Security control module

• US 20050097350A1
• Filed: 10/08/2004
• Published: 05/05/2005
• Est. Priority Date: 10/10/2003
• Status: Active Grant

• Current Assignee: BAE Systems Incorporated (BAE Systems Plc), Oracle International Corporation (Oracle Corporation)
• Original Assignee: BEA Systems Incorporated (Oracle Corporation)
• Inventors: Xu, Mingde, Byrne, David, Howes, Jason, Patrick, Paul, Riendeau, Richard J., Yagen, Kenneth D., Falco, Mark A.
• Granted Patent: US 7,603,547 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system and method for distributing information from a first process to one or more security service modules, said system comprising the steps of, a remote interface capable of accepting first information from the first process, a provisioning service provider coupled to the remote interface and capable of obtaining the first information from the remote interface, and further capable of providing second information to a local interface, wherein the second information is based on the first information and is tailored for the one or more security service modules, the local interface capable of providing the second information to the one or more security service modules and wherein the one or more security service modules are capable of accepting the second information and performing at least one of the following: adjusting a configuration of the one or more security service modules to reflect the second information, and protecting access to at least one resource based on the second information.

Claims

1. A system for distributing information from a first process to one or more security service modules, said system comprising the steps of:

a remote interface capable of accepting first information from the first process;

a provisioning service provider coupled to the remote interface and capable of obtaining the first information from the remote interface, and further capable of providing second information to a local interface, wherein the second information is based on the first information and is tailored for the one or more security service modules;

the local interface capable of providing the second information to the one or more security service modules; and

wherein the one or more security service modules are capable of accepting the second information and performing at least one of the following;

adjusting a configuration of the one or more security service modules to reflect the second information, and protecting access to at least one resource based on the second information.

2. The system of claim 1 wherein:

at least one of the first information and the second information includes only information that has changed.

3. The system of claim 1 wherein:

the first information and the second information include at least one of the following;

a policy and configuration information.

4. The system of claim 3 wherein:

a policy controls access to one of;

a resource, a resource attribute and a role.

5. The system of claim 1 wherein:

the tailored first information includes only information relevant to the provisioning service provider.

6. The system of claim 1 wherein:

the tailored second information includes only information relevant to one of the one or more security service modules.

7. The system of claim 1 wherein a security service module includes:

a dynamically configurable services layer.

8. The system of claim 1, further comprising:

a cache capable of caching the first information.

9. The system of claim 1, further comprising:

a cache capable of caching the second information.

10. The system of claim of 1 wherein:

the second information is automatically provided to the one or more security service modules.

11. The system of claim 1 wherein:

the second information is provided to the one or more security service modules when the one or more security service modules requests the second information.

12. The system of claim 1, further comprising:

a secure communication link capable of securely transporting at least one of;

the first information and the second information.

13. A method for distributing information from a first process to one or more security service modules, said method comprising the steps of:

obtaining the first information from the first process;

providing second information to the one or more security service modules, wherein second information is based on the first information and is tailored for the one or more security service modules; and

wherein the one or more security service modules are capable of accepting the second information and performing at least one of the following;

adjusting a configuration of the one or more security service modules to reflect the second information, and protecting access to at least one resource based on the second information.

14. The method of claim 13 wherein:

at least one of the first information and the second information includes only information that has changed.

15. The method of claim 13 wherein:

the first information and the second information include at least one of the following;

a policy and configuration information.

16. The method of claim 15 wherein:

a policy controls access to one of;

a resource, a resource attribute and a role.

17. The method of claim 13 wherein:

the tailored second information includes only information relevant to one of the one or more security service modules.

18. The method of claim 13 wherein a security service module includes:

a dynamically configurable services layer.

19. The method of claim 13, further comprising:

caching of one or more of;

the first information and the second information.

20. The method of claim of 13 wherein, further comprising:

providing the second information to the one or more security service modules when the one or more security service modules requests the second information.

21. The method of claim 13 wherein:

the first information is transported over a secure communication link.

22. The method of claim 13 wherein:

the second information is transported over a secure communication link.

23. A machine readable medium having instructions stored thereon to cause a system to:

obtain first information from a first process;

provide second information to one or more security service modules, wherein second information is based on the first information and is tailored for the one or more security service modules; and

wherein the one or more security service modules are capable of accepting the second information and performing at least one of the following;

adjusting a configuration of the one or more security service modules to reflect the second information, and protecting access to at least one resource based on the second information.

24. The machine readable medium of claim 23 wherein:

at least one of the first information and the second information includes only information that has changed.

25. The machine readable medium of claim 23 wherein:

the first information and the second information include at least one of the following;

a policy and configuration information.

26. The machine readable medium of claim 25 wherein:

a policy controls access to one of;

a resource, a resource attribute and a role.

27. The machine readable medium of claim 23 wherein:

the tailored second information includes only information relevant to one of the one or more security service modules.

28. The machine readable medium of claim 23 wherein a security service module includes:

a dynamically configurable services layer.

29. The machine readable medium of claim 23, further comprising:

caching of one or more of;

the first information and the second information.

30. The machine readable medium of claim of 23 wherein, further comprising instructions to cause the system to:

providing the second information to the one or more security service modules when the one or more security service modules requests the second information.

31. The machine readable medium of claim 23 wherein:

the first information is transported over a secure communication link.

32. The machine readable medium of claim 23 wherein:

the second information is transported over a secure communication link.

33. A computer signal embodied in a transmission medium, comprising:

a code segment including instructions for obtaining the first information from the first process;

a code segment including instructions for providing second information to the one or more security service modules, wherein second information is based on the first information and is tailored for the one or more security service modules; and

wherein the one or more security service modules are capable of accepting the second information and performing at least one of the following;

adjusting a configuration of the one or more security service modules to reflect the second information, and protecting access to at least one resource based on the second information.