SYSTEM AND METHODS FOR SECURE SERVICE ORIENTED ARCHITECTURES

• US 20090320121A1
• Filed: 08/26/2009
• Published: 12/24/2009
• Est. Priority Date: 08/24/2005
• Status: Active Grant

• Current Assignee: Metasecure Corporation
• Original Assignee: Metasecure Corporation
• Inventors: ENGLE, Steven W., LINDSEY, John H., NIEVES, Michael J., MAIDA-SMITH, Kathy J.
• Granted Patent: US 8,024,786 B2
• Time in Patent Office: Days
• US Class Current: 726/14
• CPC Class Codes: G06F 16/958 Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services

Abstract

Provided is a method for intercepting a message between a requesting web service and a source web service, validating the message, logging the result of the validations, and adding a security profile to the message. The method may also include examining the message to determine whether a security profile is embedded therein. If the message is valid, access to the message by the requesting web service is permitted. If the message is not valid, access to the message by the requesting web service is prevented.

Claims

1. A method of controlling and securing a service oriented architecture, comprising:

a plurality of intermediaries, one intermediary for each web service of a plurality of web services, each intermediary intercepting a message between a requesting web service and a source web service, and each intermediary being associated with a requesting web service or a source web service;

each intermediary examining the message to determine whether a security profile is embedded therein, wherein the security profile comprises a data security privilege, a services security privilege, and a user security privilege determined based on a security policy;

each intermediary adding a security profile to the message if a security profile is not already present; and

when a security profile is embedded in the message, each intermediary validating the message comprises comparing the security profile embedded in the message with a second security profile associated with the requesting web service, said second security profile also comprising a data security privilege, a services security privilege, and a user security privilege.

4. The method of claim 1, further comprising validating the message, wherein if no security profile is embedded in the message, validating the message comprises:

authenticating a user associated with the requesting web service; and

, if the user is legitimate, creating a security profile and embedding the security profile in the message.

5. The method of claim 4, wherein if the message is valid, permitting access to the message by the requesting web service.

6. The method of claim 4, wherein if the message is not valid, preventing access to the message by the requesting web service.

7. The method of claim 1, further comprising:

generating a new message capable of being requested by the requesting web service;

defining a security profile; and

embedding the security profile in the message such that the message may be validated when requested by the requesting web service.

2-3. -3. (canceled)

8. (canceled)

9. A computer-readable medium storing a software program that, when executed by a processor, causes the processor to:

intercept a message between a requesting web service and a source web service;

examine the message to determine whether a security profile is embedded therein, wherein the security profile comprises a data security privilege, a services security privilege, and a user security privilege determined based on a security policy;

add a security profile to the message if a security profile is not already present;

when a security profile is embedded in the message, validate the message by comparing the security profile embedded in the message with a second security profile associated with the requesting web service, said second security profile also comprising a data security privilege, a services security privilege, and a user security privilege;

wherein the software operates as an intermediary, and wherein the intermediary is associated with either the requesting web service or the source web service.

10. The computer-readable medium storing a software program of claim 9, that, when executed, further causes the processor to examine the message to determine whether a security profile is embedded therein.

12. The computer-readable medium storing a software program of claim 9, wherein if a security profile is not embedded in the message, the program further causes the processor to validate the message by authenticating a user associated with the requesting web service;

and, if the user is legitimate, create a security profile and embedding the security profile in the message.

13. The computer-readable medium storing a software program of claim 12, wherein if the message is valid, the program further causes the processor to permit access to the message by the requesting web service.

14. The computer-readable medium storing a software program of claim 12, wherein if the message is not valid, the program further causes the processor to prevent access to the message by the requesting web service.

15. The computer-readable medium storing a software program of claim 9, that, when executed, further causes the processor to:

generate a new message capable of being requested by the requesting web service;

define a security profile; and

embed the security profile in the message such that the message may be validated when requested by the requesting web service.

16. The computer-readable medium storing a software program of claim 9, wherein the security profile is based on a security policy.

11. (canceled)

17. A computer system organized according to a secure service oriented architecture, comprising:

at least one computer on which a plurality of web services are implemented to pass data messages between the web services; and

at least one computer on which a plurality of intermediaries are implemented;

wherein each web service is coupled for communication of data messages through an intermediary, each web service associated with a different intermediary; and

wherein each of the plurality of intermediaries performs a method comprising;

intercepting a message between a requesting web service and a source web service;

examining the message to determine whether a security profile is embedded therein, wherein the security profile comprises a data security privilege, a services security privilege, and a user security privilege determined based on a security policy;

adding a security profile to the message if a security profile is not already present; and

when a security profile is embedded in the message, validating the message by comparing the security profile embedded in the message with a second security profile associated with the requesting web service, said second security profile also comprising a data security privilege, a services security privilege, and a user security privilege.

18. The computer system of claim 17, wherein:

if a security profile is not embedded in the message, each intermediary is further operable to validate the message by authenticating a user associated with the requesting web service; and

, if the user is legitimate, create a security profile and embedding the security profile in the message.

19. The computer system of claim 17, wherein each intermediary is further operable to:

generate a new message capable of being requested by the requesting web service;

define a security profile; and

embed the security profile in the message such that the message may be validated when requested by the requesting web service.

20. The computer system of claim 17, wherein each intermediary communicates with the other intermediaries to maintain an architecture-level data engine populated with security profiles for messages and services within the architecture.

21. The computer system of claim 17 wherein the security profile comprises a data security permission, a services security permission, and a user security permission determined based on a security policy.