VIRTUALIZED DATA STORAGE AND MANAGEMENT OF POLICY AND CREDENTIAL DATA SOURCES

• US 20170289135A1
• Filed: 06/15/2017
• Published: 10/05/2017
• Est. Priority Date: 09/20/2013
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Uchil, Mrudul, Jain, Swati
• Granted Patent: US 10,116,643 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Web-based single sign-on can enable a user to log in to a single interface (such as through a web browser or thin client) and then provide SSO services to the user for one or more web applications. The web-based SSO system can be extended to support one or more different access control methods, such as form-fill, Federated (OIF), SSO Protected (OAM), and other policies. The web-based SSO system can include a user interface through which the user can access different web applications, systems, etc. and manage their credentials. Each SSO service can be associated with a web interface allowing the SSO services to be accessed over the web. The web interfaces can provide CRUD (create, read, update, delete) functionality for each SSO service. To support different access policy types, the web-based SSO system can include an extensible data manager that can manage data access to different types of repositories transparently.

Claims

1. A method comprising:

receiving, at a computer system, using an interface for accessing a plurality of storage systems, a data request for credential information from a single sign-on service of one or more single sign-on services, wherein the credential information is stored at one of the plurality of storage systems, and wherein the data request includes one or more criteria for obtaining the credential information from the single sign-on service;

identifying, using one or more credential criteria identified in the data request based on the one or more criteria, a storage system associated with the data request, wherein the one or more credential criteria are generated for the credential information;

selecting, from a plurality of plug-ins, a plug-in corresponding to the identified storage system, wherein the plug-in is selected based on a type of storage system, and wherein the plug-in converts the data request according to the type of storage system; and

sending, to the single sign-on service for which the data request is received, data associated with the data request, the data being obtained from the identified storage system.

2. The method of claim 1, wherein the interface is a first interface, wherein the data request is received through the first interface, and wherein the method further comprises:

based on the selected plug-in converting the data request, sending, using a second interface, to the identified storage system, the converted data request to obtain the data associated with the data request from the identified storage system, wherein the converted data request includes one or more operations to retrieve the data at the identified storage system.

3. The method of claim 2, wherein obtaining the data from the identified storage system includes receiving a response from the identified storage system through the second interface, wherein the response includes a credential;

and wherein the method further includes;

encrypting at least a portion of the credential information;

reformatting the response based on the first interface; and

sending, using the first interface, the reformatted response.

4. The method of claim 1, further comprising:

receiving, from a device, a new plug-in associated with a new storage system; and

adding the new plug-in to a service provider interface.

5. The method of claim 1, wherein the identified storage system is a first storage system, wherein the data request is a first data request, wherein the selected plug-in is a first plug-in, and wherein the method further comprises:

receiving a second data request, at the computer system, for a policy associated with an application;

identifying a second storage system associated with the second data request;

selecting, from the plurality of plug-ins, a second plug-in corresponding to the second identified storage system; and

retrieving one or more policies associated with the application from the second identified storage system using the second selected plug-in corresponding to the second identified storage system.

6. The method of claim 5, wherein the interface is a first interface, wherein the second data request is received through the first interface, and wherein the method further comprises:

based on the selected second plug-in converting the data request, sending, using a second interface, to the second identified storage system, the second converted data request to obtain at least one policy responsive to the second data request from the second identified storage system, wherein the second converted data request includes one or more operations to obtain the at least one policy at the second identified storage system.

7. The method of claim 6, further comprising:

receiving, using the second interface, a response from the second identified storage system, wherein the response includes the policy; and

reformatting the response based on the first interface; and

sending, using the first interface, the reformatted response.

8. The method of claim 1, wherein the one or more credential criteria includes a credential identifier, a credential type, or both.

9. A non-transitory computer-readable medium storing one or more instructions that upon execution by one or more processors, cause the one or more processors to:

receive using an interface for accessing a plurality of storage systems, a data request for credential information from a single sign-on service of one or more single sign-on services, wherein the credential information is stored at one of the plurality of storage systems, and wherein the data request includes one or more criteria for obtaining the credential information from the single sign-on service;

identify, using one or more credential criteria identified in the data request based on the one or more criteria, a storage system associated with the data request, wherein the one or more credential criteria are generated for the credential information;

select, from a plurality of plug-ins, a plug-in corresponding to the identified storage system, wherein the plug-in is selected based on a type of storage system, and wherein the plug-in converts the data request according to the type of storage system; and

send, to the single sign-on service for which the data request is received, data associated with the data request, the data being obtained from the identified storage system.

10. The non-transitory computer-readable medium of claim 9, wherein the interface is a first interface, wherein the data request is received through the first interface, and wherein the one or more instructions, upon execution by the one or more processors, further cause the one or more processors to:

based on the selected plug-in converting the data request, send, using a second interface, to the identified storage system, the converted data request to obtain the data associated with the data request from the identified storage system, wherein the converted data request includes one or more operations to retrieve the data at the identified storage system.

11. The non-transitory computer-readable medium of claim 10:

wherein obtaining the data from the identified storage system includes receiving a response from the identified storage system through the second interface, wherein the response includes a credential; and

wherein the one or more instructions, upon execution by the one or more processors, further cause the one or more processors to;

encrypt at least a portion of the credential;

reformat the response based on the first interface; and

send, using the first interface, the reformatted response.

12. The non-transitory computer-readable medium of claim 9, wherein the one or more instructions, upon execution by the one or more processors, further cause the one or more processors to:

receive, from a device, a new plug-in associated with a new storage system; and

add the new plug-in to a service provider interface.

13. The non-transitory computer-readable medium of claim 9, wherein the identified storage system is a first storage system, wherein the data request is a first data request, wherein selected plug-in is a first plug-in, and wherein the one or more instructions, upon execution by the one or more processors, further cause the one or more processors to:

receive a second data request for a policy associated with an application;

identify a second storage system associated with the second data request;

select, from the plurality of plug-ins, a second plug-in corresponding to the second identified storage system; and

retrieve one or more policies associated with the application from the second identified storage system using the second selected plug-in corresponding to the second identified storage system.

14. The non-transitory computer-readable medium of claim 13, wherein the interface is a first interface, wherein the second data request is received through the first interface, and wherein the one or more instructions, upon execution by the one or more processors, further cause the one or more processors to:

based on the selected second plug-in converting the data request, send, using a second interface, to the second identified storage system, the second converted data request to obtain at least one policy responsive to the second data request from the second identified storage system, wherein the second converted data request includes one or more operations to obtain the at least one policy at the second identified storage system.

15. The non-transitory computer-readable medium of claim 14, wherein the one or more instructions, upon execution by the one or more processors, further cause the one or more processors to:

receive, using the second interface, a response from the second identified storage system, wherein the response includes the policy; and

reformat the response based on the first interface; and

send, using the first interface, the reformatted response.

16. The non-transitory computer-readable medium of claim 9, wherein the one or more credential criteria includes a credential identifier, a credential type, or both.

17. A system comprising:

one or more processors; and

a memory accessible to the one or more processors, the memory storing one or more instructions that, upon execution by the one or more processors, causes the one or more processors to;

receive using an interface for accessing a plurality of storage systems, a data request for credential information from a single sign-on service of one or more single sign-on services, wherein the credential information is stored at one of the plurality of storage systems, and wherein the data request includes one or more criteria for obtaining the credential information from the single sign-on service;

identify, using one or more credential criteria identified in the data request based on the one or more criteria, a storage system associated with the data request, wherein the one or more credential criteria are generated for the credential information;

select, from a plurality of plug-ins, a plug-in corresponding to the identified storage system, wherein the plug-in is selected based on a type of storage system, and wherein the plug-in converts the data request according to the type of storage system; and

send, to the single sign-on service for which the data request is received, data associated with the data request, the data being obtained from the identified storage system.

18. The system of claim 17, wherein the interface is a first interface, wherein the data request is received through the first interface, and wherein the one or more instructions, upon execution by the one or more processors, further cause the one or more processors to:

based on the selected plug-in converting the data request, send, using a second interface, to the identified storage system, the converted data request to obtain the data associated with the data request from the identified storage system, wherein the converted data request includes one or more operations to retrieve the data at the identified storage system.

19. The system of claim 18:

wherein obtaining the data from the identified storage system includes receiving a response from the identified storage system through the second interface, wherein the response includes a credential; and

wherein the one or more instructions, upon execution by the one or more processors, further cause the one or more processors to;

encrypt at least a portion of the credential;

reformat the response based on the first interface; and

send, using the first interface, the reformatted response.

20. The system of claim 17, wherein the one or more credential criteria includes a credential identifier, a credential type, or both.