Cross domain security information conversion

• US 20050223413A1
• Filed: 03/31/2004
• Published: 10/06/2005
• Est. Priority Date: 03/31/2004
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Wardrop, Patrick Ryan, Falola, Dolapo Martin, Duggan, Matthew Paul
• Granted Patent: US 8,528,063 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: G06F 21/6236 between heterogeneous systems
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04W 4/00 Services specially adapted for wireless communication networks; Facilities therefor

Abstract

Methods, systems, and computer program products are provided for cross domain security information conversion. Embodiments include receiving from a system entity, in a security service, security information in a native format of a first security domain regarding a system entity having an identity in at least one security domain; translating the security information to a canonical format for security information; transforming the security information in the canonical format using a predefined mapping from the first security domain to a second security domain; translating the transformed security information in the canonical format to a native format of the second security domain; and returning to the system entity the security information in the native format of the second security domain.

Claims

1. A method for cross domain security information conversion, the method comprising:

receiving from a system entity, in a security service, security information in a native format of a first security domain regarding a system entity having an identity in at least one security domain;

translating the security information to a canonical format for security information;

transforming the security information in the canonical format using a predefined mapping from the first security domain to a second security domain;

translating the transformed security information in the canonical format to a native format of the second security domain; and

returning to the system entity the security information in the native format of the second security domain.

2. The method of claim 1 wherein transforming the security information includes structure transformation and value transformation, including mapping a system entity'"'"'s identity in the first security domain to a another identity in the second security domain.

3. The method of claim 1 wherein receiving security information further comprises receiving a request for security information for the second security domain, wherein the request encapsulates the security information in a native format of a first security domain.

4. The method of claim 3 wherein the system entity comprises a system entity requesting access to a resource in the second security domain.

5. The method of claim 3 wherein the system entity comprises a system entity providing access to a resource in the second security domain.

6. The method of claim 1 wherein translating the security information in a native format of a first security domain to a canonical format is carried out through a procedural software function.

7. The method of claim 1 wherein the native format of the first security domain is expressed in XML, the canonical format is expressed in XML, and translating the security information in a native format of a first security domain to a canonical format is carried out in dependence upon a mapping, expressed in XSL, from the native format of the first security domain to a canonical format.

8. The method of claim 1 wherein the canonical format is expressed in XML and the predefined mapping from the first security domain to a second security domain is expressed in XSL.

9. The method of claim 1 wherein the second native format is expressed in XML, the canonical format is expressed in XML, and translating the transformed security information in the canonical format to a native format of the second security domain is carried out in dependence upon a predefined mapping, expressed in XSL, from the canonical format to the native format of the second security domain.

10. A system for cross domain security information conversion, the system comprising:

means for receiving from a system entity, in a security service, security information in a native format of a first security domain regarding a system entity having an identity in at least one security domain;

means for translating the security information to a canonical format for security information;

means for transforming the security information in the canonical format using a predefined mapping from the first security domain to a second security domain;

means for translating the transformed security information in the canonical format to a native format of the second security domain; and

means for returning to the system entity the security information in the native format of the second security domain.

11. The system of claim 10 wherein means for transforming the security information includes means for structure transformation and value transformation, including means for mapping a system entity'"'"'s identity in the first security domain to a another identity in the second security domain.

12. The system of claim 10 wherein means for receiving security information further comprises means for receiving a request for security information for the second security domain, wherein the request encapsulates the security information in a native format of a first security domain.

13. The system of claim 12 wherein the system entity comprises a system entity requesting access to a resource in the second security domain.

14. The system of claim 12 wherein the system entity comprises a system entity providing access to a resource in the second security domain.

15. The system of claim 10 wherein means for translating the security information in a native format of a first security domain to a canonical format comprises a procedural software function.

16. The system of claim 10 wherein means for translating the security information in a native format of a first security domain to a canonical format comprises a mapping, expressed in XSL, from the native format of the first security domain to a canonical format.

17. The system of claim 10 wherein the canonical format is expressed in XML and the predefined mapping from the first security domain to a second security domain is expressed in XSL.

18. The system of claim 10 wherein the second native format is expressed in XML, the canonical format is expressed in XML, and means for translating the transformed security information in the canonical format to a native format of the second security domain comprises a predefined mapping, expressed in XSL, from the canonical format to the native format of the second security domain.

19. A computer program product for cross domain security information conversion, the computer program product comprising:

a recording medium;

means, recorded on the recording medium, for receiving from a computer program product entity, in a security service, security information in a native format of a first security domain regarding a computer program product entity having an identity in at least one security domain;

means, recorded on the recording medium, for translating the security information to a canonical format for security information;

means, recorded on the recording medium, for transforming the security information in the canonical format using a predefined mapping from the first security domain to a second security domain;

means, recorded on the recording medium, for translating the transformed security information in the canonical format to a native format of the second security domain; and

means, recorded on the recording medium, for returning to the computer program product entity the security information in the native format of the second security domain.

20. The computer program product of claim 19 wherein means, recorded on the recording medium, for transforming the security information includes means, recorded on the recording medium, for structure transformation and value transformation, including means, recorded on the recording medium, for mapping a system entity'"'"'s identity in the first security domain to a another identity in the second security domain.

21. The computer program product of claim 19 wherein means, recorded on the recording medium, for receiving security information further comprises means, recorded on the recording medium, for receiving a request for security information for the second security domain, wherein the request encapsulates the security information in a native format of a first security domain.

22. The computer program product of claim 21 wherein the computer program product entity comprises a computer program product entity requesting access to a resource in the second security domain.

23. The computer program product of claim 21 wherein the computer program product entity comprises a computer program product entity providing access to a resource in the second security domain.

24. The computer program product of claim 19 wherein means, recorded on the recording medium, for translating the security information in a native format of a first security domain to a canonical format comprises a procedural software function.

25. The computer program product of claim 19 wherein means, recorded on the recording medium, for translating the security information in a native format of a first security domain to a canonical format comprises a mapping, expressed in XSL, from the native format of the first security domain to a canonical format.

26. The computer program product of claim 19 wherein the canonical format is expressed in XML and the predefined mapping from the first security domain to a second security domain is expressed in XSL.

27. The computer program product of claim 19 wherein means, recorded on the recording medium, for translating the transformed security information in the canonical format to a native format of the second security domain comprises a procedural software function.

28. The computer program product of claim 19 wherein the second native format is expressed in XML, the canonical format is expressed in XML, and means, recorded on the recording medium, for translating the transformed security information in the canonical format to a native format of the second security domain comprises a predefined mapping, expressed in XSL, from the canonical format to the native format of the second security domain.