Dynamic negotiation of security arrangements between web services

• US 7,444,522 B1
• Filed: 09/18/2002
• Issued: 10/28/2008
• Est. Priority Date: 09/18/2002
• Status: Expired due to Fees

• Current Assignee: Perfect Commerce Holdings, LLC
• Original Assignee: Open Invention Network LLC
• Inventors: Kasi, Jayaram Rajan, Chang, Symon Szu-Yuan, Sanfilippo, Joseph S., Crall, Christopher
• Primary Examiner(s): Vu; Kimyen
• Assistant Examiner(s): Pich; Ponnoreay
• Application Number:
  US10/246,276
• Publication Number:
  US 20080256364A1
• Time in Patent Office: 2,232 Days
• Field of Search: 713/189, 713/154, 713/201, 713/156, 713/176, 713/175, 713/200, 726/1
• US Class Current: 713/189
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

The present invention relates to computer-based devices and methods negotiate and implement security arrangements between two or more web services. More particularly, it relates to devices and methods that specify input and output interfaces, computation and generation of a security contract consistent with inputs, and implementation of security in accordance with negotiated security arrangements. Particular aspects of the present invention are described in the claims, specification and drawings.

Claims

1. A method of dynamically determining security options for exchange of at least one message between services, comprising the steps of:

providing a computer-readable security option profile data structure stored in memory for a first service;

obtaining a computer-readable security option profile data structure for a second service;

wherein the security option profile data structures for the first and second services include

preference sets, divided into community preferences and service preferences, applicable to communities of collaboration partners and individual collaboration partners, respectively, each preference set including

algorithm preferences for selecting among security arrangement algorithms;

security arrangement preferences for selecting among security arrangements; and

rules for categorizing, prioritizing and comparing preference sets;

receiving a message at the first service from the second service; and

employing the rules to determine security algorithms and arrangements between the first and second services.

2. The method of claim 1, wherein community preferences override service preferences.

3. The method of claim 1, wherein preferences can apply to one or more portions of a message.

4. The method of claim 1, wherein preferences can be categorical or specific.

5. The method of claim 1, wherein algorithm preferences include signature algorithm preferences.

6. The method of claim 1, wherein algorithm preferences include encryption algorithm preferences.

7. The method of claim 1, wherein algorithm preferences include authentication algorithm preferences.

8. The method of claim 1, wherein security arrangement preferences include signature arrangement preferences.

9. The method of claim 1, wherein security arrangement preferences include encryption arrangement preferences.

10. The method of claim 1, wherein security arrangement preferences include authentication arrangement preferences.

11. The method of claim 1, wherein one or more steps are carried out by a third service provider.

12. The method of claim 1, wherein one or more steps are carried out by a trusted party service provider.

13. The method of claim 1, wherein the rules include an algorithm for determining preferences among competing standards.

14. The method of claim 1, wherein the rules include weighting factors.

15. The method of claim 1, wherein the rules include weighting factors favoring the service receiving the message.

16. The method of claim 1, wherein the rules include weighting factors favoring the service sending the message.

17. The method of claim 1, wherein the rules include weighting factors favoring the community of the service receiving the message.

18. The method of claim 1, wherein the rules include weighting factors favoring the community of the service sending the message.