Method and apparatus to discover services and negotiate capabilities

• US 6,970,869 B1
• Filed: 08/31/2000
• Issued: 11/29/2005
• Est. Priority Date: 05/09/2000
• Status: Active Grant

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Slaughter, Gregory L., Abdelaziz, Mohamed M., Saulpaugh, Thomas E., Traversat, Bernard A.
• Primary Examiner(s): EL HADY, NABIL M
• Application Number:
  US09/653,451
• Time in Patent Office: 1,916 Days
• Field of Search: 709/201, 709/203, 709/218, 709/217, 709/219, 719/311, 719/315, 719/313, 707/10, 707/102
• US Class Current: 1/1
• CPC Class Codes: G06F 2209/5015 Service provider selection
• CPC Class Codes: G06F 9/5055 considering software capabilities, i.e. software resources associated or available to the machine
• CPC Class Codes: Y10S 707/99943 Generating database or data structure, e.g. via user interface

Abstract

A service discovery protocol may allow clients in a distributed computing environment to search for services. Service providers (or a listener agent) may respond to search requests by publishing or providing corresponding service advertisements or URIs to corresponding service advertisements. When a service provider responds to a discovery search request (either directly or through a listener agent), the provider may choose to publish a protected or an un-protected (complete) advertisement. A protected advertisement may include the set of information necessary to obtain a complete advertisement. Publishing a protected advertisement may force the client to obtain a valid credential from an authentication service before receiving the complete un-protected advertisement from the service provider. A complete un-protected advertisement is needed to create a message endpoint for accessing the service. Forcing clients to obtain a valid credential before receiving an advertisement may provide an additional level of security for the service provider. The security credential that may need to be obtained to receive the complete advertisement may also be used to construct a message gate to communicate with the service where the gate embeds the security credential in each message to the service.

Claims

1. A method for accessing a service in a distributed computing environment, comprising:

a client locating a first service within the distributed computing environment;

the client requesting a capability credential to allow the client access to a portion of the first service'"'"'s capabilities depending upon the clients authorization;

the client receiving said capability credential;

the client requesting a document that describes the first service'"'"'s interface to access said portion of the first service'"'"'s capabilities;

the client receiving said document, wherein said document comprises information describing how to access no more than said portion of the first service'"'"'s capabilities; and

the client using the information from said document to access the first service.

2. The method as recited in claim 1, wherein the client locating a first service comprises the client sending a search message, wherein the search message comprises search criteria indicating the name or type of the first service.

3. The method as recited in claim 1, wherein the client locating a first service comprises the client receiving a protected advertisement for the first service, wherein the protected advertisement comprises an address for requesting said capability credential and an address for requesting said document.

4. The method as recited in claim 1, further comprising:

the client receiving a protected advertisement for the first service, wherein the protected advertisement specifies an authentication service; and

wherein the client requesting a capability credential comprises the client sending a capability credential request message to the authentication service specified in said protected advertisement.

5. The method as recited in claim 4, wherein said capability credential request message comprises an indication of the portion of the first service'"'"'s capabilities desired to be accessed by the client.

6. The method as recited in claim 5, wherein said protected advertisement further comprises a description of said first service'"'"'s capabilities, and wherein said indication of the portion of the first service'"'"'s capabilities desired to be accessed by the client indicates an edited version of said protected advertisement description of said first service'"'"'s capabilities.

7. The method as recited in claim 4, wherein the client receiving said capability credential comprises the client receiving said capability credential from said authentication service, wherein said capability credential grants the client access to a portion of the first service'"'"'s capabilities depending upon the client'"'"'s authorization and the portion of the first service'"'"'s capabilities requested by the client.

8. The method as recited in claim 1, further comprising:

the client receiving a protected advertisement for the first service, wherein the protected advertisement specifies an advertisement request address; and

wherein the client requesting a document comprises the client sending an advertisement request message to the advertisement request address specified in the protected advertisement.

9. The method as recited in claim 8, wherein the advertisement request message includes said capability credential, the method further comprising the first service using said capability credential to authenticate the client and determine the capabilities which the client is authorized to access.

10. The method as recited in claim 1, wherein said document comprises a service advertisement for said first service, wherein said service advertisement comprises a schema specifying an interface to a portion of the first service'"'"'s capabilities corresponding to said capability credential.

11. The method as recited in claim 10, wherein said schema is an eXtensible Markup Language (XML) schema defining XML messages for the client to send to the first service and the first service to send to the client in order for the client to access capabilities of the first service.

12. The method as recited in claim 11, wherein the client using the information from said document comprises the client sending one or more of said XML messages to the first service.

13. The method as recited in claim 12, wherein each said one or more of said XML messages is sent to said first service with said capability credential, the method further comprising the first service using said capability credential sent with each message to authenticate the client.

14. A client device, comprising:

a connection to a distributed computing environment;

an interface coupled to said connection and configured to locate a first service within the distributed computing environment;

wherein said interface is further configured to request over said connection a capability credential to allow access to a portion of the first service'"'"'s capabilities depending upon the clients authorization;

wherein said interface is further configured to receive over said connection said capability credential;

wherein said interface is further configured to request over said, connection a document that describes the first service'"'"'s interface to access said portion of the first service'"'"'s capabilities;

wherein said interface is further configured to receive over said connection said document, wherein said document comprises information describing how to access no more than said portion of the first service'"'"'s capabilities; and

wherein the interface is further configured to use the information from said document to provide a mechanism fro the client device to access the first service.

15. The client device as recited in claim 14, wherein the interface is configured to locate the first service by sending a search message over said connection, wherein the search message comprises search criteria indicating the name or type of the first service.

16. The client device as recited in claim 14, wherein the interface is configured to locate the first service by receiving over said connection a protected advertisement for the first service, wherein the protected advertisement comprises an address for requesting said capability credential and an address for requesting said document.

17. The client device as recited in claim 14, wherein the interface is further configured to receive a protected advertisement for the first service, wherein the protected advertisement specifies an authentication service;

and wherein the interface is configured to request a capability credential by sending a capability credential request message to the authentication service specified in said protected advertisement.

18. The client device as recited in claim 17, wherein said capability credential request message comprises an indication of the portion of the first service'"'"'s capabilities desired to be accessed by the client device.

19. The client device as recited in claim 18, wherein said protected advertisement further comprises;

a description of said first service'"'"'s capabilities, and wherein said indication of the portion of the first service'"'"'s capabilities desired to be accessed by the client device indicates an edited version of said protected advertisement description of said first service'"'"'s capabilities.

20. The client device as recited in claim 17, wherein the interface is configured to receive said capability credential from said authentication service, wherein said capability credential grants the client device access to a portion of the first service'"'"'s capabilities depending upon the client device'"'"'s authorization and the portion of the first service'"'"'s capabilities requested by the client device.

21. The client device as recited in claim 14, wherein the interface is configured to receive a protected advertisement for the first service, wherein the protected advertisement specifies an advertisement request address;

and wherein the interface is configured to request a document by sending an advertisement request message to the advertisement request address specified in the protected advertisement.

22. The client device as recited in claim 21, wherein the advertisement request message includes said capability credential so that the first service may use said capability credential to authenticate the client device and determine the capabilities which the client device is authorized to access.

23. The client device as recited in claim 14, wherein said document comprises a service advertisement for said first service, wherein said service advertisement comprises a schema specifying an interface to a portion of the first service'"'"'s capabilities corresponding to said capability credential.

24. The client device as recited in claim 23, wherein said schema is an eXtensible Markup Language (XML) schema defining XML messages for the client device to send to the first service and the first service to send to the client in order for the client device to access capabilities of the first service.

25. The client device as recited in claim 24, wherein the client is configured to use the information from said document for sending one or more of said XML messages to the first service.

26. The client device as recited in claim 25, wherein the interface is configured so that each said one or more of said XML messages is sent to said first service with said capability credential so that the first service may use said capability credential sent with each message to authenticate the client device.

27. The client device as recited in claim 14, wherein said interface comprises one or more processes executable on a processor within the client device.

28. A carrier medium comprising program instructions, wherein the program instructions are computer-executable on a client device to implement:

locating a first service within the distributed computing environment;

requesting a capability credential to allow a client on the client device access to a portion of the first service'"'"'s capabilities depending upon the clients authorization;

receiving said capability credential;

requesting a document that describes the first service'"'"'s interface to access said portion of the first service'"'"'s capabilities;

receiving said document, wherein said document comprises information describing how to access no more than said portion of the first service'"'"'s capabilities; and

using the information from said document to access the first service.

29. The carrier medium as recited in claim 28, wherein locating a first service comprises sending a search message, wherein the search message comprises search criteria indicating the name or type of the first service.

30. The carrier medium as recited in claim 28, wherein locating a first service comprises receiving a protected advertisement for the first service, wherein the protected advertisement comprises an address for requesting said capability credential and an address for requesting said document.

31. The carrier medium as recited in claim 28, wherein the program instructions are computer-executable on the client device to further implement:

receiving a protected advertisement for the first service, wherein the protected advertisement specifies an authentication service; and

wherein requesting a capability credential comprises sending a capability credential request message to the authentication service specified in said protected advertisement.

32. The carrier medium as recited in claim 31, wherein said capability credential request message comprises an indication of the portion of the first service'"'"'s capabilities desired to be accessed by the client.

33. The carrier medium as recited in claim 32, wherein said protected advertisement further comprises a description of said first service'"'"'s capabilities, and wherein said indication of the portion of the first service'"'"'s capabilities desired to be accessed by the client indicates an edited version of said protected advertisement description of said first service'"'"'s capabilities.

34. The carrier medium as recited in claim 31, wherein receiving said capability credential comprises receiving said capability credential from said authentication service, wherein said capability credential grants the client access to a portion of the first service'"'"'s capabilities depending upon the client'"'"'s authorization and the portion of the first service'"'"'s capabilities requested by the client.

35. The carrier medium as recited in claim 28, wherein the program instructions are computer-executable on the client device to further implement:

receiving a protected advertisement for the first service, wherein the protected advertisement specifies an advertisement request address; and

wherein requesting a document comprises sending an advertisement request message to the advertisement request address specified in the protected advertisement.

36. The carrier medium as recited in claim 35, wherein the advertisement request message includes said capability credential so that the first service may use said capability credential to authenticate the client and determine the capabilities which the client is authorized to access.

37. The carrier medium as recited in claim 28, wherein said document comprises a service advertisement for said first service, wherein said service advertisement comprises a schema specifying an interface to a portion of the first service'"'"'s capabilities corresponding to said capability credential.

38. The carrier medium as recited in claim 37, wherein said schema is an eXtensible Markup Language (XML) schema defining XML messages for the client to send to the first service and the first service to send to the client in order for the client to access capabilities of the first service.

39. The carrier medium as recited in claim 38, wherein using the information from said document comprises sending one or more of said XML messages to the first service.

40. The carrier medium as recited in claim 39, wherein each said one or more of said XML messages is sent to said first service with said capability credential so that the first service may use said capability credential sent with each message to authenticate the client.