Write-access control system

• US 20060004803A1
• Filed: 05/20/2004
• Published: 01/05/2006
• Est. Priority Date: 05/20/2004
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Aschen, Sean E., Doran, James R., Olore, Brian P., Quintero, Christine L.
• Granted Patent: US 7,530,111 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: H04L 61/4523 using lightweight directory access protocol [LDAP]
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/61 taking into account QoS or priority requirements
• CPC Class Codes: Y10S 707/99931 Database or file accessing

Abstract

A method and system is provided so that requests to a first application (e.g., an LDAP directory) are routed to a second application, the second application being trusted by the first application. The second application validates the requests and sends the request to the first software application when the first application is available. Requests may be queued for processing until the first application is available so that the requests remain pending. A reply may be sent to the requester indicating the results of the request. The second software application processes authentication and validation of the request thereby relieving the first application of this function. Since the second application is a trusted application, the request to the first application may be applied with improved efficiencies increasing the overall performance of the first software application.

Claims

1. A method of processing requests, the method comprising:

routing at least one request for access to a first software application to a second software application, wherein the second application is trusted by the first software application;

validating the at least one request using the second software application; and

sending the at least one request to the first software application in response to the at least one request being successfully validated by the validating step,

wherein the validating using the second software application reduces a processing overhead of the first software application.

2. The method of claim 1, further comprising queuing the at least one request until the first software application is available.

3. The method of claim 2, further comprising de-queuing the at least one request by the second application when the first software application is available.

4. The method of claim 3, further comprising decrypting the at least one request.

5. The method of claim 1, further comprising the step of queuing a reply for subsequent delivery.

6. The method of claim 5, wherein the reply is sent to an initial requestor of the request and the reply indicates either successful or non-successful processing of the request.

7. The method of claim 6, wherein the reply is a notice to another software application advising the another application of at least one of the request and the effect of the request.

8. The method of claim 1, wherein the first software application is a lightweight directory access protocol (LDAP) directory.

9. The method of claim 1, wherein the second software application is a lightweight directory access protocol (LDAP) proxy.

10. The method of claim 1, wherein the sending step includes accessing and updating the first software application using a root-id and a password for any data being updated to reduce overall processing demands on the first software application.

11. The method of claim 1, further comprising sending the at least one request to an application proxy, the application proxy providing identification and change information to the second software application on behalf of the requestor.

12. A method for reducing processing demands, the method comprising:

queueing at least one request for a first software application at a second software application in response to the first software application being unavailable, wherein the second software application is trusted by the first software application;

validating the at least one request using the second software application; and

sending the at least one request from the second software application to the first software application in response to the first application resuming availability and the at least one request being successfully validated by the validating,

wherein the validating step reduces a processing overhead of the first software application.

13. The method of claim 12, further comprising de-queuing the at least one request by the second software application when the first software application is available.

14. The method of claim 13, further comprising decrypting the at least one request.

15. The method of claim 14, wherein the queuing and de-queuing provides an asynchronous communication mechanism and maintains the request pending when the first software application is unavailable.

16. The method of claim 12, further comprising the steps of queuing a reply for subsequent delivery.

17. The method of claim 16, wherein the reply is sent to an initial requester of the request and indicates either successful or non-successful processing of the request.

18. The method of claim 12, wherein the first software application is a lightweight directory access protocol (LDAP) directory and the second software application is a lightweight directory access protocol (LDAP) proxy.

19. The method of claim 12, wherein the sending step includes accessing and updating the first software application using a root-id and a password to update data associated with an initial requester of the request.

20. The method of claim 12, further comprising sending a request to an application proxy, the application proxy providing identification and change information to the second software application on behalf of the requestor.

21. A computer program product comprising a computer usable medium having readable program code embodied in the medium, the computer program product includes at least one component to:

route at least one request for access to a first software application to a second software application, wherein the second software application is trusted by the first software application;

validate the at least one request using the second software application; and

send the at least one request to the first software application in response to the at least one request being successfully validated by the validating.

22. The method of claim 21, wherein the at least one component queues the at least one request until the first software application is available.

23. The method of claim 22, wherein the at least one component de-queues the at least one request by the second software application when the first software application is available.

24. The method of claim 23, wherein the at least one component decrypts the at least one request.

25. The method of claim 21, wherein the at least one component queues a reply for subsequent delivery.

26. The method of claim 25, wherein the reply is sent to an initial requestor of the request indicates either successful or non-successful processing of the request.

27. The method of claim 26, wherein the reply is a notice to another software application for providing information concerning the processing of the request by the first software application.

28. The method of claim 21, wherein the first software application is a lightweight directory access protocol (LDAP) directory and the second software application is a lightweight directory access protocol (LDAP) proxy.

29. The method of claim 21, wherein the at least one component accesses and updates the first software application using a root-id and a password for any data being updated, reducing processing demands on the first software application.

30. The method of claim 21, wherein the at least one component sends a request to an application proxy, the application proxy providing identification and change information to the second software application on behalf of the requestor.