-
公开(公告)号：US07533265B2
公开(公告)日：2009-05-12
申请号：US10892046
申请日：2004-07-14
IPC分类号： G06F21/00
CPC分类号： H04L63/0428 , H04L63/08 , H04L63/20
摘要： The present invention provides for maintaining security context during a communication session between applications, without having to have executable code in either application for obtaining or generating a security context token (SCT) used to secure the communication. On a service side, a configuration file is provided that can be configured to indicate that automatic issuance of a SCT is enabled, thereby allowing a Web service engine to generate the SCT upon request. On the client side, when a message is sent from the client application to the service application, a policy engine accesses a policy that includes assertions indicating that a SCT is required for messages destined for the Web service application. As such, the policy engine requests and receives the SCT, which it uses to secure the message.
摘要翻译： 本发明提供在应用之间的通信会话期间维护安全上下文，而不必在任一应用中具有用于获得或生成用于保护通信的安全上下文令牌（SCT）的可执行代码。 在服务端，提供可配置为指示启用SCT的自动发布的配置文件，从而允许Web服务引擎根据请求生成SCT。 在客户端，当从客户端应用程序发送消息到服务应用程序时，策略引擎将访问包含断言的策略，该断言指示为发往Web服务应用程序的消息需要SCT。 因此，策略引擎请求并接收它用于保护消息的SCT。
-
2.发明授权Extendible security token management architecture and secure message handling methods 有权可扩展安全令牌管理架构和安全消息处理方法公开(公告)号：US07657932B2
公开(公告)日：2010-02-02
申请号：US10891926
申请日：2004-07-14
CPC分类号： H04L63/0823 , H04L63/104 , H04L63/126 , H04L67/02
摘要： A message handling computing system that provides security across even transport-independent communication mechanisms, and which allows for convenient extension of security to different security token types, and may provide end-to-end security across different transport protocols. The message handling computing system includes a message handling component configured to send and receive network messages having security tokens. The message handling component interfaces with an expandable and contractible set of security token managers through a standardized application program interface. Each security manager is capable of providing security services for messages that correspond to security tokens of a particular type. A security token plug-in component registers new security token managers with the message handling component.
摘要翻译： 一种消息处理计算系统，其提供跨传输独立通信机制的安全性，并且允许将安全性方便地扩展到不同的安全令牌类型，并且可以在不同的传输协议之间提供端到端的安全性。 消息处理计算系统包括被配置为发送和接收具有安全令牌的网络消息的消息处理组件。 消息处理组件通过标准化应用程序接口与可扩展和可收缩的安全令牌管理器集接口。 每个安全管理器能够为与特定类型的安全令牌相对应的消息提供安全服务。 安全令牌插件组件使用消息处理组件注册新的安全令牌管理器。
-
3.发明授权Role-based authorization of network services using diversified security tokens 有权基于角色的网络服务授权使用多样化的安全令牌公开(公告)号：US07434252B2
公开(公告)日：2008-10-07
申请号：US10891884
申请日：2004-07-14
CPC分类号： H04L63/0823 , G06F21/335 , H04L63/105
摘要： A mechanism for performing role-based authorization of the one or more services using security tokens associated with received service request messages. This role-based authentication is performed regardless of the type of security token associated with the received service request messages. Upon receiving a service request message over the network for a particular service offered by the service providing computing system, the service providing computing system accesses a security token associated with the received service request message. Then, the computing system identifies one or more roles that include the identity associated with the security token, and correlates the roles with the security token. These correlated roles are then used to authorize the requested service. This mechanism is performed regardless of the type of the security token.
摘要翻译： 用于使用与所接收的服务请求消息相关联的安全令牌来执行所述一个或多个服务的基于角色的授权的机制。 无论与接收到的服务请求消息相关联的安全令牌的类型如何，都会执行此基于角色的身份验证。 在由服务提供计算系统提供的特定服务通过网络接收到服务请求消息时，服务提供计算系统访问与所接收的服务请求消息相关联的安全令牌。 然后，计算系统识别包括与安全令牌相关联的身份的一个或多个角色，并且将角色与安全令牌相关联。 然后将这些相关角色用于授权所请求的服务。 无论安全令牌的类型如何，都会执行此机制。
-
公开(公告)号：US07665120B2
公开(公告)日：2010-02-16
申请号：US11055435
申请日：2005-02-10
CPC分类号： H04L41/5083 , H04L9/3213 , H04L9/3247 , H04L9/3263 , H04L41/0893 , H04L41/16 , H04L41/5003 , H04L63/168 , H04L63/20 , H04L2209/80
摘要： Example embodiments provide for a rule-based wizard type tool for generating secure policy documents. Wizard pages present a user with general Web Service security options or questions at a user interface, which abstracts the user from any specific code, e.g., XML code, used for creating a Web Service policy document. Based on user input selecting general criteria, security rules are accessed and evaluated for automatically making choices on behalf of the user for creating a secure policy document. Other embodiments also provide for presenting the user with an easily understandable visual representation of selected criteria of a policy document in, e.g., a tree like structure that shows relationships between various elements of the criteria.
摘要翻译： 示例性实施例提供用于生成安全策略文档的基于规则的向导类型工具。 向导页面向用户呈现在用户界面处的一般Web服务安全选项或问题，其将用户从用于创建Web服务策略文档的任何特定代码（例如，XML代码）抽象出来。 基于选择一般标准的用户输入，访问和评估安全规则以代表用户自动进行选择以创建安全策略文档。 其他实施例还提供向用户呈现在例如呈现标准的各个要素之间的关系的树状结构中的策略文档的选定标准的易于理解的视觉表示。
-
公开(公告)号：US08005901B2
公开(公告)日：2011-08-23
申请号：US10891946
申请日：2004-07-14
IPC分类号： G06F15/16
CPC分类号： H04L67/322 , H04L67/02
摘要： Within a distributed system, e.g., Web service environment, the present invention provides a way for identifying policies mapped to messages associated with an application, without having to have code within the application for determining what policies should apply to the messages. A centralized Web service engine is provided that receives incoming and outgoing messages associated with an application. The messages have associated with them destination endpoint identifiers and request-reply properties, which the Web service engine can access. The Web service engine can then use at least the identifiers and properties for scanning policy message files corresponding to the applications in order to identify what policies, if any, should be applied to the messages.
摘要翻译： 在分布式系统（例如，Web服务环境）内，本发明提供了一种用于识别映射到与应用相关联的消息的策略的方法，而不必在应用程序内具有用于确定哪些策略应用于消息的代码。 提供了一种集中式Web服务引擎，用于接收与应用程序相关联的传入和传出消息。 消息与它们相关联的目标端点标识符和请求回复属性，Web服务引擎可以访问它们。 因此，Web服务引擎至少可以使用标识符和属性来扫描与应用程序相对应的策略消息文件，以便确定哪些策略（如果有的话）应该应用于消息。
-
公开(公告)号：US07661124B2
公开(公告)日：2010-02-09
申请号：US10959886
申请日：2004-10-05
CPC分类号： H04L41/5083 , H04L9/3213 , H04L9/3247 , H04L9/3263 , H04L41/0893 , H04L41/16 , H04L41/5003 , H04L63/168 , H04L63/20 , H04L2209/80
摘要： Example embodiments provide for a rule-based wizard type tool for generating secure policy documents. Wizard pages present a user with general Web Service security options or questions at a user interface, which abstracts the user from any specific code, e.g., XML code, used for creating a Web Service policy document. Based on user input selecting general criteria, security rules are accessed and evaluated for automatically making choices on behalf of the user for creating a secure policy document. Other embodiments also provide for presenting the user with an easily understandable visual representation of selected criteria of a policy document in, e.g., a tree like structure that shows relationships between various elements of the criteria.
摘要翻译： 示例性实施例提供用于生成安全策略文档的基于规则的向导类型工具。 向导页面向用户呈现在用户界面处的一般Web服务安全选项或问题，其将用户从用于创建Web服务策略文档的任何特定代码（例如，XML代码）抽象出来。 基于选择一般标准的用户输入，访问和评估安全规则以代表用户自动进行选择以创建安全策略文档。 其他实施例还提供向用户呈现在例如呈现标准的各个要素之间的关系的树状结构中的策略文档的选定标准的易于理解的视觉表示。
-
公开(公告)号：US07730138B2
公开(公告)日：2010-06-01
申请号：US10892007
申请日：2004-07-14
IPC分类号： G06F15/16
CPC分类号： H04L67/16 , H04L67/28 , H04L67/2852
摘要： Example embodiments provide for processing policies that include policy assertions associated with incoming or outgoing messages of an application in a distributed system, without having to have code within the application for executing the policy assertions. When a message is received by a Web service engine, a policy document associated with an application may be accessed for identifying objects corresponding to policy assertions within the policy document. The objects identified can then be used to generate assertion handlers, which are software entities that include executable code configured to determine if messages can satisfy requirements described by the policy assertions.
摘要翻译： 示例性实施例提供了处理策略，其包括与分布式系统中的应用的传入或传出消息相关联的策略断言，而不必在应用程序内具有用于执行策略断言的代码。 当Web服务引擎接收到消息时，可以访问与应用相关联的策略文档，用于识别与策略文档内的策略断言相对应的对象。 所识别的对象然后可以用于生成断言处理程序，这些软件实体包括被配置为确定消息是否可以满足策略断言描述的要求的可执行代码的软件实体。
-
公开(公告)号：US07165118B2
公开(公告)日：2007-01-16
申请号：US10918907
申请日：2004-08-15
IPC分类号： G06F15/16
CPC分类号： H04L69/32
摘要： Methods, systems, and computer program products for processing network messages in a manner that simplifies messaging application logic. Processing layers of a messaging system architecture that may include a transport layer, a channel layer, a send/receive layer, a service/client layer, and potentially others, are aware of an End Point Reference (“EPR”) within a network message The transport layer retrieves message data from a message transport. The channel layer de-serializing the network message consistent with an underlying type system. The send/receive layer filters and dispatches the network message to messaging logic (other layers or application logic) based on the EPRs. The service/client message layer dispatches the network message to messaging application logic based on the EPRs. These EPR aware message processing layers implement dispatch logic so that messaging applications written for the architecture need not provide the dispatch logic, simplifying the messaging application logic and development of the messaging application itself.
摘要翻译： 用于以简化消息传递应用逻辑的方式处理网络消息的方法，系统和计算机程序产品。 可以包括传输层，信道层，发送/接收层，服务/客户端层以及潜在的其它消息系统架构的处理层知道网络消息内的端点参考（“EPR”） 传输层从消息传输中检索消息数据。 信道层将网络消息序列化，与基础类型系统一致。 发送/接收层基于EPR将网络消息过滤并分发到消息传递逻辑（其他层或应用程序逻辑）。 服务/客户端消息层基于EPR将网络消息分派到消息传递应用程序逻辑。 这些EPR感知消息处理层实现调度逻辑，使得针对架构编写的消息传递应用程序不需要提供调度逻辑，简化了消息应用程序逻辑和消息传递应用程序本身的开发。
-
公开(公告)号：US20090319795A1
公开(公告)日：2009-12-24
申请号：US12143392
申请日：2008-06-20
申请人： Tariq Sharif , Arun K. Nanda , Craig H. Wittenberg , Lucas R. Melton , Richard Randall , Kim Cameron , Hervey O. Wilson
发明人： Tariq Sharif , Arun K. Nanda , Craig H. Wittenberg , Lucas R. Melton , Richard Randall , Kim Cameron , Hervey O. Wilson
IPC分类号： H04L9/00
CPC分类号： G06F21/64 , G06F2221/2117 , H04L63/0823 , H04L63/123
摘要： Creating a token for use by an entity when digitally signing documents. In a computing environment, a digital identity representation for an entity is accessed. The digital identity representation includes information identifying identity attributes about the entity and capabilities of an identity provider that provides tokens for use by the entity. Context information is accessed. The context information includes information about one or more of which, how or where the attributes for the entity identified in the digital identity representation will be used. A security token is created from the information in the digital identity representation and the context information. The security token makes assertions by the identity provider. The assertions are based on the information in the digital identity representation. The token further includes information related to at least a portion of the context information.
摘要翻译： 创建一个令牌供实体在数字签署文档时使用。 在计算环境中，访问实体的数字身份表示。 数字身份表示包括识别关于实体的身份属性的信息以及提供令牌以供实体使用的身份提供者的能力。 访问上下文信息。 上下文信息包括关于在数字身份表示中识别的实体的属性的一个或多个，如何或何处被使用的信息。 根据数字身份表示和上下文信息中的信息创建安全令牌。 安全令牌由身份提供者进行断言。 断言是基于数字身份表示中的信息。 令牌还包括与上下文信息的至少一部分相关的信息。
-
公开(公告)号：US08087072B2
公开(公告)日：2011-12-27
申请号：US11856617
申请日：2007-09-17
申请人： Vijay K. Gajjala , Colin H. Brace , Derek T. Del Conte , Kim Cameron , Arun K. Nanda , Hervey O. Wilson , Stuart L. S. Kwan , Rashmi Raj , Vijayavani Nori
发明人： Vijay K. Gajjala , Colin H. Brace , Derek T. Del Conte , Kim Cameron , Arun K. Nanda , Hervey O. Wilson , Stuart L. S. Kwan , Rashmi Raj , Vijayavani Nori
CPC分类号： G06F21/33 , H04L9/3213 , H04L63/08 , H04L63/102 , H04L2209/56 , H04L2209/80
摘要： A system and method for provisioning digital identity representations (“DIRs”) uses various techniques and structures to ease administration, increase accuracy, and decrease inconsistencies of a digital-identity provisioning system. A system is provided using a common identity data store for both DIR issuance and identity token issuance, decreasing synchronization issues. Various methods are provided for creating new DIRs, notifying principals of available DIRs, and approving issuance of new DIRs.
摘要翻译： 用于提供数字身份表示（“DIR”）的系统和方法使用各种技术和结构来简化管理，增加准确性并减少数字身份提供系统的不一致性。 使用公共标识数据存储来提供系统以用于DIR发行和身份令牌发行，从而减少同步问题。 提供了各种方法来创建新的DIR，通知可用DIR的主体，并批准发布新的DIR。
-
-
-
-
-
-
-
-
-
搜索结果
20 条记录 (耗时 0.027 秒)
