Ajaykumar Karkala Reddy, Carlton Keith Mason, Ching-Yun Chao, Hyen Vui Chung, Peter Daniel Birk, Vishwanath Venkataramappa
• Original Assignee: Ajaykumar Karkala Reddy, Carlton Keith Mason, Ching-Yun Chao, Hyen Vui Chung, Peter Daniel Birk, Vishwanath Venkataramappa
• Inventors: Venkataramappa, Vishwanath, Chao, Ching-Yun, Birk, Peter Daniel, Chung, Hyen Vui, Reddy, Ajaykumar Karkala, Mason, Carlton Keith
• Granted Patent: US 7,810,132 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/31 User authentication

Abstract

Objects on application servers may be defined into classes which receive different levels of security protection, such as definition of user objects and administrative objects. Domain-wide security may be enforced on administrative objects, which user object security may be configured separately for each application server in a domain. In a CORBA architecture, IOR'"'"'s for shared objects which are to be secured on a domain-wide basis, such as administrative objects, are provided with tagged components during IOR creation and exporting to a name server. Later, when the IOR is used by a client, the client invokes necessary security measures such as authentication, authorization and transport protection according to the tagged components.

Claims

1. A computer readable medium encoded with software for use in a distributed computing domain, said software performing steps comprising:

distributing administrative objects and user objects to one or more application servers;

allowing a user to declare in a list which objects residing on each application server are to be protected;

reading said list by an interceptor;

responsive to exportation of a Common Object Request Broker Architecture (“

CORBA”

) compliant Interoperable Object Reference (“

IOR”

) for a listed object, associating by said interceptor one or more application server security flags with interfaces to said listed objects by tagging components of the IOR with one or more security flags; and

performing one or more security operations by an application server according to said security flags tagged to said IOR when a client accesses an application server-stored object, said security operations including an operation besides establishing secure communications between said client process and said server-stored object.

2. The medium as set forth in claim 1 wherein said software for performing security operations comprises software for providing separate security operations for administrative objects and user objects.

3. The medium as set forth in claim 1 comprising a WebSphere compliant application server.

4. The medium as set forth in claim 1 comprising an Enterprise Java Bean compliant client process.

5. The medium as set forth in claim 1 comprising Enterprise Java Beans compliant user object.

6. The medium as set forth in claim 1 comprising an Mbean compliant administrative object.

7. The medium as set forth in claim 1 comprising software for performing a security operation selected from the group of authentication and authorization.

8. The medium as set forth in claim 1 comprising software for employing a security protocol selected from the group of Simple Object Access Protocol and Inter-ORB Protocol.

9. The medium as set forth in claim 1 comprising software for employing a service description model selected from the group of IDL and Web Services Definition Language with Web Service Endpoint Language (“

WSEL”

) and Interface Definition Language.

10. An object-level security system in a distributed computing domain comprising:

one or more administrative objects and one or more user objects distributed among one or more application servers;

a user-declared list of objects residing on each application server which are to be protected;

an interceptor configured to read said list, and to, responsive to exportation of a Common Object Request Broker Architecture (“

CORBA”

) compliant Interoperable Object Reference (“

IOR”

) for a list object, to associate one or more application server security flags associated with interfaces to said listed objects by tagging components of the IOR with one or more security flags; and

one or more security operations performed by an application server in cooperation with a client process responsive to access by said client process of an object having a tagged IOR, said security operations including an operation besides establishing secure communications between said client process and said server-stored object.

11. The system as set forth in claim 10 wherein said security operation comprises separate security operations for administrative objects and user objects.

12. The system as set forth in claim 10 comprising a WebSphere compliant application server.

13. The system as set forth in claim 10 comprising an Enterprise Java Bean compliant client process.

14. The system as set forth in claim 10 comprising an Enterprise Java Bean compliant user object.

15. The system as set forth in claim 10 comprising an MBean compliant administrative object.

16. The system as set forth in claim 10 comprising a security operation selected from the group of authentication and authorization.

17. The system as set forth in claim 10 comprising a security protocol selected from the group of Simple Object Access Protocol and Inter-ORB Protocol.

18. The system as set forth in claim 10 comprising a service description model selected from the group of IDL and Web Services Definition Language with Web Service Endpoint Language and Interface Definition Language.