System and method for maintaining security in a distributed computer network

• US 6,158,010 A
• Filed: 02/12/1999
• Issued: 12/05/2000
• Est. Priority Date: 10/28/1998
• Status: Expired due to Term

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: CrossLogix, Inc. (Oracle Corporation)
• Inventors: Moriconi, Mark, Qian, Shelly
• Primary Examiner(s): Lee, Thomas C.
• Assistant Examiner(s): Mai, Rijue
• Application Number:
  US09/248,788
• Time in Patent Office: 662 Days
• Field of Search: 713/200, 713/201, 713/202, 709/223, 709/224, 709/225, 709/229, 710/39, 710/40
• US Class Current: 726/1
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

A system and method for maintaining security in a distributed computing environment comprises a policy manager located on a server for managing and distributing a security policy, and an application guard located on a client for managing access to securable components as specified by the security policy. In the preferred embodiment, a global policy specifies access privileges of the user to securable components. The policy manager may then preferably distribute a local client policy based on the global policy to the client. An application guard located on the client then manages access to the securable components as specified by the local policy.

Claims

1. A system for maintaining security in a distributed computing environment, comprising:

a policy manager for managing a security policy; and

an application guard for managing access to securable components as specified by the security policy, said securable components being selected from the group consisting of at least one application, a function within an application, a procedure within an application, a data structure within an application, a database object referenced by an application, or a file system object referenced by an application.

2. The system of claim 1, wherein said policy manager comprises a management station for constructing and editing the security policy.

3. The system of claim 2, wherein said policy manager further comprises a distributor for distributing the security policy to a client.

4. The system of claim 2, wherein said policy manager further comprises a distributor for distributing a customized local policy based on the security policy to a client.

5. The system of claim 4, wherein said policy manager further comprises a logger for recording and tracking authorization events that occur through the application guard.

6. The system of claim 4, wherein the policy manager further comprises a database management system for maintaining the security policy.

7. The system of claim 4, wherein the customized local policy is optimized.

8. The system of claim 1, wherein said system is scalable by further comprising a plurality of clients, said policy manager further managing and distributing a customized local policy to each client, and at least one additional application guard located on each client for managing access to the securable components as specified by each customized local policy.

9. The system of claim 1, wherein said application guard includes an application guard interface coupled to an application for requesting access to the securable components, and at least one authorization engine for evaluating requests from the application guard interface as specified by a customized local policy based on the security policy.

10. The system of claim 9, wherein said application guard interface is located on a client, and said at least one authorization engine and said customized local policy are located on a client server.

11. The system of claim 1, wherein the security policy is defined by a policy language to grant or deny access to the securable components for a particular user.

12. The system of claim 1 further comprising a policy loader for bulk loading the security policy onto the system.

13. The system of claim 1, wherein said policy manager includes a set of menu options to manage and distribute the security policy.

14. The system of claim 13, wherein said set of menu options include:

navigate tree, analyze policy, edit policy, distribute policy, and view audit log.

15. The system of claim 1, wherein the application guard further allows for additional customized code to process and evaluate authorization requests based on the additional customized code.

16. The system of claim 1, wherein the policy manager further includes a policy manager application guard for managing access to the policy manager as specified by a local administrative policy.

17. A system for controlling user access in a distributed computing environment, comprising:

a global policy specifying access privileges of the user to securable components;

a policy manager located on a server for managing and distributing a local client policy based on the global policy to a client, and

an application guard located on the client for managing access to the securable components as specified by the local client policy, said securable components being selected from the group consisting of at least one application, a function within an application, a procedure within an application, a data structure within an application, a database object referenced by an application, or a file system object referenced by an application.

18. The system of claim 17 further comprising at least one additional client, said policy manager further managing and distributing a customized local policy based on the global policy to each additional client, and at least one additional application guard located on each additional client for managing access to the securable components as specified by the customized local policy.

19. The system of claim 17, wherein said policy manager comprises:

a management station for constructing and editing the global policy; and

a distributor for distributing the local policy to the client.

20. The system of claim 19, wherein said policy manager further comprises a database management system for maintaining the global policy.

21. The system of claim 17, wherein said policy manager further comprises a logger for recording and tracking authorization events that occur through the application guard.

22. The system of claim 17, wherein the global policy is defined by a policy language to grant or deny access to the securable components for a particular user.

23. The system of claim 17, wherein said system is scalable by further comprising a plurality of clients, said policy manager further managing and distributing a customized local policy to each client, and at least one additional application guard located on each client for managing access to the securable components as specified by each customized local policy.

24. The system of claim 17, wherein said application guard includes an application guard interface coupled to an application for requesting access to the securable components, and at least one authorization engine for evaluating requests from the application guard interface as specified by the local client policy.

25. The system of claim 17 further comprising a policy bulk loader for bulk loading the global policy onto the system.

26. The system of claim 17, wherein the local client policy is optimized.

27. The system of claim 17, wherein the application guard further allows for additional customized code to process and evaluate authorization requests based on the additional customized code.

28. The system of claim 17, wherein the policy manager further includes a policy manager application guard for managing access to the policy manager as specified by a local administrative policy.

29. A system for authorization that provides access to securable components for a user, comprising:

a policy specifying access privileges of the user to the securable components;

an application guard that allows for additional customized code to process and evaluate authorization requests based on the additional customized code; and

a processor coupled to said system, said processor executing said application guard to manage access to the securable components.

30. The system of claim 29 further including an audit log for recording and tracking each authorization event that occurs though the application guard.

31. The system of claim 29, wherein said securable components are selected from the group consisting of:

at least one application, a function within an application, a procedure within an application, a data structure within an application, a database object referenced by an application, or a file system object referenced by an application.

32. The system of claim 29, wherein said application guard comprises an application guard interface connected to an application for managing access to the securable components in said application.

33. The system of claim 29, wherein said application guard includes an application guard interface coupled to an application for requesting access to the securable components, and at least one authorization engine for evaluating requests from the application guard interface as specified by a customized local policy based on the policy.

34. The system of claim 33, wherein said application guard interface is located on a client, and said at least one authorization engine and said customized local policy are located on a client server.

35. A system for managing security in a distributed computing environment, comprising:

a policy manager specifying access priveleges to securable components selected from the group consisting of at least one application, a function within an application, a procedure within an application, a data structure within an application, a database object referenced by an application, or a file system object referenced by an application; and

a processor coupled to said system, said processor executing said policy manager to manage and distribute a customized local policy based on a global policy to a client.

36. The system of claim 35, wherein said policy manager comprises a management station for constructing and editing the global policy.

37. The system of claim 36, wherein said policy manager further comprises a distributor for distributing the customized local policy to the client.

38. The system of claim 35, wherein said policy manager further comprises a logger for recording and tracking authorization events that are received from the client.

39. The system of claim 35, wherein said global policy specifies access privileges of at least one user to securable components.

40. The system of claim 35, wherein the policy manager comprises a database management system for maintaining the global policy.

41. The system of claim 35, wherein the global policy is defined by a policy language to grant or deny access to securable components for a particular user.

42. The system of claim 35, wherein said policy manager includes a set of menu options to manage and distribute the customized local policy.

43. The system of claim 35, wherein the customized local policy is optimized.

44. The system of claim 35, wherein the policy manager further includes a policy manager application guard for managing access to the policy manager as specified by a local administrative policy.

45. A method for maintaining security in a distributed computing environment, comprising the steps of:

managing a policy using a policy manager by specifying access privileges of a user to securable components selected from the group consisting of at least one application, a function within an application, a procedure within an application, a data structure within an application, a database object referenced by an application, or a file system object referenced by an application; and

distributing the policy to a client having an application guard, whereby the application guard manages access to the securable components as specified by the policy.

46. The method of claim 45, further including the step of recording authorization events that occur through the application guard after distributing the policy.

47. A method for maintaining security on a client in a distributed computing environment, comprising the steps of:

constructing and issuing an authorization request for a user to access to securable components located on the client using an application guard, said securable components being selected from the group consisting of at least one application, a function within an application, a procedure within an application, a data structure within an application, a database object referenced by an application, or a file system object referenced by an application;

evaluating the authorization request using the application guard to determine if the authorization request is valid or invalid; and

allowing access to the user via the application guard if the evaluated authorization request was valid, and denying access to the user via the application guard if the authorization request was invalid.

48. The method of claim 47, after evaluating the authorization request, further including the step of recording the authorization request in an audit log.

49. A computer-readable medium comprising program instructions for maintaining security in a distributed computing environment by performing the steps of:

managing a policy using a policy manager by specifying access privileges of a user to securable components selected from the group consisting of at least one application, a function within an application, a procedure within an application, a data structure within an application, a database object referenced by an application, or a file system object referenced by an application;

distributing the policy using the policy manager to a client having an application guard, whereby the application guard manages access to the securable components as specified by the policy; and

executing said policy manager with a processor to manage and distribute the policy.

50. A computer-readable medium comprising program instructions for maintaining security on a client in a distributed computing environment by performing the steps of:

constructing and issuing an authorization request for a user to access to securable components located on the client using an application guard, said securable components being selected from the group consisting of at least one application, a function within an application, a procedure within an application, a data structure within an application, a database object referenced by an application, or a file system object referenced by an application;

evaluating the authorization request using the application guard to determine if the authorization request is valid or invalid;

allowing access to the user via the application guard if the evaluated authorization request was valid, and denying access to the user via the application guard if the authorization request was invalid; and

executing said application guard with a processor to automatically maintain security on the client.

51. A system for maintaining security in a distributed computing environment, comprising:

means for managing a policy using a policy manager by specifying access privileges of a user to securable components selected from the group consisting of at least one application, a function within an application, a procedure within an application, a data structure within an application, a database object referenced by an application, or a file system object referenced by an application;

means for distributing the policy using the policy manager to a client having an application guard, whereby the application guard manages access to the securable components as specified by the policy; and

means for executing the policy manager to manage and distribute the policy.

52. A system for maintaining security on a client in a distributed computing environment, comprising:

means for constructing and issuing an authorization request for a user to access to securable components located on the client using an application guard, said securable components being selected from the group consisting of at least one application, a function within an application, a procedure within an application, a data structure within an application, a database object referenced by an application, or a file system object referenced by an application;

means for evaluating the authorization request using the application guard to determine if the authorization request is valid or invalid;

means for allowing access to the user via the application guard if the evaluated authorization request was valid, and denying access to the user via the application guard if the authorization request was invalid; and

means for executing said application guard to automatically maintain security on the client.