Method and system for securely extending a path of a mobile agent within a network system

• US 7,975,137 B2
• Filed: 01/18/2008
• Issued: 07/05/2011
• Est. Priority Date: 01/19/2007
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP AG (SAP SE)
• Inventors: Rits, Maarten
• Primary Examiner(s): Revak; Christopher A
• Assistant Examiner(s): KOSOWSKI, CAROLYN M
• Application Number:
  US12/016,475
• Publication Number:
  US 20080201762A1
• Time in Patent Office: 1,264 Days
• Field of Search: 713/153, 713/187
• US Class Current: 713/153
• CPC Class Codes: G06F 9/4862 the task being a mobile agent, i.e. specifically designed to migrate
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

A method, a system, and a computer program product for access control using resource filters for a strict separation of application and security logic are described. The computer-implemented method for access control may include receiving at least one access request to at least one resource from an application; providing a resource hierarchy for the at least one resource, the resource having at least one resource class, wherein the resource hierarchy is defined in a single resource; providing a policy comprising at least one access control rule for accessing at least one element of the at least one resource class; verifying the at least one access request based on the policy through an authorization service; and processing the at least one access request through a service interface.

Claims

1. A method of securely extending an initial path of a mobile agent from a first server within a network system having a plurality of servers, at least an initial number of which the mobile agent must pass according to a pre-given chronology which defines the initial path of the mobile agent, the method comprising:

extending the initial path of the mobile agent from an initiator server by a second number of servers of the plurality of servers, when the initiator server is reached by the mobile agent in the pre-given chronology, wherein the second number of servers includes the server following the initiator server according to the initial path thereby defining an extension of the initial path;

jointly encrypting within a nested structure the extension of the initial path and data intended for any one of the second number of servers;

giving the nested structure to the mobile agent to take with it, the nested structure being built up of a number of nested terms corresponding to the second number of servers, each nested term being decryptable by exactly one server of the second number of servers in such a manner that each server of the second number of servers gets access only to the data intended for it and to a section of the extended path, when being reached by the mobile agent in the defined chronology of the extension, the nested structure further including a signature of the initiator server of the extension.

2. The method according to claim 1, further comprising jointly encrypting the initial path and data intended for any one of the initial number of servers within an initial nested structure, the initial nested structure being built up of a number of nested terms corresponding to the initial number of servers, each nested term being decryptable by exactly one server of the initial number of servers in such a manner that each server of the initial number of servers gets access only to the data intended for it and to a section of the path, respectively, when being reached by the mobile agent in the chronology defined by the initial path.

3. The method according to claim 2, wherein the nested term of the initial nested structure which is decryptable by the server following the initiator server according to the initial path is integrated in the nested structure describing the extension.

4. The method according to claim 1, further comprising defined the nested term that is to be decoded by a respective server (the i^th server) for access to the respective data according to the following scheme:

Data_—

S_i=[r0,ip(S_i-1), {S_iKo}KS_i,h(KS_I,S_iKo),{m′

_i}S_iKo]PKS_I

wherein r0 is a unique number that is assigned to the mobile agent, S_iKo is a secret key of the i^th server, KS_i, is the i^th server'"'"'s public key, h is a wrapping function, KS_I is the public key of a signing server, PKS_I is the private key of the signing server and m′

_I is the i^th term of the nested terms which is defined as follows;

m′

_i=m_i, ip(S_i+1), Data ₁₃ S_i+1

wherein i is a positive integer value, m_i, is the data intended for the i^th server S_i, wherein the signing server is the initiator server with respect to the extension and the first server with respect to the initial path.

5. The method according to claim 4, wherein the unique number (r0) is used only once and is calculated on the basis of a program code (PA) of the mobile agent (MA).

6. The method according to claim 5, wherein the program code (PA) of the mobile agent (MA) is maintained in a Java Archive file (JAR).

7. The method according to claim 6, wherein the Java Archive file (JAR) is signed by the first server'"'"'s private key (PKS₀).

8. The method according to claim 6, wherein the Java Archive file (JAR) contains the unique number (r0) assigned to the mobile agent (MA).

9. The method according to claim 5, wherein the agent'"'"'s program code (PA) and the data of the agent are serialized separately.

10. The method according to claim 1, wherein each of the plurality of servers has a pair of a public key (KS₀, . . . , KS_i, . . . , KS_n) and a private key (PKS₀, . . . , PKS_i, . . . , PKS_n) associated therewith, respectively, the method further comprising:

receiving the mobile agent which has been prepared by the first server (S₀) at the initiator server by choosing a unique number (r0) and assigning it to the mobile agent, encoding the chosen unique number (r0) with the private key (PKS₀) of the first server (S₀), thus forming an agent specific initialization number (C₀) as basis for a sequence of checksums (C₀, . . . , C_i, . . . , C_n) to be computed successively by the number of servers (S₀, S₁, . . . , S_n) to be passed by the mobile agent, and sending the mobile agent together with its initialization number (C₀) on its route through the network system for processing an order passing thereby the number of servers (S₀, S₁, . . . , S_n) successively;

encoding at the initiator server the initialization number (C₀) together with data (X_i) which are to be added by the initiator server and which comprise at least all identities of the servers on the extension with the initiator server'"'"'s private key (PKS_i,) and computing therewith a new server specific checksum (C_i,) using the public key (KS₀) of the first server (S₀) and the checksum (C_i-1) computed by the server (S_i-1) right before in the succession; and

sending the mobile agent further on the extension passing thereby the second number of servers successively, so that each server of the second number of servers when being passed by the mobile agent encodes the initialization number (C₀) together with data which are to be added at that respective server and which comprise at least the identity of that respective server with that server'"'"'s private key and computes therewith a new server specific checksum using the public key (KS₀) of the first server (S₀) and the checksum computed by the server right before in the succession, and sends the mobile agent together with the new checksum further to the next server within the succession.

11. The method according to claim 10, wherein the data to be added at any of the servers are encoded by the public key (KS₀) of the first server (S₀).

12. The method according to claim 10, wherein the data the mobile agent gathers on its route through the network when processing the order are collected within a secure data container.

13. The method according to claim 10, wherein the sequence of checksums is defined as

C_i={C_i-1,[X_{i31 1},[r0]PKS₀]PKS_iS_i}KS₀

wherein C_i is the i^th checksum, X_i is the data to be added at the i^th server, r0 is the unique number, PKS₀ is the private key of the first server, KS₀ is the public key of the first server, PKS_i is the private key of the i^th server, S_i is a code number of the i^th server, i is a positive integer value.

14. The method according to claim 10, further comprising deflating each checksum (C_i) by the first server for verifying successively the respective keys on the data thus checking the orderly completion of the path when the mobile agent returns back to the first server (S₀).

15. A system comprising:

a mobile agent;

a plurality of servers that the mobile agent must pass according to a pre-given chronology that defines an initial path of the mobile agent; and

an initiator server, selected from the plurality of servers, and configured such that when the initiator server is reached by the mobile agent in the pre-given chronology it extends the initial path of the mobile agent by a second number of servers, including a server following the initiator server according to the initial path, thereby defining an extension of the initial path,

wherein the mobile agent carries the extended path and data intended for any one of the second number of servers and wherein the extended path and the data are jointly encrypted within a nested structure, the nested structure being built up of a number of nested terms corresponding to the second number of servers, each nested term being decryptable by exactly one server of the second number of servers in such a manner that each server of the second number of servers gets access only to the data intended for it and to a section of the path, when being reached by the mobile agent in the defined chronology of the extension, the nested structure further being signed by a signature of the initiator server of the extension.

16. The system according to claim 15, wherein the initial path and data intended for any one of an initial number of servers which are to be passed on the initial path are jointly encrypted within an initial nested structure, the initial nested structure being built up of a number of nested terms corresponding to the initial number of servers, each nested term being decryptable by exactly one server of the initial number of servers in such a manner that each server of the initial number of servers gets access only to the data intended for it and to a section of the path, respectively, when being reached by the mobile agent in the chronology defined by the initial path.

17. The system according to claim 16, wherein the nested term of the initial nested structure which is decryptable by the server following the initiator server according to the initial path is integrated in the nested structure describing the extension.

18. The system according to claim 15, wherein the nested term which is to be decoded by a respective server (the i^th server S_i) for access to the respective data is defined according to the following scheme:

Data₁₃ S_i=[r0,ip(S_{i31 1}),ip(S_i,{S_iKo}KS_i,h(KS_I,S_iKo),{m′

_i}S_iKo]PKS_I

wherein i is a positive integer value, r0 is a unique number, ip(S_i) and ip(S_i-1) are the respective ip-addresses of servers S_i and S_i-1, respectively, S_iKo is a secret key of the i^th server, KS_i is the i^th server'"'"'s public key, h is a wrapping function, KS_I is the public key of a signing server, PKS_I is the private key of the signing server and m′

_i is the i^th term of the nested terms which is defined as follows;

m′

_i=m_i,ip(S_i+i), Data —

S_i+1

wherein ip(S_i+1) is the respective ip-address of server S_i+1, and m_i is the data intended for the i^th server S_i, wherein the signing server is the initiator server with respect to the extension and the first server with respect to the initial path.

19. The system according to claim 18, wherein the unique number (r0) is used only once and is calculated on basis of a program code (PA) of the mobile agent (MA).

20. The system according to claim 19, wherein the program code (PA) of the mobile agent (MA) is maintained in a Java Archive file (JAR).

21. The system according to claim 20, wherein the Java Archive file (JAR) is signed by the first server'"'"'s private key (PKA).

22. The system according to claim 20, wherein the Java Archive file (JAR) contains the unique number (r0) assigned to the mobile agent (MA).

23. The system according to claim 19, wherein the agent'"'"'s program code (PA) and the data of the mobile agent (MA) are serialized separately.

24. The network system according to claim 15, wherein the at least one initiator server of the plurality of servers (S₀, S₁, . . . , S_n) is configured to receive the mobile agent which has been prepared by the first server by encoding the chosen unique number (r0) with the private key (PKS₀) of the first server (S₀), thus forming an agent specific initialization number (C₀) as basis for a sequence of checksums (C_O, . . . ,C_i, . . . ,C_n) to be computed successively by the number of servers (S₀, S₁, . . . , S_n) to be passed by the mobile agent, and sending the mobile agent together with its initialization number (C₀) on its route passing thereby the number of servers (S₀, S₁, . . . , S_n) successively, to encode when being passed the initialization number (C₀) together with data (X_i) which are to be added by the initiator server and which comprise at least all identities of the servers on the extension with said server'"'"'s private key (PKS_i) and to compute therewith a new server specific checksum (C_i) using the public key (KS₀) of the first server (S₀) and the checksum (C_i-1) computed by the server right before in the succession, and to send the mobile agent further to the next server on the extension passing thereby the second number of servers successively, for that each server of the second number of servers when being passed by the mobile agent encodes the initialization number (C₀) together with data which are to be added at that respective server and which comprise at least the identity of that respective server with that server'"'"'s private key and computes therewith a new server specific checksum using the public key (KS₀) of the first server (S₀) and the checksum computed by the server right before in the succession, and sends the mobile agent together with the new checksum further to the next server within the succession.

25. The system according to claim 24, wherein the sequence of checksums is defined as:

C_i={C<sub>i−

1</sub>,[X_i,[r0]PKS₀]PKS_i,S_i}KS₀

wherein C_i is the i^th checksum, Xis the data to be added at the i^th server, r0 is the unique number, PKS₀ is the private key of the first server, KS₀ is the public key of the first server, PKS_i is the private key of the i^th server, S_i is a code number of the i^th server, i is a positive integer value.

26. A computer program stored on a non-transitory computer-readable medium with a program code that when executed on a computer enables the computer to securely extend an initial path of a mobile agent from a first server within a network system having a plurality of servers, at least an initial number of which the mobile agent must pass according to a pre-given chronology which defines the initial path of the mobile agent, by:

extending the initial path of the mobile agent from an initiator server by a second number of servers of the plurality of servers, when the initiator server is reached by the mobile agent in the pre-given chronology, wherein the second number of servers includes the server following the initiator server according to the initial path thereby defining an extension of the initial path;

encrypting within a nested structure the extension of the initial path and data intended for any one of the second number of servers;

giving the nested structure to the mobile agent to take with it, the nested structure being built up of a number of nested terms corresponding to the second number of servers, each nested term being decryptable by exactly one server of the second number of servers in such a manner that each server of the second number of servers gets access only to the data intended for it and to a section of the extended path, when being reached by the mobile agent in the defined chronology of the extension, the nested structure further including a signature of the initiator server of the extension.