Dynamic Proxy Server

• US 20170111444A1
• Filed: 10/14/2015
• Published: 04/20/2017
• Est. Priority Date: 10/14/2015
• Status: Active Grant

• Current Assignee: ADP, Inc.
• Original Assignee: ADP LLC (ADP, Inc.)
• Inventors: Saheba, Jigesh, Masiero, Roberto A., Espina Carvajal, Isabel
• Granted Patent: US 10,348,816 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/1012 based on compliance of requirements or conditions with available server resources
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/5682 Policies or rules for updating, deleting or replacing the stored data

Abstract

A method and apparatus for facilitating access to a plurality of resources is provided. A message that includes a context resource identifier is received at a proxy server from a client through a gateway in communication with both the client and the proxy server. Access to a resource associated with an interface that is referenced by the context resource identifier is controlled by the proxy server using a profile that is dynamically built for a user of the client based on a plurality of resource profiles received from a plurality of interfaces in communication with the proxy server.

Claims

1. A method for facilitating access to a plurality of resources, the method comprising:

receiving, at a proxy server, a message that includes a context resource identifier from a client through a gateway in communication with both the client and the proxy server; and

controlling, by the proxy server, access to a resource associated with an interface that is referenced by the context resource identifier using a profile that is dynamically built for a user of the client based on a plurality of resource profiles received from a plurality of interfaces in communication with the proxy server.

2. The method of claim 1, wherein controlling, by the proxy server, access to the resource comprises:

determining whether the interface referenced by the context resource identifier requires an authorization for the user.

3. The method of claim 2, wherein controlling, by the proxy server, access to the resource further comprises:

determining whether an existing profile for the user is present within a cache that is in communication with the proxy server in response to a determination that the interface requires the authorization for the user.

4. The method of claim 3, wherein controlling, by the proxy server, access to the resource further comprises:

building, dynamically, a new profile for the user in response to a determination that the profile is not present within the cache; and

storing the new profile in the cache in association with a logical expiration time and a physical expiration time for the new profile.

5. The method of claim 4, wherein controlling, by the proxy server, access to the resource further comprises:

determining whether the user is authorized to access the resource based on the new profile built for the user and a role of the user; and

routing the message to the resource in response to a determination that the user is authorized to access the resource.

6. The method of claim 5, wherein controlling, by the proxy server, access to the resource further comprises:

generating an error code in response to a determination that the user is not authorized to access the resource; and

sending the error code to the client through the gateway.

7. The method of claim 4, wherein building, dynamically, the new profile for the user comprises:

discovering, dynamically, the plurality of interfaces that are in communication with the proxy server;

obtaining the plurality of resource profiles from the plurality of interfaces, wherein each resource profile in the plurality of resource profiles is generated by a corresponding interface in the plurality of interfaces and includes a set of endpoint references and authorization information; and

building the new profile for the user based on the authorization information in each of the plurality of resource profiles.

8. The method of claim 7 further comprising:

storing the set of endpoint references received in the each of the plurality of resource profiles in an endpoint data structure.

9. The method of claim 3, wherein controlling, by the proxy server, access to the resource further comprises:

determining whether the user is authorized to access the resource based on the existing profile built for the user; and

routing the message to the resource in response to a determination that the user is authorized to access the resource.

10. The method of claim 1, wherein controlling, by the proxy server, access to the resource further comprises:

routing the message to the resource based on a set of endpoint references for the resource when the user of the client is authorized to access the resource;

receiving, at the proxy server, information from the resource through the interface; and

sending, by the proxy server, the information to the client through the gateway.

11. The method of claim 10 further comprising:

storing, by the proxy server, the information in a data cache.

12. The method of claim 1, wherein controlling, by the proxy server, access to the resource comprises:

receiving information from the resource through the interface after the user of the client has been authorized for access to the resource;

filtering the information based on a data privacy filter to form modified information; and

sending the modified information to the client through the gateway.

13. An apparatus comprising:

a plurality of resources; and

a proxy server in communication with the plurality of resources,

wherein the proxy server receives a message that includes a context resource identifier from a client through a gateway in communication with both the client and the proxy server; and

wherein the proxy server controls access to a resource associated with an interface that is referenced by the context resource identifier using a profile that is dynamically built for a user of the client based on a plurality of resource profiles received from a plurality of interfaces in communication with the proxy server.

14. The apparatus of claim 13, wherein the proxy server comprises:

an authorization manager that determines whether the user of the client is authorized to access the resource using the profile that is dynamically built for the user.

15. The apparatus of claim 14, wherein the proxy server comprises:

a router that routes the message to the resource based on a set of endpoint references for the resource after the user has been authorized to access the resource.

16. The apparatus of claim 14 further comprising:

a cache in communication with the proxy server, wherein the authorization manager determines whether the user is authorized to access the resource based on an existing profile stored in the cache.

17. The apparatus of claim 13, wherein the profile is one of an existing profile stored in a cache and a new profile that is dynamically built for the user.

18. The apparatus of claim 17, wherein the new profile is stored in the cache along with a logical expiration time and a physical expiration time for the new profile.

19. The apparatus of claim 17, wherein the new profile comprises:

a plurality of context resource identifiers that reference the plurality of interfaces; and

a set of permissions for the user corresponding to each context resource identifier in the plurality of context resource identifiers, wherein each permission in the set of permissions corresponds to a different role of the user.

20. The apparatus of claim 13, wherein each resource profile in the plurality of resource profiles includes a set of endpoint references and authorization information.

21. The apparatus of claim 13, wherein the proxy server and the gateway form a dynamic and distributed system for facilitating communications between various clients and various resources that allows clients and resources to join and leave the dynamic and distributed system over time.

22. A dynamic proxy server comprising:

a message manager that receives a message that includes a context resource identifier from a client through a gateway in communication with both the client and the dynamic proxy server;

an authorization manager that determines whether a user of the client is authorized to access a resource associated with an interface that is referenced by the context resource identifier using a profile that is dynamically built for the user of the client based on a plurality of resource profiles received from a plurality of interfaces in communication with the dynamic proxy server; and

a router that routes the message to the resource after the user has been authorized to access the resource.