Implementing Organization-Specific Policy During Establishment of an Autonomous Connection Between Computer Resources

• US 20100011408A1
• Filed: 07/09/2008
• Published: 01/14/2010
• Est. Priority Date: 07/09/2008
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Taank, Sumit, Madduri, Hari H., Sarasin, Thomas J., Fred, Ann Marie, Bhattacharyya, Anamitra
• Granted Patent: US 8,365,261 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An organization-specific policy is implemented during establishment of an autonomous connection between computer resources includes evaluating a relative priority between default credentials and alternative credentials; and using the highest priority credentials to establish a connection between the computer resources. The alternative credentials are based organization-specific policy and provide for autonomous connections between computer resources differently than the default credentials.

Claims

1. A method for implementing organization-specific policy during establishment of an autonomous connection between computer resources in an environment that provides for a default connection workflow, said default connection workflow comprising default credentials for connecting a first computer resource to a second computer resource, and an alternative connection workflow, said alternative connection workflow comprising alternative credentials based on said organization-specific policy for connecting said first computer resource to said second computer resource, said method comprising:

evaluating a relative priority of said default credentials and said alternative credentials to establish which of said default credentials and said alternative credentials are priority credentials; and

establishing said connection between said first computer resource and said second computer resource based on said priority credentials.

2. The method of claim 1, wherein said evaluating said relative priority of said default credentials and said alternative credentials comprises determining if said default credentials are designated as overrideable.

3. The method of claim 2, further comprising designating said default credentials as said priority credentials if said default credentials are not designated as overrideable.

4. The method of claim 2, further comprising, determining whether said alternative credentials exist and are valid if said default credentials are designated as overrideable.

5. The method of claim 3, further comprising, designating said alternative credentials as said priority credentials if said default credentials are designated as overrideable and said alternative credentials exist and are valid.

6. The method of claim 1, wherein said alternative credentials grant a different level of access to said second computer resource than do said default credentials.

7. The method of claim 1, further comprising obtaining said alternative credentials from a credential mapper that is an independent module.

8. The method of claim 7, further comprising programming said credential mapper with said alternative credentials based on said organization-specific policy.

9. The method of claim 1, further comprising executing an operation over said connection.

10. The method of claim 1, further comprising establishing said connection using said default connection workflow, said default connection workflow comprising:

a process code receiving a connection request to make said connection between said first computer resource and said second computer resource, said process code instantiating an integration module and retrieving said default credentials and said alternative credentials, said process code combining said connection request, said default credentials, and said alternative credentials into a parameter map;

an integration module receiving said parameter map and converting said parameter map into translated data, said translated data being compatible with said second computer resource;

a handler module receiving said translated data and evaluating the relative priority between said default credentials and said alternative credentials, and using said priority credentials to make said connection with said second computer resource.

11. The method of claim 10, wherein said alternative connection workflow further comprises:

passing at least a portion of said connection request to a credential mapper, said credential mapper using said at least a portion of said connection request to apply organization-specific code and return said alternative credentials to said integration module.

12. The method of claim 11, wherein said evaluating said relative priority of said default credentials and said alternative credentials comprises determining if said default credentials are overrideable and if said alternative credentials exist and are valid;

said alternative credentials being said priority credentials if said default credentials are overrideable and said alternative credentials exist and are valid.

13. The method of claim 12, wherein said default credentials are associated with an override parameter, said override parameter being selected to indicate if said default credentials are overrideable.

14. The method of claim 12, wherein said credential mapper is configured to be programmed without requiring a knowledge of implementation details of said integration module.

15. The method of claim 12, wherein said organization-specific code can be altered by modifying said credential mapper without modifying said integration module.

16. The method of claim 12, wherein said organization-specific code comprises security rules defining organizational entities authorized to connect to said second computing resource.

17. The method of claim 12, wherein said organization-specific code comprises dynamic mapping logic, said dynamic mapping logic evaluating at least one business attribute during the calculation of said alternative credentials.

18. The method of claim 1, wherein said default credentials are accessible within a database such that an administrator can create, modify or delete said default credentials.

19. The method of claim 13, wherein said default credentials comprise data identifying said second computer resource, a protocol used to connect to said second computer resource, and a single username and password to be used to connect to said second computer resource.

20. A computer system for implementing organization-specific code during establishment of an autonomous connection between computer resources, comprising a computer resource with data storage and processing resources comprising:

a process configured to create a connection request, said connection request comprising identification of a remote system to which a connection is desired, and an operation to be performed through said connection;

process code, said process code configured to receive said connection request and generate a first parameter map containing at least a portion of data contained within said connection request;

a credential mapper, said credential mapper being configured to receive said first parameter map, retrieve credentials from a database, apply organization-specific rules, and generate a second parameter map;

said process code receiving said second parameter map and creating a third parameter map;

an integration module configured to receive said third parameter map and translate said third parameter map into translated data, said translated data having a format compatible with said remote system, and

a handler, said handler configured to receive said translated data and open a connection to said remote system.

21. A computer program product for implementing organization-specific code during an autonomous establishment of a connection between computer resources, the computer program product comprising:

a computer usable medium having computer usable program code embodied therewith, the computer usable program code comprising;

computer usable program code configured to establish a default connection workflow, said default connection workflow being configured to supply default credentials for connecting a first computer resource to a second computer resource;

computer usable program code configured to establishing an alternative connection workflow, said alternative connection workflow being configured to apply organization-specific rules to supply alternative credentials for connecting said first computer resource to said second computer resource;

computer usable program code configured to evaluating a relative priority of said default credentials and said alternative credentials to establish which of said default credentials and said alternative credentials are priority credentials; and

computer usable program code configured to use said priority credentials to establish said connection between said first computer resource and said second computer resource.