Deployment tool and method for managing security lifecycle of a federated web service

• US 8,543,810 B1
• Filed: 08/07/2006
• Issued: 09/24/2013
• Est. Priority Date: 08/07/2006
• Status: Active Grant

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Oracle America, Inc. (Oracle Corporation)
• Inventors: Angal, Rajeev, Simhachalam, Malla V., Narayanan, Srividhya
• Primary Examiner(s): Mehedi, Morshed
• Assistant Examiner(s): LANE, GREGORY A
• Application Number:
  US11/462,780
• Time in Patent Office: 2,605 Days
• Field of Search: 726/8, 726/14, 713/155
• US Class Current: 713/155
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24

Abstract

A method for managing a security lifecycle of a federated web service provider (WSP) is described. The method includes populating a graphical user interface with available security mechanisms, receiving a selection of a selected security mechanism from a user, and creating a deployment time policy generator for instantiating the selected security mechanism in outgoing messages generated by the WSP. A system and machine readable-medium for a deployment tool for performing the method are also described.

Claims

1. A computer implemented method for deploying a federated web service provider (WSP), the method comprising:

populating a graphical user interface with a plurality of security mechanism identifiers each corresponding to a security mechanism for one or more transactions, for selection by a deployer, the plurality of security mechanism identifiers maintained by a security provider module that is distinct from a business logic module used to identify security mechanism identifiers for populating the graphical user interface, wherein the business logic module implements a function of the WSP and delegates security functionality to the security provider module;

receiving a selection of a transaction type associated with the one or more transactions;

receiving deployer selection of one of the security mechanism identifiers appropriate for the transaction type associated with the one or more transactions, the selected security mechanism identifier mapped to the transaction type of the one or more transactions to provide a level of security based on sensitivity of the one or more transactions;

generating a client-side provider for identifying the transaction type of each of one or more incoming messages of the one or more transactions and implementing the deployer selections to permit or disallow security mechanisms of the incoming messages in accordance with the deployer selection of security mechanism mapped to the transaction type of the incoming messages, the incoming messages being messages received by the WSP;

receiving updates to one or more security mechanisms; and

updating the security mechanisms maintained by the security provider module without modifying the business logic module, wherein updating includes mapping the updated security mechanism to the one or more transactions during generation of the client-side provider.

2. The method of claim 1, further comprising:

populating the graphical user interface with available policy rules;

indicating which of the available security mechanisms are enabled for the transaction type selected;

indicating which of the deployer-defined policy rules are enabled for the transaction type selected;

causing the enabled security mechanisms to be mapped to the transaction type in response to the deployer selections of security mechanisms and causing the policy rules to be changed in response to deployer selections of policy rules; and

configuring the client side provider to enforce policy rules enabled for a transaction type corresponding to the transaction type of the incoming message.

3. The method of claim 1, further comprising:

creating a deployment time policy generator causing the selected security mechanism to be inserted into outgoing messages generated by the WSP.

4. The method of claim 1, further comprising:

accessing a trusted authority to determine what security mechanisms are supported by the trusted authority, the plurality of security mechanism identifiers corresponding to the security mechanisms supported by the trusted authority; and

registering the WSP with the trusted authority, the registering comprising information identifying security mechanisms that are acceptable to the WSP, the acceptable security mechanisms corresponding to the user selections.

5. The method of claim 4 wherein the registering comprises providing a resource offering message, the resource offering message including an endpoint URL where the WSP is available, the security mechanisms that are acceptable to the WSP, and information on how to generate security tokens corresponding to the acceptable security mechanisms.

6. A method for deploying or redeploying a federated web service provider (WSP), the method comprising:

populating a graphical user interface with a plurality of security mechanism identifiers corresponding to security mechanisms appropriate for one or more transactions selected by a deployer, the plurality of security mechanism identifiers maintained by a security provider module distinct from a business logic module that is used to identify security mechanism identifiers for populating the graphical user interface, wherein the business logic module implements a function of the WSP and delegates security functionality to the security provider module;

populating the graphical user interface with available deployer-defined policy rules;

receiving a selection of a transaction type;

indicating which of the available security mechanisms are enabled for the transaction type;

indicating which of the deployer-defined policy rules are enabled for the transaction type;

receiving deployer selections causing the enabled security mechanism and enabled user-defined policy rules to be changed, the changed security mechanism and user-defined policy rules mapped to the one or more transactions;

generating a client-side provider implementing the deployer selections to permit or disallow security mechanisms of incoming messages of the one or more transactions in accordance with the deployer selections and enforce the policy rules on the incoming messages, the incoming messages being messages received by the WSP;

generating a deployment time policy generator causing the selected security mechanism to be inserted into outgoing messages generated by the WSP;

receiving updates to one or more security mechanisms; and

updating the security mechanisms maintained by the security provider module without modifying the business logic module, the updating causing the updated security mechanisms to be inserted into the outgoing messages generated by the WSP independent of the business logic.

7. The method of claim 6, further comprising:

receiving deployer input for creating a new policy rule, the new policy rule being added to the list of available deployer-defined policy rules.

8. The method of claim 6, wherein, when the security mechanism of an incoming message is the client-side provider validates the security mechanism.

9. The method of claim 6, wherein the WSP resides within a circle of trust, the method further comprising:

accessing a trusted authority within the circle of trust to determine what security mechanisms are supported by the trusted authority, the available security mechanisms being the security mechanisms supported by the trusted authority.

10. The method of claim 6, wherein the WSP resides within a circle of trust, the method further comprising:

registering the WSP with a trusted authority within the circle of trust with selected security mechanism.

11. A non-transitory machine readable medium embodying computer program instructions which when implemented by a computer system performs a method for managing a security lifecycle of a federated web service provider (WSP), the machine readable medium comprising:

program instructions for populating a graphical user interface with a plurality of security mechanism identifiers each corresponding to a security mechanism for one or more transactions for selection by a deployer, the plurality of security mechanism identifiers maintained by a security provider module distinct from a business logic module that is used to identify security mechanism identifiers for populating the graphical user interface, wherein the business logic module implements a function of the WSP and delegates security functionality to the security mechanism module;

program instructions for receiving a selection of a transaction type associated with the one or more transactions;

program instructions for receiving deployer selection of one of the security mechanism identifiers appropriate for the transaction type associated with the one or more transactions, the selected security mechanism identifier mapped to the transaction type of the one or more transactions;

program instructions for generating a client-side provider for identifying the transaction type of each of one or more incoming messages of the one or more transactions and implementing the deployer selections to permit or disallow security mechanisms of the incoming messages in accordance with the deployer selection of security mechanism mapped to the transaction type of the incoming messages, the incoming messages being messages received by the WSP;

program instructions for receiving updates to one or more security mechanisms; and

program instructions for updating the security mechanisms maintained by the security provider module without modifying the business logic module, the updated security mechanism used in generating the client-side provider for the one or more transactions independent of the business logic module.

12. The machine readable medium of claim 11, further comprising:

program instructions for populating the graphical user interface with available policy rules;

program instructions for indicating which of the available security mechanisms are enabled for the transaction type selected;

program instructions for indicating which of the deployer-defined policy rules are enabled for the transaction type selected;

program instructions for causing the enabled security mechanisms to be mapped to the transaction type in response to the deployer selections of security mechanisms and causing the policy rules to be changed in response to deployer selections of policy rules; and

program instructions for configuring the client side provider to enforce policy rules enabled for a transaction type corresponding to the transaction type of the incoming message.

13. The machine readable medium of claim 11, further comprising:

program instructions for creating a deployment time policy generator, the deployment time policy generator causing the selected security mechanism to be inserted into outgoing messages generated by the WSP.

14. The machine readable medium readable medium of claim 11, further comprising:

program instructions for accessing a trusted authority to determine what security mechanisms are supported by the trusted authority, the plurality of security mechanism identifiers corresponding to the security mechanisms supported by the trusted authority; and

program instructions for registering the WSP with the trusted authority, the program instructions for registering comprising program instructions for providing information identifying security mechanisms that are acceptable to the WSP, the acceptable security mechanisms corresponding to the user selections.

15. The machine readable medium of claim 14 wherein the program instructions for registering further comprises program instructions for providing a resource offering message, the resource offering message including an endpoint URL where the WSP is available, the security mechanisms that are acceptable to the WSP, and information on how to generate security tokens corresponding to the acceptable security mechanisms.