Delegation Metasystem for Composite Services

• US 20090119672A1
• Filed: 11/02/2007
• Published: 05/07/2009
• Est. Priority Date: 11/02/2007
• Status: Active Grant

• Current Assignee: Zhigu Holdings Limited
• Original Assignee: Microsoft Corporation
• Inventors: Wojtas, Anna, Bussard, Laurent
• Granted Patent: US 8,601,482 B2
• Time in Patent Office: Days
• US Class Current: 718/104
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context

Abstract

A delegation metasystem for composite services is described, where a composite service is a service which calls other services during its operation. In an embodiment, the composite service is defined using generic descriptions for any services (and their access control models) which may be called by the composite service during operation. At run time, these generic descriptions and potentially other factors, such as the user of the composite service, are used to select actual available services which may be called by the composite service and access rights for the selected services are delegated to the composite service. These access rights may subsequently be revoked when the composite service terminates.

Claims

1. A composite service comprising a plurality of generic resource descriptions, and wherein the generic resource descriptions are mapped to available resources at runtime.

2. A composite service according to claim 1, wherein the generic resource descriptions are mapped to available resources at runtime based on the generic resource descriptions and a user of the composite service.

3. A composite service according to claim 1, wherein the plurality of generic resource descriptions is included within metadata associated with the composite service.

4. A composite service according to claim 3, wherein the metadata further comprises identity information for the composite service.

5. A composite service according to claim 1, further comprising a plurality of plug-ins, wherein each of the plurality of plug-ins corresponds to an access control model.

6. A composite service according to claim 5, further comprising a module arranged to select one of the plurality of plug-ins for an available resource.

7. A composite service according to claim 1, further comprising a module arranged to verify credentials received for an available resource.

8. A composite service according to claim 1, further comprising a data store arranged to store credentials received for an available resource.

9. A composite service according to claim 1, arranged:

to receive credentials associated with an available resource; and

on invocation of the composite service, to use the credentials to access the available resource.

10. A method of initiating a composite service comprising:

accessing generic service requirements for the composite service;

mapping the generic service requirements to at least one available service; and

delegating access rights to the composite service for the at least one available service.

11. A method according to claim 10, wherein accessing generic service requirements comprises:

accessing metadata associated with the composite service, the metadata comprising the generic service requirements and identity data for the composite service.

12. A method according to claim 10, further comprising:

providing credentials for the at least one available service to the composite service.

13. A method according to claim 10, wherein mapping the generic service requirements to at least one available service comprises:

accessing metadata associated with each of a plurality of available services; and

mapping the generic requirements to at least one of the plurality of available services based on at least the metadata.

14. A method according to claim 10, wherein delegating access rights to the composite service for the at least one available service comprises:

selecting a plug-in for use with each of the at least one available service; and

using the selected one of the plurality of plug-ins to communicate with the at least one available service.

15. A method according to claim 10, further comprising:

On termination of the composite service;

revoking the access rights.

16. A delegation metasystem comprising:

a resource mapping application arranged to map generic resource requirements of a composite service to at least one available resource;

a plurality of plug-ins associated with different access control models; and

a delegation module arranged to delegate access rights for the at least one available resource to the composite service using one of the plurality of plug-ins.

17. A delegation metasystem according to claim 16, further comprising:

a composite service.

18. A delegation metasystem according to claim 17, wherein the composite service comprises:

a composite service application arranged to receive an identifier and a credential for each of the at least one available resource;

a plurality of plug-ins associated with different access control models; and

a service provision module arranged to access the at least one available resource using the identifier and credential and a selected one of the plurality of plug-ins.

19. A delegation metasystem according to claim 16, further comprising:

a plurality of resources,

and wherein each resource comprises metadata, the metadata comprising at least one of;

data identifying an access control model associated with the resource and a management endpoint for the resource.

20. A delegation metasystem according to claim 16, wherein the delegation module is further arranged to revoke access rights for the at least one available resource to the composite service using one of the plurality of plug-ins on termination of the composite service.