Processing extensible markup language security messages using delta parsing technology

• US 9,530,012 B2
• Filed: 11/13/2014
• Issued: 12/27/2016
• Est. Priority Date: 03/23/2007
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Chung, Hyen Vui, Makino, Satoshi, Teraguchi, Masayoshi, Ueno, Kenichiro
• Primary Examiner(s): Davis, Zachary A
• Application Number:
  US14/540,826
• Publication Number:
  US 20150095657A1
• Time in Patent Office: 775 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 40/143 Markup, e.g. Standard Generalized Markup Language [SGML] or Document Type Definition [DTD]
• CPC Class Codes: G06F 40/151 Transformation
• CPC Class Codes: G06F 40/186 Templates
• CPC Class Codes: G06F 40/194 Calculation of difference between files
• CPC Class Codes: G06F 40/205 Parsing

Abstract

Markup language security messages are processed. A template corresponding to a markup language security message is identified. The markup language security message is parsed for variable values using the template. A transition sequence is generated that represents the entire markup language security message. Each transition in the transition sequence is associated with a portion of the markup language security message. A lightweight data model of the markup language security message is populated using the transition sequence. The lightweight data model includes nodes for the variable values and a set of selected constant values.

Claims

1. A method for constructing a post-transform template for use with a markup language security message in a light weight data model, comprising:

a computer receiving an input byte array associated with the markup language security message, wherein the markup language security message includes a security element and encrypted message data;

the computer determining whether a template corresponding to all of the markup language security message or a portion of the markup language security message is located in an automaton;

responsive to a determination the template corresponding to all of the markup language security message or a portion of the markup language security message is located in the automaton;

the computer retrieving a cached lightweight data model corresponding to the markup language security message and a transition sequence that represents all of the markup language security message;

the computer parsing the transition sequence using a delta parsing engine, to create a first result;

the computer generating the post-transform template using the first result of the delta parsing engine with cached transforms; and

the computer storing the post-transform template in the automaton; and

responsive to a determination the template corresponding to all of the markup language security message or a portion of the markup language security message is not located in the automaton;

the computer calling transformers corresponding to transform information stored in the cached lightweight data model to construct the post-transform template, wherein a first process calling a transform using an expression conforming to Xpath produces a first transform result and a second process calling a canonicalization transform using the first transform result produces the post-transform template;

the computer storing the post-transform template in the automaton;

the computer populating the post-transform template with corresponding actual variable values of the input byte array; and

the computer performing a serialization operation using the post transform template as populated to form a serialized byte array.

2. The method of claim 1, further comprising:

the computer using data values in the serialized byte array to verify integrity of the markup language security message.

3. The method of claim 1, wherein the transition sequence contains a transition representing every value in the markup language security message represented by the transition sequence, and wherein each transition in the transition sequence is associated with a portion or snippet of the markup language security message, and each transition represents one of an element, an element tag, a nested sub-element, a nested sub-element tag, a content value, a variable value, a constant value, or an attribute.

4. The method of claim 1, wherein the automaton is a component with capabilities comprising storing one or more cached templates, performing transformations, and performing canonicalization processes associated with processing the markup language security message.

5. The method of claim 1, wherein when one template in the automaton that matches a format or structure of the markup language security message is identified in the automaton, then the transition sequence and data model corresponding to the template identified as a match are also stored in the automaton.

6. The method of claim 1, wherein the computer determining whether a template corresponding to all of the markup language security message or a portion of the markup language security message is located in an automaton further comprises the delta parsing engine treating an input as a transition sequence for the markup language security message received by the delta parsing engine, and wherein the computer determining whether the input treated as a transition sequence matches a cached transition sequence stored in the automaton.

7. The method of claim 1, further comprising:

the computer, in response to receiving a second markup language security message, determining that a result of a transformation of a previous markup language security message stored in the automaton is a match with the second markup language security message; and

the computer, in response to determining that the result of the transformation of the previous markup language security message stored in the automaton is the match with the second markup language security message, skipping a second transformation of the second markup language security message.