Method and system for secure pervasive access
First Claim
1. A security system for controlling access to one or more application functions located on a server or accessible via server, each application function having an associated security level, wherein one or more clients communicate with said server by means of requests for accessing one of said application functions using network, wherein access to said application functions is controlled by security requirements, comprising:
- an authentication component functionally separated from said clients and said application functions for processing said client request independently of said client type, containing more than one authentication mechanisms and selecting and executing an authentication mechanism from said more than one authentication mechanisms based on the information contained in the client request resulting in a security state;
a security component containing a security policy describing security requirements (security level) for accessing application functions, comparing said security state associated with said client with the security level of the application function on and allowing access to the application function if the security state fulfills the security level.
3 Assignments
0 Petitions
Accused Products
Abstract
The present invention relates to a client-server system having a security system for controlling access to application functions. The security system separated from the clients and the application functions routes all incoming requests created by various PVC-devices to a centralized security system providing an authentication component and a security component. The authentication component provides several authentication mechanisms which may be selected by information contained in the client'"'"'s request. The authentication mechanism may be changed or extended without changing conditions on the client as well on the server or application side. The security component provides a security policy describing security requirements for accessing application functions which may be invoked by the security component. If the selected authentication mechanism succeeds and fulfills the security policy associated to that application function then the application function will be invoked by the security component.
-
Citations
15 Claims
-
1. A security system for controlling access to one or more application functions located on a server or accessible via server, each application function having an associated security level, wherein one or more clients communicate with said server by means of requests for accessing one of said application functions using network, wherein access to said application functions is controlled by security requirements, comprising:
-
an authentication component functionally separated from said clients and said application functions for processing said client request independently of said client type, containing more than one authentication mechanisms and selecting and executing an authentication mechanism from said more than one authentication mechanisms based on the information contained in the client request resulting in a security state;
a security component containing a security policy describing security requirements (security level) for accessing application functions, comparing said security state associated with said client with the security level of the application function on and allowing access to the application function if the security state fulfills the security level. - View Dependent Claims (2, 3, 4, 5, 6)
-
-
7. A method for controlling access to one or more application functions stored on a server or accessible via server, each application function having an associated security level, wherein one or more clients communicate with said server by means of requests for accessing one of said application functions using a network, whereby access to said application functions is controlled by a security requirements, comprising the steps of:
-
routing all incoming requests created by said clients to an authentication component which is functionally independent from said clients and said application functions, said authentication component comprising the steps of;
authentication of said client by determining an authentication mechanism provided by said authentication component by means of authentication information contained in said request and applying said authentication mechanism;
storing a result of said authentication and said authentication information or parts of it contained in said request as a security state;
using security requirements for said one of said application functions to be accessed;
comparing said stored security state with said security requirements for accessing the requested application function; and
invoking said requested application function if said security state fulfills said security requirements. - View Dependent Claims (8, 9, 10, 11, 12, 13, 14)
-
-
15. A client-server system, wherein one or more clients, having client types, communicate with a server by means of requests for accessing application functions located on or accessible via said server, wherein access to said application functions is controlled by a security system located on said server, wherein said security system comprises:
-
an authentication component, functionally separated from said one or more clients and said application functions for processing client request independently of client type, containing a plurality of authentication mechanisms and selecting and executing an authentication mechanism from said a plurality of authentication mechanisms based on the information contained in the client request, resulting in a security state;
a security component containing a security policy describing security requirements (security level) for accessing application functions, comparing said security state associated to a client with the security level of the application function an allowing access to the specified application function if the security state fulfills the security level.
-
Specification