PROPAGATING SECURITY IDENTITY INFORMATION TO COMPONENTS OF A COMPOSITE APPLICATION

• US 20120131654A1
• Filed: 05/31/2011
• Published: 05/24/2012
• Est. Priority Date: 11/24/2010
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Kavantzas, Nickolas, Yamuna, Prakash
• Granted Patent: US 8,635,682 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 9/461 Saving or restoring of program or task context
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

Various methods and systems for propagating identity information in a composite application are presented. State data of a composite application, as executed for a particular entity, may be transferred to and stored by a computer-readable storage medium. The state data may include a portion of a set of subject information linked with the entity. A security attribute of the subject may not be present in the portion of the set of subject information in the state data transferred to the non-transitory computer-readable storage medium. After a period of time, such as an hour or a day, the state data of the composite application as executed for the entity may be retrieved and the security attribute of the set of subject information linked with the entity may be determined. The composite application may then continue to be executed for the entity.

Claims

1. A method for propagating identity information in a composite application, the method comprising:

processing, by a computer system, a first step of the composite application for an entity, wherein;

the entity is linked with a set of subject information;

the set of subject information comprises an identity attribute linked with the entity and a security attribute linked with the entity; and

the first step is processed if the security attribute is authenticated;

transferring, by the computer system, state data of the composite application as executed for the entity to a non-transitory computer-readable storage medium, wherein;

the state data comprises at least a portion of the set of subject information linked with the entity; and

the security attribute is not present in at least the portion of the set of subject information in the state data transferred to the non-transitory computer-readable storage medium;

storing, by the computer system, the state data of the composite application as executed for the entity using the non-transitory computer-readable storage medium;

retrieving, by the computer system, the state data of the composite application as executed for the entity from the non-transitory computer-readable storage medium;

following retrieving the state data of the composite application as executed for the entity, determining, by the computer system, the security attribute of the set of subject information linked with the entity; and

populating, by the computer system, the security attribute of the set of subject information linked with the entity.

2. The method of claim 1, wherein a restart is tolerated while the state data of the composite application as executed for the entity is stored by the non-transitory computer-readable storage medium.

3. The method of claim 1, wherein following the transfer of the state data of the composite application as executed for the entity to the non-transitory computer-readable storage medium, but before retrieving the state data of the composite application from the non-transitory computer-readable storage medium, a period of time elapses, wherein the period of time is selected from a group consisting of:

at least an hour;

at least a day; and

at least a week.

4. The method of claim 1, further comprising:

following populating the security attribute of the set of subject information linked with the entity, processing a second step of the composite application for the entity, wherein;

the second step is processed if the security attribute is authenticated.

5. The method of claim 1, further comprising:

following populating the security attribute of the set of subject information linked with the entity, aborting the composite application for the entity, wherein;

the security attribute is not authenticated.

6. The method of claim 4, further comprising:

following transferring the state data of the composite application as executed for the entity to the non-transitory computer-readable storage medium, ending, by the computer system, a first processing string linked with the entity, wherein processing the second step utilizes a second processing string.

7. The method of claim 1, wherein storing, by the computer system, the state data of the composite application as executed for the entity using the non-transitory computer-readable storage medium comprises storing the state data as a data blob within a database on the non-transitory computer-readable storage medium.

8. A computer program product residing on a non-transitory computer-readable storage medium and comprising processor-readable instructions configured to cause a processor to:

process a first step of a composite application for an entity, wherein;

the entity is linked with a set of subject information;

the set of subject information comprises an identity attribute linked to the entity and a security attribute; and

the first step is processed if the security attribute is authenticated;

transfer state data of the composite application as executed for the entity to a non-transitory computer-readable storage medium, wherein;

the state data comprises a portion of the set of subject information linked with the entity; and

the security attribute is not stored by the non-transitory computer-readable storage medium;

cause the state data of the composite application as executed for the entity to be stored using the non-transitory computer-readable storage medium;

cause the state data of the composite application as executed for the entity to be retrieved from the non-transitory computer-readable storage medium;

following the state data of the composite application being retrieved, determine the security attribute of the set of subject information linked with the entity; and

populate the security attribute of the set of subject information linked with the entity.

9. The computer program product of claim 8, wherein a restart is tolerated while the state data of the composite application as executed for the entity is stored by the non-transitory computer-readable storage medium.

10. The computer program product of claim 8, wherein following the transfer of the state data of the composite application as executed for the entity to the non-transitory computer-readable storage medium, but before retrieving the state data of the composite application from the non-transitory computer-readable storage medium, a period of time elapses, wherein the period of time is selected from a group consisting of:

at least an hour;

at least a day; and

at least a week.

11. The computer program product of claim 8, further comprising instructions configured to cause the processor to:

following populating the security attribute of the set of subject information linked with the entity, process a second step of the composite application for the entity, wherein;

the second step is processed if the security attribute is authenticated.

12. The computer program product of claim 8, further comprising instructions configured to cause the processor to:

following populating the security attribute of the set of subject information linked with the entity, aborting the composite application for the entity, wherein;

the security attribute is not authenticated.

13. The computer program product of claim 11, further comprising instructions configured to cause the processor to:

following transferring the state data of the composite application as executed for the entity to the non-transitory computer-readable storage medium, end a first processing string linked with the entity, wherein processing the second step utilizes a second processing string.

14. The computer program product of claim 8, wherein the state data of the composite application as executed for the entity that is transferred to the non-transitory computer-readable storage medium is stored as a data blob within a database on the non-transitory computer-readable storage medium.

15. A system for propagating identity information in a composite application, the system comprising:

a processor, wherein the processor is configured to;

process a first step of the composite application for an entity, wherein;

the entity is linked with a set of subject information;

the set of subject information comprises an identity attribute linked to the entity and a security attribute; and

the first step is processed if the security attribute is authenticated;

transfer state data of the composite application as executed for the entity to a non-transitory computer-readable storage medium, wherein;

the state data comprises a portion of the set of subject information linked with the entity; and

the security attribute is not stored by the non-transitory computer-readable storage medium;

retrieve the state data of the composite application as executed for the entity from the non-transitory computer-readable storage medium;

following retrieving the state data of the composite application, determine the security attribute of the set of subject information linked with the entity; and

populate the security attribute of the set of subject information linked with the entity; and

the non-transitory computer-readable storage medium configured to;

store the state data of the composite application as executed for the entity.

16. The system of claim 15, wherein the processor is configured to tolerate a restart while the state data of the composite application as executed for the entity is stored by the non-transitory computer-readable storage medium.

17. The system of claim 15, wherein the processor is further configured to:

following populating the security attribute of the set of subject information linked with the entity, process a second step of the composite application for the entity, wherein;

the second step is processed if the security attribute is authenticated.

18. The system of claim 15, wherein the processor is further configured to:

following populating the security attribute of the set of subject information linked with the entity, aborting the composite application for the entity, wherein;

the security attribute is not authenticated.

19. The system of claim 15, wherein the state data of the composite application as executed for the entity that is transferred to the non-transitory computer-readable storage medium is stored as a data blob within a database on the non-transitory computer-readable storage medium.

20. The system of claim 15, wherein the entity is a web service client.