Query Interface to Policy Server

• US 20080172366A1
• Filed: 10/29/2007
• Published: 07/17/2008
• Est. Priority Date: 06/29/1998
• Status: Active Grant

• Current Assignee: Quest Software, Inc.
• Original Assignee: SonicWALL, Inc. (SonicWall Holdings Ltd.)
• Inventors: Hannel, Clifford Lee, May, Anthony
• Granted Patent: US 7,912,856 B2
• Time in Patent Office: Days
• US Class Current: 707/3
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A scalable access filter that is used together with others like it in a virtual private network to control access by users at clients in the network to information resources provided by servers in the network. Each access filter use a local copy of an access control data base (3845) to determine whether an access request is made by a user. Each user belongs to one or more user groups and each information resource belongs to one or more information sets. Access is permitted or denied according to access policies which define access in terms of the user groups and information sets. The first access filter in the path performs the access check, encrypts and authenticates the request; the other access filters in the path do not repeat the access check. The interface used by applications to determine whether a user has access to an entity is now an SQL query. The policy server (3811) assembles the information needed for the response to the query from various information sources, including source external to the policy server.

Claims

1. Apparatus for providing information in response to a query where the query and the response thereto have define forms, the query being addressed to a database table having at least one row, each row having at least one named filed, the query including at least one field name to specify the information to be provided in the response and an indication of a manner of selecting a row containing the information from the database table, the apparatus comprising:

a virtual database service; and

an information service for the information to be provided which does not use the named field to identify the information to be provided, the virtual database service receiving the query, using the indication of the manner of selecting a row to obtain the information to be provided from the information source, and providing the information in the response, whereby the apparatus presents a virtual database table of the form addressed by the query to a source of the query.

2-14. -14. (canceled)