Implementing organization-specific policy during establishment of an autonomous connection between computer resources

• US 8,365,261 B2
• Filed: 07/09/2008
• Issued: 01/29/2013
• Est. Priority Date: 07/09/2008
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Bhattacharyya, Anamitra, Fred, Ann Marie, Madduri, Hari H., Sarasin, Thomas J., Taank, Sumit
• Primary Examiner(s): Davis, Zachary A
• Application Number:
  US12/169,807
• Publication Number:
  US 20100011408A1
• Time in Patent Office: 1,665 Days
• Field of Search: 726 1- 7, 726/18, 726/19, 726/27, 713/150, 713/166, 713/164, 380/255
• US Class Current: 726/6
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method for implementing organization-specific policy during establishment of an autonomous connection between computer resources includes evaluating a relative priority between default credentials and alternative credentials; and using the highest priority credentials to establish a connection between the computer resources. The alternative credentials are based on organization-specific policy and provide for autonomous connections between computer resources differently than the default credentials.

Claims

1. A method for implementing organization-specific policy during establishment of an autonomous connection between computer resources in an environment that provides for a default connection workflow, said default connection workflow comprising default credentials for connecting a first computer resource to a second computer resource, and an alternative connection workflow, said alternative connection workflow comprising alternative credentials based on said organization-specific policy for connecting said first computer resource to said second computer resource, said method comprising:

evaluating a relative priority of said default credentials and said alternative credentials to establish which of said default credentials and said alternative credentials are priority credentials; and

establishing said connection between said first computer resource and said second computer resource based on said priority credentials.

2. The method of claim 1, wherein said evaluating said relative priority of said default credentials and said alternative credentials comprises determining if said default credentials are designated as overrideable.

3. The method of claim 2, further comprising designating said default credentials as said priority credentials if said default credentials are not designated as overrideable.

4. The method of claim 3, further comprising designating said alternative credentials as said priority credentials if said default credentials are designated as overrideable and said alternative credentials exist and are valid.

5. The method of claim 2, further comprising determining whether said alternative credentials exist and are valid if said default credentials are designated as overrideable.

6. The method of claim 1, wherein said alternative credentials grant a different level of access to said second computer resource than do said default credentials.

7. The method of claim 1, further comprising obtaining said alternative credentials from a credential mapper that is an independent module.

8. The method of claim 7, further comprising programming said credential mapper with said alternative credentials based on said organization-specific policy.

9. The method of claim 1, further comprising executing an operation over said connection.

10. The method of claim 1, wherein when the default credentials are the priority credentials, the method further comprises establishing said connection using said default connection workflow, said default connection workflow comprising:

a process code receiving a connection request to make said connection between said first computer resource and said second computer resource, said process code instantiating an integration module and retrieving said default credentials and said alternative credentials, said process code combining said connection request, said default credentials, and said alternative credentials into a parameter map;

an integration module receiving said parameter map and converting said parameter map into translated data, said translated data being compatible with said second computer resource;

a handler module receiving said translated data and evaluating the relative priority between said default credentials and said alternative credentials, and using said priority credentials to make said connection with said second computer resource.

11. The method of claim 1, wherein said alternative connection workflow further comprises:

passing at least a portion of said connection request to a credential mapper, said credential mapper using said at least a portion of said connection request to apply organization-specific code and return said alternative credentials to an integration module.

12. The method of claim 11, wherein said evaluating said relative priority of said default credentials and said alternative credentials comprises determining if said default credentials are overrideable and if said alternative credentials exist and are valid;

wherein said alternative credentials are determined to be said priority credentials if said default credentials are overrideable and said alternative credentials exist and are valid.

13. The method of claim 12, wherein said default credentials are associated with an override parameter, said override parameter being selected to indicate if said default credentials are overrideable.

14. The method of claim 13, wherein said default credentials comprise data identifying said second computer resource, a protocol used to connect to said second computer resource, and a single username and password to be used to connect to said second computer resource.

15. The method of claim 12, wherein said credential mapper is configured to be programmed without requiring the programmer of the credential mapper to have a knowledge of implementation details of said integration module.

16. The method of claim 12, wherein said organization-specific code can be altered by modifying said credential mapper without modifying said integration module.

17. The method of claim 12, wherein said organization-specific code comprises security rules defining organizational entities authorized to connect to said second computing resource.

18. The method of claim 12, wherein said organization-specific code comprises a credential mapper, said credential mapper evaluating at least one business attribute during the calculation of said alternative credentials.

19. The method of claim 1, wherein said default credentials are accessible within a database such that an administrator can create, modify or delete said default credentials.

20. A computer program product for implementing organization-specific code during an autonomous establishment of a connection between computer resources, the computer program product comprising:

a computer usable storage device having computer usable program code embodied therewith, the computer usable program code comprising;

computer usable program code configured to establish a default connection workflow, said default connection workflow being configured to supply default credentials valid for connecting a first computer resource to a second computer resource;

computer usable program code configured to establish an alternative connection workflow, said alternative connection workflow being configured to apply organization-specific rules to supply alternative credentials valid for connecting said first computer resource to said second computer resource;

computer usable program code configured to evaluate a relative priority of said default credentials and said alternative credentials to establish which of said default credentials and said alternative credentials are priority credentials; and

computer usable program code configured to use said priority credentials to establish said connection between said first computer resource and said second computer resource.