System and method for facilitating the provision of web services across different internet security domains

• US 8,572,675 B2
• Filed: 04/03/2009
• Issued: 10/29/2013
• Est. Priority Date: 04/03/2009
• Status: Active Grant

• Current Assignee: The Boeing Co.
• Original Assignee: The Boeing Co.
• Inventors: Chazin, David
• Primary Examiner(s): Kim, Jung
• Assistant Examiner(s): NGUYEN, NGOC THACH D
• Application Number:
  US12/418,402
• Publication Number:
  US 20100257587A1
• Time in Patent Office: 1,670 Days
• Field of Search: 726/3, 726/5, 726/1, 726/13
• US Class Current: 726/1
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A method and apparatus for cross-domain Web-service publishing of information regarding a Web service provider in a first domain having a first security clearance access level into a second domain having a second security clearance access level across a cross-domain security system may comprise a cross-domain publishing service within the second domain receiving through the security system a request to publish information regarding the Web service provider located in the first domain; and may comprise the cross-domain publishing service establishing a surrogate end point within the second domain corresponding to the Web service provider and making available at the surrogate end point Web service information regarding the provision of a Web service by the Web service provider. The second domain cross-domain publishing service may register the Web service provider within the second domain and may also provide a link to the surrogate endpoint.

Claims

1. A cross-domain Web service publishing system embodied on one or more processing devices comprising:

a source security domain having a first security clearance classification;

a first cross-domain publishing service located in the source security domain to;

receive a Web service publication request from a service publication requester;

retrieve a Web services description language reference for the Web service from a remote source;

create a call to publish the Web service; and

transmit the call to a first security server located in the source security domain;

a destination security domain having a second security clearance classification;

a second cross-domain publishing service within the destination security domain to;

receive the Web service publication request;

establish a surrogate end point within the destination security domain; and

publish at the surrogate end point a Web services description language reference regarding the provision of the Web service by the Web service provider; and

a high assurance guard (HAG) service configured to provide communication connections between the first cross-domain publishing service and the second cross-domain publishing service;

wherein the HAG service comprises a source HAG node in the source security domain and a destination HAG node in the destination security domain;

wherein the source HAG node is configured to receive the Web service publication request, and to determine whether the Web service publication request violates one or more security rules;

wherein the destination HAG node is configured to receive the Web service publication request from the source HAG node, unwrap the Web service publication request, and pass the Web service publication request to the second cross-domain publishing service; and

wherein the second cross-domain publishing service is configured to determine whether the service identified in the Web service publication request violates one or more security rules, and to create a repository and directory for the service identified in the Web service publication request.

2. The system of claim 1 wherein the HAG service further comprises:

at least one intermediate HAG node in the communication path between the source HAG node and the destination HAG node.

3. The system of claim 2 wherein the source HAG node is further configured to transmit the Web service publication request in response to a determination that the Web service publication request does not violate one or more security rules.

4. The system of claim 1 wherein the Web service publication request identifies a first service endpoint in the source security domain, and wherein a consumer in the destination security domain generates a binding that points to the first service endpoint in the source security domain.

5. A method to publish Web service information regarding a Web service provider in a source security domain into a destination security domain, wherein said source security domain has a first security clearance classification and said destination security domain has a second security classification, comprising:

in a first cross-domain publishing service location in the source security domain;

receiving a Web service publication request from a service publication requester;

retrieving a Web services description language reference for the Web service from a remote source;

creating a call to publish the Web service; and

transmitting the call to a first security server located in the source security domain;

in a second cross-domain publishing service within the destination security domain;

establishing a surrogate end point within the destination security domain; and

publishing at the surrogate end point a Web services description language reference regarding the provision of the Web service by the Web service provider;

wherein the source security domain and the destination security domain are communicatively coupled through a high assurance guard (HAG) service;

wherein the HAG service comprises a source HAG node in the source security domain and a destination HAG node in the destination security domain;

wherein the source HAG node is configured to receive the Web service publication request, and to determine whether the Web service publication request violates one or more security rules;

wherein the destination HAG node is configured to receive the Web service publication request from the source HAG node, unwrap the Web service publication request, and pass the Web service publication request to the second cross-domain publishing service; and

wherein the second cross-domain publishing service is configured to determine whether the service identified in the web service publication request violates one or more security rules, and to create a repository and directory for the service identified in the Web service publication request.

6. The method of claim 5 wherein the HAG service further comprises:

at least one intermediate HAG node in the communication path between the source HAG node and the destination HAG node.

7. The method of claim 5 wherein the source HAG node:

transmits the Web service publication request in response to a determination that the Web service publication request does not violate one or more security rules.

8. The method of claim 5 wherein the Web service publication request identifies a first service endpoint in the source security domain, and wherein a consumer in the destination security domain generates a binding that points to the first service endpoint in the source security domain.