Security for external system management

• US 20060168646A1
• Filed: 12/29/2004
• Published: 07/27/2006
• Est. Priority Date: 12/29/2004
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP AG (SAP SE)
• Inventors: Werner, Randolf
• Granted Patent: US 7,591,006 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

A system and method for enhanced security for external system management. A request to manage a system is received from a client at an interface. A determination is made whether a level of security is desired for the interface. If a level of security is desired for the interface, then identification information is obtained from the request and is converted into a format that is compatible with the system to be managed. A determination is made whether the system provides authorization for the client to manage the system.

Claims

1. A method comprising:

receiving a request to manage a system from a client at an interface;

determining if a level of security is desired for the interface;

if a level of security is desired for the interface, then;

obtaining identification information from the request;

converting the identification information into a format that is compatible with the system to be managed; and

determining whether the system provides authorization for the client to manage the system.

2. The method of claim 1, wherein the interface is a web service.

3. The method of claim 1, wherein determining if a level of security is desired comprises determining whether the request received from the client system includes a secure object.

4. The method of claim 3, wherein a secure object includes a UNIX domain socket or a Windows named pipe.

5. The method of claim 1, further comprising refusing access to the client through the interface if the system does not provide authorization for the client.

6. The method of claim 1, wherein determining whether the system provides authorization for the client to manage the system comprises comparing the converted identification to authorization data contained in the system to be managed.

7. The method of claim 1, wherein the request comprises a domain and user name for the client.

8. The method of claim 7, wherein converting the identification information comprises eliminating the domain from the identification information.

9. A method comprising:

registering a web service as an interface for a server;

receiving a request to manage an application on the server from an external client at the web service;

determining if enhanced security is desired for the web service;

if enhanced security is desired for the web service, then providing an enhanced security function, the enhanced security function including;

extracting identification information from the request;

converting the identification information into a format that is compatible with the application; and

searching the application for the identification information.

10. The method of claim 9, wherein determining if enhanced security is desired for the web service comprises determining whether the request received from the external client system includes a secure object.

11. The method of claim 9, further comprising refusing access to the external client through the interface if the search of the application does not provide a match for the identification information.

12. A server comprising:

a container comprising an application, the application including authorization data concerning users who are authorized to access the application; and

an interface, the interface to be connected to a client system for management of the application, the interface to include an enhanced security function, the enhanced security function to extract identity information from a communication from a client system and determine whether the client system has authority to manage the application.

13. The server of claim 12, wherein the interface comprises a web service.

14. The server of claim 12, wherein the application comprises authorization data, and wherein the enhanced security function is to search the authorization data for the extracted identity information.

15. The server of claim 12, wherein the enhanced security function is to convert the identification information into a format that is compatible with the application.

16. The server of claim 12, wherein the enhanced security function is active when the interface determines that a communication from a client is not secure.

17. The server of claim 16, wherein the interface determines that a communication is secure if the communication includes a secure object.

18. A system comprising:

a client system, the client system to provide a request to manage a computer application, the request to include identification information regarding the client system; and

a server, the server including the computer application and an interface, the client system to be coupled with the interface, the computer application including data regarding access credentials;

the interface to remove identification information from the request and convert the identification information into a format compatible with the computer application, the interface to compare the converted identification information with the data regarding access credentials to determine whether the client system is authorized to access the computer application.

19. The system of claim 18, wherein the request comprises an account and domain name, and wherein the interface removes the domain name and provides the account to the computer application.

20. The system of claim 18, wherein the interface comprises a web service.

21. The system of claim 20, wherein the server includes a registry, the web service being registered with the registry.

22. The system of claim 21, wherein the registry comprises a UDDI (universal description, discovery, and integration) registry.

23. The system of claim 18, wherein the interface will refuse access to the client system through the interface if the interface is unable to establish that the client system is authorized to access the computer application.

24. A machine-readable medium having stored thereon data representing sequences of instructions that, when executed by a processor, cause the processor to perform operations comprising:

receiving a request to manage a system from a client at an interface;

determining if a level of security is desired for the interface;

if a level of security is desired for the interface, then;

obtaining identification information from the request;

converting the identification information to a format that is compatible with the system to be managed; and

determining whether the system provides authorization for the client to manage the system.

25. The medium of claim 24, wherein the interface is a web service.

26. The medium of claim 24, wherein determining if a level of security is desired comprises determining whether the request received from the client system includes a secure object.

27. The method of claim 26, wherein a secure object includes a UNIX domain socket or a Windows named pipe.

28. The medium of claim 24, further comprising instructions that, when executed by the processor, cause the processor to perform operations comprising refusing access to the client through the interface if the system does not include authorization for the client.

29. The medium of claim 24, wherein determining whether comprises comparing the converted identification to authorization data contained in the system to be managed.

30. The medium of claim 24, wherein the request comprises a domain and user name for the client.

31. The medium of claim 30, wherein converting the identification information comprises eliminating the domain from the identification information.