Infrastructure to secure federated web services

• US 8,275,985 B1
• Filed: 03/30/2007
• Issued: 09/25/2012
• Est. Priority Date: 08/07/2006
• Status: Active Grant

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Oracle America, Inc. (Oracle Corporation)
• Inventors: Narayanan, Srividhya, Angal, Rajeev, Simhachalam, Malla V.
• Primary Examiner(s): Zee, Edward
• Assistant Examiner(s): Paliwal, Yogesh
• Application Number:
  US11/694,001
• Time in Patent Office: 2,006 Days
• Field of Search: 713/160
• US Class Current: 713/160
• CPC Class Codes: G06Q 50/14 Travel agencies
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/133 Protocols for remote procedure calls [RPC]

Abstract

A federation participant in communication with other participants of a federation according to a federation protocol is described. The web service participant includes business logic and a security provider. The business logic implements a web service consumer (WSC) or a web service provider (WSP) business logic. The business logic is configured to generate an outgoing message for transmission to a recipient and receive an incoming message from the recipient, the recipient being a WSP if the business logic is a WSC business logic and a WSC if the business logic is a WSP business logic. The security provider is configured to receive the generated messages and apply header information to the outgoing message according to the federation protocol to form a modified outgoing message. The security provider then transmits the modified outgoing message to the recipient. Methods of operation for the WSC and WSP are also described.

Claims

1. An apparatus, comprising:

one or more processors;

memory and storage; and

a federation participant in communication with other participants of a federation according to a federation protocol, the federation participant further comprising;

a business logic, the business logic being one of a web service consumer (WSC) business logic or a web service provider (WSP) business logic, the business logic being a software component configured to execute within a container on a computer, the business logic being configured to generate an outgoing message for transmission to a fictitious recipient and receive an incoming message from a WSP if the business logic is a WSC business logic and a WSC if the business logic is a WSP business logic;

a security provider, the security provider being configured to execute in the container with the business logic, the security provider receiving the generated messages and applying header information to the outgoing message according to the federation protocol and a list of permitted security mechanism types to form a modified outgoing message, the security provider then transmitting the modified outgoing message to a real recipient.

2. The apparatus of claim 1, wherein the security provider authenticates itself with an identity provider to obtain an assertion, the assertion attesting to the identity of the federation participant.

3. The apparatus of claim 2, wherein the security provider communicates with a trusted authority to obtain a resource offering containing data relating to the real recipient, the data relating to the real recipient including an endpoint address and security requirements for the recipient.

4. The apparatus of claim 1, wherein the business logic is configured to transmit the outgoing message to the fictitious recipient and the security provider is configured to intercept the outgoing message being transmitted by the business logic and prevent transmission of the outgoing message prior to being modified.

5. The apparatus of claim 1, wherein the security provider is further configured to receive an incoming message from the real recipient, the incoming message being transmitted in conformance with the federation protocol, the security provider being configured to validate any security mechanisms incorporated into the incoming message and pass a message body of the incoming message to the business logic.

6. The apparatus of claim 1, wherein the federation participant is a web service consumer, the real recipient is a web service provider, the outgoing message is a remote procedure call (RPC) query, and the incoming message is an RPC response.

7. The apparatus of claim 1, wherein the federation participant is a web service provider, the real recipient is a web service consumer, the outgoing message is a remote procedure call (RPC) response and the incoming message is an RPC query.

8. The apparatus claim 7, wherein the security provider is further configured to receive the RPC response from the web service consumer, the security provider being configured to verify that the RPC response is provided with a security mechanism is of an acceptable type according to a predetermined policy.

9. A method for accessing a web service provider (WSP) at a web service consumer (WSC), the method comprising:

using a WSC business logic to generate an original query message to a fictitious WSP, wherein the WSP and WSC are participants in a federation according to a federation protocol;

receiving the original query message in a security provider;

identifying a real WSP that is an intended recipient of the original query message;

processing the original query message to generate a modified query message that conforms to the federation protocol, the modified query message including a header with a security mechanism selected by the security provider from a list of permitted security mechanism types; and

transmitting the modified query message to the real WSP over a network from the security provider, the WSC business logic and the security provider each being a distinct software module executing within a container on a computer.

10. The method of claim 9, wherein the WSC business logic performs operations to transmit the original query message, the method further comprising intercepting the original query message and preventing the transmission of the original query message, the security provider operating to perform the intercepting and preventing.

11. The method of claim 9, wherein the processing of the original query message comprises:

stripping an envelope from the original query message, and applying a new envelope, the new envelope including endpoint information of the real WSP.

12. The method of claim 9, further comprising:

identifying whether the real WSP requires authentication;

generating a query message to request authentication from an identity provider;

receiving an assertion from the identity provider, the assertion including information that is usable by the real WSP to authenticate the WSC; and

incorporating the assertion into the modified query message.

13. The method of claim 9, further comprising:

determining whether an endpoint address and security requirements of the real WSP are known;

generating a query message to request a resource offering relating to the real WSP, the resource offering including an endpoint address of the real WSP and permitted security mechanism types;

encoding the modified query message using a security mechanism type acceptable to the real WSP according to the resource offering and addressing an envelope of the modified query message using the endpoint address provided in the resource offering.

14. The method of claim 9, further comprising:

receiving a response message from the real WSP;

decoding and validating any security mechanism provided with the response message; and

passing a message body of the response message to the WSC business logic.

15. A method for providing a web service at a web service provider (WSP) to a web service consumer (WSC), the method comprising:

receiving a query message from a real WSC over a network in a security provider, wherein the WSP and WSC are participants in a federation according to a federation protocol and wherein a header for the query message conforms to the federation protocol;

identifying a security mechanism incorporated into the header for the query message;

verifying that the security mechanism corresponds to an acceptable type of security mechanism selected by the real WSC from a list of permitted security mechanism types;

validating the security mechanism, the validating including determining that the real WSC is authenticated and that the message integrity is not compromised;

extracting a message body from the query message; and

sending the message body to WSP business logic from the security provider, the security provider and the business logic each comprising a distinct software module executing within a container on a computer; and

using a WSP business logic to generate an original response message addressed to a fictitious WSC.

16. The method of claim 15, wherein the WSP business logic is configured to communicate directly with the real WSC and the message body is sent to the WSP business logic in a manner allowing the WSP business logic to receive the message body as though it was received directly from the real WSC over the network.

17. The method of claim 15, further comprising:

generating an error message for transmission to the real WSC when the query message has an unacceptable security mechanism type and when the query message cannot be validated; and

transmitting the error message to the real WSC over the network.

18. The method of claim 15, further comprising:

receiving the original response message in the security provider;

identifying a real WSC that is an intended recipient of the original response message;

processing the original response message to generate a modified response message, the modified query message including a header and security mechanism according to requirements of the real WSC; and

transmitting the modified response message to the real WSC.

19. The method of claim 15, wherein the WSP business logic performs operations to transmit the original response message, the method further comprising intercepting the original response message and preventing the transmission of the original response message, the security provider operating to perform the intercepting and preventing.

20. The method of claim 15, wherein the processing of the original response message comprises:

stripping an envelope from the original response message, and applying a new envelope, the new envelope including endpoint information of the real WSC.