Patent Grant
7594224
A portion of the disclosure of this patent document contains material which is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction by anyone of the patent document or the patent disclosure, as it appears in the Patent and Trademark Office patent file or records, but otherwise reserves all copyright rights whatsoever.
The present disclosure relates generally to systems and methods for a distributed security system that can be deployed to protect enterprise applications in a heterogeneous computing environment.
Companies are increasingly deploying network-based services (e.g., web services) to create enterprise-wide applications in heterogeneous computing environments. However, ensuring the security of such services is seen as a barrier to their wide-spread adoption.
Services are typically assembled from one or more software applications that may each implement their own proprietary security model and may each require their own form of administration. Thus, the security information and security procedures from one portion of an enterprise application may not be compatible with other portions. Furthermore, some security models may not take into account that users can have different policies depending on when and how they are interacting with a service. The result is a collection of services having incompatible silos of security.
Another reason why security remains a barrier to deploying web services is cost. Software developers can require extensive training before they are able to implement and deploy such systems. Developing a security system can also be seen as a distraction from a programmer's primary duty of developing application software. Even if this were not so, legacy applications not designed for dynamic changes in policy can require that security measures be intricately tied to the application itself. This leads to a security systems that are brittle and costly to maintain.
The invention is illustrated by way of example and not by way of limitation in the figures of the accompanying drawings in which like references indicate similar elements. References to embodiments in this disclosure are not necessarily to the same embodiment, and such references mean at least one.
In the following description, numerous specific details are set forth to provide a thorough description of the invention. However, it will be apparent to one skilled in the art that the invention may be practiced without these specific details. In other instances, well-known features have not been described in detail so as not to obscure the invention.
In various embodiments, systems and methods disclosed herein provide an approach to security for enterprise-wide applications while allowing for simple integration with third party security products. Security can be administered and controlled through flexible policies. The system can perform fine-grained, business transaction-based authorization at each point of access of application and other resources. In various embodiments, a resource can represent a component of an application, information, a process, a service, a function, a device and/or any other suitable entity which can be interacted with programmatically. By way of illustration, resources can include (but are not limited to) the following:
The present disclosure is not limited to or dependent on any type of resource. Accordingly, it will be apparent to those of skill in the art that any resource type presently known or yet to be developed is fully within the scope and spirit of the present disclosure.
Resources may contain attributes that provide additional information concerning the resource and how it may be accessed. For example, a filetype resource attribute could indicate whether a resource has a corresponding HTML, image, JSP or PDF representation. By way of illustration, permission to view a resource could be granted if the resource has a filetype equal to PDF. Such permissions are termed policies. Policies embody the security needs and reflect the business processes of an organization. Policies can be analogized to declarative rules, such as:
Policies dynamically identify resources that need to be protected, privileges or roles allowed each resource, and constraints that apply to each user or group of users that attempt to access the resource. In various embodiments, roles can be defined to dynamically associate users and/or groups of users based on some criteria. For example, a system administrator role might include all users having a certain skill level and only during certain times of day (e.g., after 5:00 pm). In various embodiments, the granting of roles can be expressed as policies (i.e., role policies). An authorization policy can be based on role(s) such that it determines which role(s) are permitted to access a resource under certain conditions.
In various embodiments, the system can use several categories of policies:
Once policies are deployed, security provider modules (see below) can apply them to the resources that they are managing.
In various embodiments, each component of the system may have a unique or shared configuration. In aspects of these embodiments, configuration can be managed through an administration console. Configuration also can be used to configure security provider modules (see below) for supported service types (e.g., Authentication, Authorization, Auditing, Role Mapping and Credential Mapping). For example, a security provider module installed on an intermediate network between an untrusted external network and a trusted internal network might be used to authenticate incoming user requests against a customer database, control which parts of the application user interface the user can access based on their role in the organization, and pass their identity to an application behind the firewall. An authentication security provider could be configured to provide this service. An audit security provider could also be configured so that all transactions are audited.
In various embodiments, authentication policy is used to determine the constraints under which a user, known to trusted authentication services and can prove who they claim to be, is permitted to be authenticated. These services may be embodied in an operating system, a Lightweight Directory Access Protocol (LDAP) directory, or a legacy application, for example. By way of illustration, the method of authentication can depend on the type of user directory and authentication method desired, or on the form of identity accepted from a trusted external source (e.g., a web application might require a simple username and password, whereas a financial application might require more stringent authentication). In username and password authentication, a user provides an identification and a matching password, which a configured provider (e.g., LDAP, Windows NT, or database) can then check against the configured directory to validate the user's identity.
By way of illustration, two other types of authentication are certificate-based and single sign-on. Certificate-based authentication is typically used when an TLS/SSL or HTTPS client requests access and presents its digital certificate to the server. The server passes a certificate to an X.509 Identity Asserter provider, which verifies the digital certificate and creates a local identity. The digital certificate is issued by a trusted certificate authority and is accepted as a form of user authentication. A Single Sign-On form of authentication is typical in a setting where the users are using multiple applications, each of which maintains its own security and requires user identity to control access. These may be within an organization, through an employee portal or externally on a completely different domain. For example, if the user requires access to separate applications, one in New York with a local LDAP and the other in London that uses a proprietary user database, a SAML identity assertion credential may be passed between these environments and either consumed by the remote security system directly or converted to a local identity through credential mapping.
In various embodiments, authorization policy can be based on the roles a user or group of users may hold at the time a resource access request is made. Unlike groups, which are relatively static and can persist for a session, roles are dynamic and are assigned to users or groups of users by evaluating role policies. For example, a group of bank tellers might have access to the same set of applications to perform specific banking tasks. Thus, there might be a role called Teller that encompasses the bank tellers. Authorization and other policies could then be enacted to restrict access to the applications only to users in the role of Teller. Role policies can significantly reduce the overall number of policies required and makes features like delegation easier to manage. Role policies can be combined with authorization requests or may be directly evaluated to support uses like application or portal personalization.
In various embodiments, authorization policies are associated with a resource. In aspects of these embodiments, resources can be organized in a hierarchy. The hierarchical children of a given resource in the hierarchy inherit the authorization policies associated with their parent resource(s). In aspects of these embodiments, authorization policies assigned to individual resources take precedence or override inherited authorization policies. By way of illustration, assume resource C is a child of resource B, and resource B is a child of resource A. If policy P1 is associated with A, B and C will inherit P1. If policy P2 is associated with B (which is for the same control of access as P1), B and C will not inherit P1, but C will inherit P2. Finally, if C is associated with a policy P3 (which is for the same control of access as P2), then C will not inherit P2. If P1, P2 and P3 were all for different rules for controlling access, then B would inherit P1 and C would inherit P1 and P2.
Generally speaking, an authorization policy can be specified as follows (wherein items in square brackets indicate alternatives; italic font indicates optional items):
In various embodiments, and by way of illustration, user and user group information can be stored and managed in external directories and databases and can be gathered and/or calculated at authentication time. For example, the source of user information might be an employee database, which would include the fact that the user is in the Sales department group, in the London office group, and in the star-salesmen group. Typically, it is desirable to establish a policy that applies to a large community of people, as establishing policies for each and every user can be time consuming, tedious, and hard to manage. Organizational structure, in the form of groups, maps well to typical business policies and is very useful for determining authorization and role policy. Thus, it is desirable to create groups of users (or groups of groups) whose tasks are related. For example, the following policy grants the ability to open accounts via the resource TellerApp to all users and groups belonging to the Tellers group from 9:00 AM to 5:00 PM, Monday through Friday:
An alternative to defining a group of users is to specify a role which defines the conditions under which a user or group of users is provided a capability. Roles are desirable when group membership tends not to be static (e.g., based on prevailing conditions). Roles are used to abstract the capabilities mechanism and represent a business task that a user or group of users are entitled to perform. In the above example, if instead a role called Tellers was used, the policies could be specified as follows:
The first policy defines a role named Tellers which includes anybody that is an employee and who happens to have a position of teller or manager. The second policy permits the OpenAccount action to be performed by a user that holds the Tellers role, subject to the constraints of time and day. By defining Tellers as a role, its definition can change dynamically as employee accounts are created and modified whereas a group definition would have to be changed along with employee accounts to remain current.
In various embodiments, role and authorization policies can also be based on contextual data available at run-time (e.g., a transaction amount passed in as a parameter). In some cases, a policy constraint can utilize information that is not locally available and which could require the security provider module (see below) to retrieve it from another source or compute it from another piece of data. For example, assume that an account balance is an attribute of a customer. To allow customers with an account balance over $100,000 access to the premier banking features of an application, the following policy could be defined:
In various embodiments, delegation is the transfer of capabilities from one user or group to another, and optionally under certain conditions. For example, a manager may delegate the ability to approve expense reports to his secretary. Delegation is often used by administrative users to control policy for other administrative users or for application users to allow someone else to perform an action for them or in their absence. In various embodiments, there can be restrictions on what rights can be further delegated by the delegate.
A policy can be used to delegate a role or privilege from one subject (i.e., the delegator) to another (i.e., the delegate). By way of illustration, delegation policies can be described with the following syntax:
In various embodiments, the delegate gets the ability to perform an action if the constraints evaluate to true and if the delegator would also get the ability to perform an action under the same conditions. If the delegator later loses the rights he has delegated, the delegate also looses them. In aspects of these embodiments, a delegator's identity information can be retrieved dynamically in order to determine if, at time of evaluation, the delegator has the capabilities (role) being delegated. By way of illustration, a delegator can put additional constraints on what is being shared. Constraints can include support for time-based restrictions such as (but not limited to) the following:
In various embodiments, a delegate can re-delegate capabilities/rights to another subject. The ability to re-delegate can be protected such that re-delegation could be prevented when the original delegation is made. In various embodiments, a delegator can indicate if the delegate can re-delegate the rights they are delegated.
By way of illustration, suppose George delegates the ability to author a product requirements document (PRD) to Andy, and also gives Andy the permission to delegate this ability further (not shown). Assuming the following delegated roles:
The author role is delegated to Andy from George. Thus, Andy can be in the author role whenever George could be. George also delegates the roles of editor and reader to the groups Managers and Engineers, respectively. As with the author role, Managers can be in the editor role and Engineers can be in the reader role whenever George can be in those roles.
By way of further illustration, Andy then decides to make Ken an author on an “authorization” section of the PRD. This is possible because George did not restrict Andy from re-delegating this role:
Assuming that Ken is a Manager and an Engineer he can get the editor and reader roles on the PRD. Accordingly, Ken can act as an author if he's working on the “authorization” section and if Andy (the delegator) can act as an author on the PRD when the section is “authorization.” The first policy says that Andy is always an author on the PRD so Andy's policy gets a grant, which makes the delegation policy return true and Ken picks up the “author” role assuming the given section is the “authorization” section. If Ken were trying to “write” in the PRD, he would only be able to if he had picked up the “author” role.
In various embodiments, delegation policies can be used to create administrative policy. In aspects of these embodiments, the rights of an administrator can be delegated by an administrator with greater rights than their own. Default administrative policies can be provided in this regard.
In various embodiments, auditing of administrative policy actions can be performed. This can include recording whether permission to perform an action was granted and whether the action was actually performed.
In various embodiments, delegation rules can be evaluated for authorization of a resource request only if a decision has not been reached with authorization policy rules. Such an algorithm can be used to require delegation evaluation in all cases.
In various embodiments, a client request to perform an operation on a resource can be intercepted and provided to a security service module (SSM). In various embodiments, an SSM can be integrated with a server, application server, web server, a process or any suitable device such as network firewalls, routers, relays, appliances, etc. In aspects of these embodiments, a container (e.g., an EJB or servlet container) can intercept the request and present it to a SSM. By way of illustration, the SSM can be provided with a subject that holds an authenticated identity (e.g., an authenticated user), a resource identifier, user group information, and/or a context handler object through which the SSM can obtain additional information about the context of the request.
Referring to
In various embodiments, resource request processing is performed by an SSM.
In aspects of these embodiments, the SSM 220 includes several functional layers that can reside in one or more processes. An adaptation layer 200 ties a framework layer 201 and a services layer 202 to a run-time environment. By way of example, a runtime environment can include an application/web server, an application program, a network firewall, and other suitable environments that require enterprise security. The adaptation layer includes an Application Program Interface (API) 214 to allow exploitation of the framework layer in the run-time environment. In aspects of these embodiments, an API can comprise a programmatic interface (e.g., class, method and/or function definitions), a communication interface such as a web service or other suitable mechanism for exchanging messages, and/or any other suitable protocol for invoking functionality and exchanging information. The present disclosure is not limited to or dependent on any API implementation presently known or yet to be developed, as will be appreciated by those of skill in the art.
The adaptation layer can invoke services of the framework layer via a framework programming interface (FPI) 218. Likewise, the framework layer can invoke services of the services layer via a service provider interface (SPI) 216. As with the adaptation layer API, the FPI and SPI can comprise a programmatic interface (e.g., class, method and/or function definitions), a communication interface such as a web service or other suitable mechanism for exchanging messages, and/or any other suitable protocol for invoking functionality and exchanging information. The present disclosure is not limited to or dependent on any FPI/SPI implementation presently known or yet to be developed, as will be appreciated by those of skill in the art.
In aspects of these embodiments, the FPI can translate API invocations into one or more SPI invocations. The FPI also hides the SPI from the adaptation layer, thus preventing any dependency on the SPI from forming. The SPI provides the FPI access to a set of dynamically configurable security services represented as “plug in” security provider modules (“providers”). In various embodiments, each module is compatible with the SPI. The services layer can be provided with a default set of providers. In another embodiment, the adaptation layer can communicate directly with the services layer, without an intervening framework layer (e.g., the API could invoke the SPI directly).
By way of illustration, authentication provider(s) 204 can authenticate, verify, and map security tokens to an internal format and support, for example, a single sign-on capability. Authorization provider(s) 206 can enforce authorization policies for resources that take authorization policy into consideration. Audit provider(s) 208 can audit some or all security actions taken by the framework layer. Role mapping provider(s) 210 can map roles to users/groups based on role definitions. Finally, credential mapping provider(s) 212 can map authentication credentials for a user to legacy application for single sign-on. The services layer can accommodate more than one provider of the same type.
In various embodiments and by way of illustration, SSMs can be deployed in applications, network hardware components, application servers, web servers, proxy servers, and any other suitable systems requiring security. For example, a legacy 304 or custom application program 302 can be modified to utilize the SSM through an API or other suitable means. An application/web server can also be configured to use the SSM via a J2EE servlet filter 310, security plugin provider 308, or delegated 312, as are commonly known in the art. The SSM can also be deployed in a proxy server 300. Finally, the SSM can be utilized in networking hardware 314 such as (but not limited to), a switch, router, relay, bridge, repeater or a hub.
In various embodiments, an administration console and server 306 allows an administrator or other user to create, modify and delete user, group and policy definitions. In addition, the administrator has the capability to delegate administrative privileges to other users. In various embodiments, the administration console allows a user to pose “what if” policy questions to determine what users/groups have access to a resource under a given set of conditions. The administration console can communicate with an administrative server which can dispense provisioning information (e.g., policy and/or configuration information) itself, or can utilize a distribution point process. Provisioning information can be dispensed to SSMs directly, or via one or more intermediate processes (e.g., SCMs).
In various embodiments, policy and configuration information is distributed to SSMs 402 via Security Control Mangers (SCMs) 400. This is referred to as “provisioning”. SCMs can reside anywhere on a computer network. In one embodiment, an SCM resides locally on systems that have one or more SSMs 402. An administration server can provision the policy and configuration information to an SCM as a provisioning request. In one embodiment, the information provisioned to an SCM is only relevant to SSMs deployed on the same system as the SCM. In aspects of these embodiments, only changes (“deltas”) to this information are propagated to SCMs. This is desirable since it can reduce the amount of information that needs to be transmitted between the administration server and the SCMs. By way of illustration, this can be accomplished by associating a version number with provisioning information or subsets thereof.
SCMs can cache provisioned information in a local store 404 and further provision it to one or more SSMs. In one embodiment, an SCM provisions information to SSMs that reside on the same system as the SCM. In various embodiments, provisioned configuration information can specify security providers, locations of directory servers, databases, and other suitable information. By way of illustration, an SSM can dynamically load security providers based on configuration information supplied to it by an SCM.
The SCM has many architectural benefits for the system. Firstly, the SCM can serve as the sole external management interface for all SSM components. This can eliminate redundant management infrastructure in system components, thus allowing all system components to take advantage of improvements in future versions of the SCM management interface. Secondly, having a single management interface per computing device has security benefits. An SCM-enabled host can expose a single management communication channel rather than one per SSM. This eliminates the need for a listen port in each SSM process, drastically reducing the number of open ports that are required to be secured and monitored. Finally, the use of the SCM can greatly simplify SSM configuration. Rather than relying on instance specific configuration files, an SSM can retrieve its entire configuration from the SCM via a well-known communication port.
A typical deployment of the system can consist of one or more SSMs distributed throughout an enterprise—embedded in applications, application servers, appliances, routers, web servers and other suitable systems. Configuring a potentially large number of distributed SSMs is a non-trivial task. Traditional configuration mechanisms, such as the use of local property files, break down as the number of configured entities increases. Rather than forcing customers to edit and maintain a property file for each SSM instance, the system includes a provisioning infrastructure that allows customers to manage the configuration of all SSMs through an administration console.
An SCM can supply provisioned information to SSMs as needed (e.g., in response to requests by SSMs). An SCM can also convey the information automatically without being requested to do so. In various embodiments, an SCM only provides provisioning information to an SSM is that relevant to that SSM. In aspects of these embodiments, the SCM provides only deltas to SSMs. In various embodiments, communication between system components can be accomplished with secure protocols. By way of illustration, mutually authenticated Transport Layer Security (TSL) connections can be utilized between components. In addition, the SCM and SSM can exchange Public-Key Infrastructure (X.509) certificates to establish identity and trust.
In various embodiments, support for Security Assertion Markup Language (SAML) is provided. SAML is a protocol for propagating identity that can be used from one security domain to the next and between components in the system. By way of example, a dynamic webpage can accept a user name and a password. These can be provided to a SAML authentication security provider via the SSM API. The authentication provider can perform authentication and return an artifact which can be passed back to the webpage and/or exchanged with other applications that require SAML assertions. Likewise, the SAML authentication provider can accept an artifact and return an indication of whether it is valid or not.
With reference to
With reference to
A Java® Authentication and Authorization Service (JAAS) authentication provider 512 as part of an SSM services layer 201 can authenticate user credentials against various sources of data. The provider implements an SPI for authentication providers in order to integrate itself into the services layer. In one embodiment, configuration information can be provided to the authentication provider as an Authenticator MBean. An MBean is a Java® object that implements the Java® Management Extensions (JMX) specification.
By way illustration, the provider can utilize databases 510 such as relational databases (RDBMs), Java® Database Connectivity (JDBC) data sources, and other sources of credential information. (To maximize performance database connection pooling 502 can be implemented in the provider.) A given user name can be used to lookup a user's record in a database. If the lookup locates a record in the database for the user, the password supplied can be compared against the password in the database for the user. If required, the record can also be checked to determined if it is disabled/locked out. Through configuration, the provider can be equipped with sufficient information to query a database source through JDBC and query or retrieve the necessary information. It can verify that the user exists in a store, validate a user password algorithm and retrieve user group and attribute information.
In various embodiments, providers can obtain user attribute information in at least three ways: 1) information passed to the provider as part of an authorization request; 2) information obtained from another service as needed; and 3) information obtained by evaluating policies. In various embodiments, user attributes, group membership, security credentials and other suitable information can be queried from repositories and made accessible to authentication and authorization providers within the SSM. In addition, such information can be cached to improve performance. By way of illustration, a Lightweight Directory Access Protocol (LDAP) interface for authorization and role mapping providers to a separate attribute service can be provided to obtain user-related information. Alternatively, a Simple Object Access Protocol (SOAP) interface to the attribute service can be provided. In yet another illustration, a database interface to a user database can be provided. This approach could be used to embed the attribute service in the provider. In various embodiments, the attribute service could be a plugin to the SCM. In other embodiments, the attribute service could be incorporated into the provisioning information distributed by SCMs. In yet another embodiment, the attribute service could be deployed inside an administration server.
The attribute service can be designed to scale to provide acceptable performance while servicing many providers simultaneously. Caching can be used within providers and possibly within the attribute service to improve performance. However, any caching in the attribute service can be expired or updated upon changes to the data to guarantee that only valid data is returned to the authorization and role mapping providers. Also, connection pooling by providers may be necessary to leverage multiple instances of the attribute service.
The SCM 400 can be used for retrieving and setting configuration information in authentication providers. In aspects of these embodiments, security providers—themselves plugins into the SSM—can also support their own dynamic plugins. By way of illustration, the authentication provider can include support for custom “provider” extension points. A provider extension handler class 504 can manage provider extensions 508 by loading them on initialization and unloading them on shutdown. References to provider extension class methods can be stored in a map and executed when needed. The configuration for a provider can contain a class name for each provider extension. That class can implement the method(s) for the type of provider extension it is configured for as well as initialize( ) and shutdown( ) methods. In this way, new functionality can be added to security providers without requiring the provider itself to be modified.
In various embodiments, an SCM 400 can include an extensible service framework 602 that provides services to other processes through inclusion of one or more service providers. In this illustration, a provisioning service provider 604 and a process management service provider 606 are shown. Many other service types are possible and can, by way of an example, encompass performance monitoring, event monitoring, configuration and resource discovery. In various embodiments and by way of illustration, the SCM service is a component framework that can facilitate the development of SCM agents from a set of independent but cooperating components or services. By way of illustration, service providers can be exposed via a SOAP interface.
In various embodiments, the service framework can define the lifecycle of service providers (e.g., initialization, commencement, termination, etc.) as well as how they can locate and interact with each other. In addition, the service framework can support the static and dynamic configuration of service providers. New service providers 608 can be added as needed. By way of illustration, the service framework can expose an SPI that service providers implement in order to integrate themselves into the service framework. By way of illustration, service framework and service provider configurations can be stored in an XML file that can be parameterized at installation.
In various embodiments, a service manager 610 can be used to intermediate between the service framework and services. The service manager instantiates each service provider and equips each with a service context that allows the provider to interact with the service SSM. The service SSM can also contain an in-process registry 600 in which services can be registered. By way of illustration, the SCM can be managed by a platform-specific process such as an embeddor (a system agent on Microsoft Windows® systems) or a daemon (on Unix® systems). Such a process can monitor the SCM and ensure the high availability of the SCM and its services. The SCM can provide other core functionality to services, such as configuration and logging.
The process management service provider (PMSP) 606 can start and stop processes and monitor one process on behalf of another, restarting it in the event of a crash, or stopping it when the requesting parent process exits. This capability greatly improves the manageability and reliability of the system. In various embodiments, SCMs can utilize the PMSP to manage one or more out-of-process SSMs. Security providers can also use the PMSP to start, stop, and monitor authorization and role mapping providers instances.
The provisioning service provider (PSP) 604 is responsible for maintaining provisioning information for all SSMs associated with the SCM. In various embodiments, the PSP exposes two services, one for processing provisioning requests from distributors and another for processing queries from SSMs. In various embodiments, the PSP can accept provisioning information for the set of all SSMs within a single administration domain from the distributor that, in one embodiment, are collocated on the same system as the SCM. In various embodiments, the PSP can associate a provisioning information version number with each SSM it is aware of. By way of illustration, on startup the PSP can contact a distributor, passing the version numbers of SSMs it is aware of. If necessary, the distributor can then send updates required to bring each SSM's provisioned information up-to-date. Thereafter, the PSP can listen for updates from the distributor and update a local persistent store accordingly. Each SSM can retrieve its current provisioning information at any time by querying the PSP via a information client query.
In various embodiments, SCM service providers can optionally establish trust relationships with other processes such as the distributor. By way of illustration, each trust relationship can be established by the creation of a public/private key pair that is created and registered when the SCM is installed. The SCM can retain the following information in order to establish trust relationships:
With reference to
In various embodiments, the local PSP interface 706 can be used to exchange information with one or more information query clients 702. An information query client encapsulates interaction with the local PSP interface from other processes and, by introducing a level of indirection, makes other processes less dependent on the implementation details of the local PSP interface. By way of illustration, an information query client can be implemented as an object that exposes one or more services through which other processes can communicate with a provisioning service.
The PSP is capable of receiving updates to provisioning information through the remote PSP interface. The updates can be full or incremental and can be propagated by distributor(s) (or other suitable processes). In various embodiments, the SCM can maintain provisioned information for all SSM instances for which it is responsible. The SCM can receive and store provisioned information updates in a local persistent store 708, and make it available to SSMs via one or more clients. In various embodiments, the provisioning mechanism ensures that only the provisioned information required by an SCM is provisioned to that SCM. Likewise, the SCM can ensure that only the provisioned information required by an SSM is made available to that SSM. In various embodiments, an atomic set of provisioned information updates can be transactional across all SCMs; that is, an update can take effect only if all SCMs are able to successfully process the update. This ensures that all provisioning within an administration domain is consistent across all running SCMs within that domain.
In various embodiments, Jakarta Phoenix can serve as the SCM service framework. Phoenix is a micro-kernel designed and implemented on top of the Jakarta Avalon. It provides a number of facilities to manage the environment of server applications. Such facilities include log management, class loading, and thread management. The Jakarta API defines a standard method of piecing together server components to create a server. Furthermore, since they are built on top of Jakarta Avalon, Phoenix applications automatically take advantage of the standard code design patters, rules and guidelines dictated by Avalon that increase the modularity and reuse of software components. In various embodiments, an SCM process can be managed by a Java® Service Wrapper (JSW) process. The JSW monitors a JVM process and automatically restarts it if that JVM crashes or hangs. This makes it possible to install the SCM as a Windows® NT Service or as a UNIX® daemon, allowing it to be automatically started upon system reboot.
In various embodiments, an SSM 402 includes a services layer 202 having associated security providers (not shown), a configuration service 804, and several clients (802, 702) for communication with an SCM 400. Security providers and other processes can obtain configuration information via the configuration service, which exposes services to allow a security provider to configure itself on start-up and dynamically thereafter. The configuration service encapsulates an implementation capable of retrieving this information—thus insulating security providers from implementation details. By way of illustration, a configuration service can be implemented as an object that exposes one or more simple methods through which other processes can communicate with a provisioning service provider. In aspects of these embodiments and by way of illustration, the services layer 202 can instantiate a new configuration service during initialization and pass it to one or more security providers through an initialization method. Both the service layer and its providers can query the configuration service at any time for configuration information.
In various embodiments, the configuration service 804 allows security providers to retrieve their current provisioning information from provisioning service provider 604 via information query client 702. In aspects of these embodiments and by way of illustration, provisioning information can be represented as scoped name-value pairs of text strings (e.g., an XML document). In various embodiments, additional implementations could be developed that retrieve configuration and policy data from alternative sources (e.g., a JMX MBean server). In various embodiments, the configuration service can cache provisioning information in a persistent store 808. Caching prevents unnecessary calls to the SCM at startup and reduces the amount of information transferred between the SCM and SSMs.
In various embodiments, security providers can use the PMSP 606 in order to start, stop, and monitor other processes. By way of illustration, on startup an SCM can use PMSP to start SSMs. In one embodiment, a process management client (not shown) can encapsulate interaction with the PMSP thus making security providers less dependent on the implementation details of the protocol used to communicate with the PMSP. By way of illustration, a processes management client can be implemented as an object that exposes one or more services through which other processes can communicate with a PMSP.
In various embodiments, the SCM client 802 allows the SSM to interact with the SCM by instantiating clients. By way of illustration, an SSM can first create an instance of the SCM client, and then invoke functionality on the SCM client to retrieve clients to other SCM services (e.g., provisioning). The SCM can maintain a client registry service provider (CSRP) 814 that manages information regarding the SSMs that are currently using the SCM.
The SCM client encapsulates interaction with a CSRP from other processes and, by introducing a level of indirection, makes other processes less dependent on the implementation details of the local PSP interface. By way of illustration, a SCM client can be implemented as an object that exposes one or more services through which other processes can communicate with a CSRP. In aspects of these embodiments, the CSRP can maintain a map of SSM status information. The status information can include, but is not limited to, an SSM's start time and total operation time. In further aspects, the client registry service can expose functionality for enumerating running SSMs and retrieving SSM status. For example, the service can allow other components/processes to register for SSM status update notifications. The service can also expose an interface that can receive heartbeat messages from SSM clients.
In various embodiments, the SCM service framework can include a data store service provider 810 which can be used to implement a persistent cache of provisioned information. This service can expose basic create, read, update and delete (CRUD) functionality. By way of illustration, the service can persist information in a file system, a database, and any other suitable storage means. In aspects of these embodiments, the data store service provider implements an SPI compatible with the SCM service SSM. By way of illustration, the data store service provider can be used both by the SCM and by SSMs or other processes.
The SSM allows processes to leverage services offered through security provider modules. By the same token, the SSM's flexible infrastructure also allows security vendors, integrators, and users to provide their own custom security provider modules. Secure provider modules can be mixed and matched to create unique security solutions, allowing organizations to take advantage of new technology advances in some areas while retaining proven methods in others. Thanks to the use of SCMs to distribute provisioning information, a security solution embodied in a particular SSM configuration can be painlessly scaled to suit large or small deployments.
In various embodiments, the administration server includes an administration coordinator 910 to harmonize activities of the various administration server components. In aspects of these embodiments, the administration server 900 includes an administration console 904 (“console”) that allows administrative users to easily configure and manage various aspects of the system through a unified management user interface. Configuration information is cached in storage 912 for use by the distributor 914. Configuration settings for security provider modules can be viewed and modified in the console wherein modifications to configuration information can be automatically propagated back to the effected security provider module(s). Through the console, SCMs and SSMs can be deployed on specific machines. The console can also be used to associate an SSM with an SCM and specify the security provider modules that a given SSM will utilize. In various embodiments, if an SSM has not been associated with an SCM, the SSM can either dynamically associate with an SCM through a discovery procedure or instantiate a new SCM process to associate with.
In aspects of these embodiments, the administration console includes a user interface (not shown). By way of a non-limiting example, a user interface can include one or more of the following: 1) a graphical user interface (GUI) (e.g., rendered with Hypertext Markup Language) rendered on a display device or projected onto a user's retina; 2) an ability to respond to sounds and/or voice commands; 3) an ability to respond to input from a remote control device (e.g., a cellular telephone, a PDA, or other suitable remote control); 4) an ability to respond to gestures (e.g., facial and otherwise); 5) an ability to respond to commands from a process on the same or another computing device; and 6) an ability to respond to input from a computer mouse and/or keyboard. This disclosure is not limited to any particular UI. Those of skill in the art will recognize that many other user interfaces are possible and fully within the scope and spirit of this disclosure.
In various embodiments, a loader 906 imports policy definitions 902 from one or more files, databases, other systems, or from any other suitable source(s), into storage 912. The loader can extract the definitions itself or enlist the help of one or more additional processes (not shown). Security policies frequently need more information than simple identity data to resolve sophisticated policy decisions. In various embodiments, an optional meta-directory or virtual directory 908 is provided to access and synchronize user attributes from a variety of sources to support these policies. Since these attributes may not be stored in any single place, this directory serves to integrate attributes for each user and cache them in storage 912 for use by SSMs. The meta-directory or virtual directory can integrate information from a variety of sources, including (but not limited to), application databases, Lightweight Directory Access Protocol (LDAP) directory servers, network databases, and others suitable sources. The distributor 914 utilizes information in the storage 912 to provide SCMs with policy and configuration information relevant to their SSMs.
The system can employ a fully-distributed security enforcement architecture consisting of SSMs 402 embedded in applications, application servers, web servers, and hardware, throughout an enterprise. To facilitate the management of a potentially large number of distributed SSMs, the administration server 900 uses a remote administration mechanism to distribute configuration data to each SSM. In various embodiments, the SCM 400 is a component of this remote administration mechanism. Each SCM is responsible for storing 404 and maintaining policy and configuration information for all SSMs that it is associated with. In one embodiment, an SCM is associated with the SSMs on its local machine. When a change to an SSM's configuration or policy is made and distributed from the administration console, an SCM receives the change and updates its cached copy of the configuration. The change is then propagated to the SSM which can adapt to the configuration change dynamically or at a later time. In addition to facilitating management, the SCM enables SSMs to operate in the absence of the administration server. Since SCMs maintain a persistent copy of each configuration, new SSMs can be started and existing SSMs can continue to function, even if the Administration server goes down.
The query region allows a user to find policies by specifying zero or more policy components as search criteria. In various embodiments, policy components can be specified as text strings. All policies having matching components to those specified by the user are included in the results list. User-specified components can include more than one value, and can include wild cards (e.g., “*” matches everything) to allow for pattern matching. The user can specify the following policy components: zero or more-resources 1102, zero or more policy types 1104 (e.g., GRANT, DENY, DELEGATE), zero or more privilege or role name(s) 1106, zero or more subject name(s) 1108, zero or more delegator names 1110, and zero or more constraints 1112. In aspects of these embodiments, constraints can be specified in the same manner they are specified in policy definitions. The resource 1102 can be specified as one or more text strings or can be interactively chosen from a graphical (tree) representation of a resource hierarchy 1118.
By way of illustration, if user named Joe wanted to find all policies that effect him. Joe would specify the root of the resource hierarchy in 1102 or 1118, or alternatively he would specify a wild card “*” in text field 1102. Alternatively, if Joe wanted to see what policies where applicable to him for specific resources, he could specify those resources in 1102 or 1118. In the subject field, Joe specifies his user name and, optionally, any roles and/or groups he belongs to. By hitting the return key or by selecting the Find button 1122 or other suitable action, a search commences and all applicable policies are displayed in the results list. Alternatively, the results list could be dynamically updated as search parameters are entered. Joe could refine the results using policy type filters 1130. For example, by selecting “All” (the default) all policies are displayed. But results can be limited to any combination of policy type, including but not limited to: configuration, authentication, role, authorization and audit.
Since the subject component for policies can include roles, the policy tool first discovers all of the applicable role policies for users and groups specified in the subject field 1108. Then, the policy tool can perform the search using the user-specified criteria but with the addition of any discovered roles to the subject component. In addition, policy inheritance on the selected resource(s) is taken into account. In aspects of these embodiments, the policy tool can utilize the SSM API to map users and groups to roles, and to select policies that satisfy the user specified criteria.
In various embodiments, the rows in the results list correspond to policies wherein one or more policies can be selected. Selected policies can be modified by, for example, further selecting the Edit button 1126. In aspects of these embodiments, selection of the edit button can cause an a policy editor window to appear in which selected policies can be edited. In further aspects of these embodiments, a policy can be edited in place in the results list. Or the selected policies can be deleted by further selecting the Delete button 1128. New policies can be added by selection of the New button 1124, which can cause a policy editor window to appear.
By way of further illustration, the policy tool can be used to find all policies delegated to a particular subject. By way of example, this can be accomplished by putting the user's name in the subject field 1108, and a wildcard “*” in the delegator field 1110. This will find all policies where a delegation has been made to the user (or a role the user is in). Likewise, the policy tool can be used to find all policies that have been delegated by a particular user. For example, the user's name can be provided in the delegator field and a wildcard can be placed in the subject field.
Referring to
In various embodiments, the administration console provides one or more user interfaces for creating, reading, updating and deleting users and groups, and for nesting groups within groups. Furthermore, attributes associated with users and groups can also be created, read, updated and deleted from the console.
Various embodiments can be implemented using a conventional general purpose or a specialized digital computer or microprocessor(s) programmed according to the teachings of the present disclosure, as will be apparent to those skilled in the computer art. Appropriate software coding can readily be prepared by skilled programmers based on the teachings of the present disclosure, as will be apparent to those skilled in the software art. The invention can also be implemented by the preparation of integrated circuits or by interconnecting an appropriate network of conventional component circuits, as can be readily apparent to those skilled in the art.
Various embodiments include a computer program product which is a storage medium (media) having instructions stored thereon/in which can be used to program a computer to perform any of the embodiments presented herein. The storage medium can include, but is not limited to, any type of disk including floppy disks, optical discs, DVD, CD-ROMs, microdrive, and magneto-optical disks, ROMs, RAMs, EPROMs, EEPROMs, DRAMs, VRAMs, flash memory devices, magnetic or optical cards, nanosystems (including molecular memory ICs), or any type of media or device suitable for storing instructions and/or data.
Stored on any one of the computer readable medium (media), the present invention includes software for controlling both the hardware of the general purpose/specialized computer or microprocessor, and for enabling the computer or microprocessor to interact with a human user or other mechanism utilizing the results of the present invention. Such software can include, but is not limited to, device drivers, operating systems, execution environments/containers, and applications.
The foregoing description of the preferred embodiments of the present invention has been provided for the purposes of illustration and description. It is not intended to be exhaustive or to limit the invention to the precise forms disclosed. Many modifications and variations will be apparent to the practitioner skilled in the art. Embodiments were chosen and described in order to best describe the principles of the invention and its practical application, thereby enabling others skilled in the art to understand the invention, the various embodiments and with various modifications that are suited to the particular use contemplated. It is intended that the scope of the invention be defined by the following claims and their equivalents.
This application claims priority from the following application, which is hereby incorporated by reference in its entirety: U.S. Provisional Patent Application No. 60/508,427 entitled SYSTEMS AND METHODS FOR ENTERPRISE APPLICATION SECURITY, by Paul Patrick et al., filed Oct. 10, 2003. This application is related to the following co-pending applications which are each hereby incorporated by reference in their entirety: U.S. patent application Ser. No. 10/961,637 entitled DELAGATION IN A DISTRIBUTED SECURITY SYSTEM, by Paul Patrick et al., filed Oct. 8, 2004; U.S. patent application Ser. No. 10/961,647, entitled DISTRIBUTED SECURITY SYSTEM WITH DYNAMIC ROLES, by Paul Patrick et al., filed Oct. 8, 2004; U.S. patent application Ser. No. 10/961,351 entitled DISTRIBUTED SECURITY SYSTEM WITH SECURITY SERVICE PROVIDERS, by Paul Patrick et al., filed Oct. 8, 2004; U.S. patent application Ser. No. 10/961,701 entitled AN EMBEDDABLE SECURITY SERVICE MODULE, by Paul Patrick et al., filed Oct. 8, 2004; U.S. patent application Ser. No. 10/962,067 entitled CONFIGURATION OF A DISTRIBUTED SECURITY SYSTEM, by Paul Patrick et al., filed Oct. 8, 2004; U.S. patent application Ser. No. 10/961,808 entitled POLICY ANALYSIS TOOL, by Paul Patrick et al., filed Oct. 8, 2004; U.S. patent application Ser. No. 10/961,593 entitled DISTRIBUTED SECURITY SYSTEM POLICIES, by Paul Patrick et al., filed Oct. 8, 2004; U.S. patent application Ser. No. 10/962,079 entitled POLICY INHERITENCE THROUGH NESTED GROUPS, by Paul Patrick et al., filed Oct. 8, 2004; U.S. patent application Ser. No. 10/961,675 entitled SECURITY PROVIDER DEVELOPMENT MODEL, by Paul Patrick et al., filed Oct. 8, 2004; U.S. patent application Ser. No. 10/961,674 SECURITY CONTROL MODULE, by Paul Patrick et al., filed Oct. 8, 2004; U.S. patent application Ser. No. 10/961,839 entitled DELEGATED ADMINISTRATION FOR A DISTRIBUTED SECURITY SYSTEM, by Paul Patrick et al., filed Oct. 8, 2004; U.S. patent application Ser. No. 10/961,850 entitled DYNAMICALLY CONFIGURABLE DISTRIBUTED SECURITY SYSTEM, by Paul Patrick et al., filed Oct. 8, 2004; U.S. patent application Ser. No. 10/961,544 entitled DYNAMICALLY CONFIGURABLE DISTRIBUTED SECURITY SYSTEM, by Paul Patrick et al., filed Oct. 8, 2004; U.S. patent application Ser. No. 10/962,106 entitled DISTRIBUTED ENTERPRISE SECURITY SYSTEM, by Paul Patrick et al., filed Oct. 8, 2004; and U.S. patent application Ser. No. 10/961,677 entitled DISTRIBUTED ENTERPRISE SECURITY SYSTEM FOR A RESOURCE HIERARCHY, by Paul Patrick et al., filed Oct. 8, 2004. The following U.S. Patent and U.S. Patent Publications are hereby incorporated by reference in their entirety: U.S. Pat. No. 6,158,010 entitled SYSTEM AND METHOD FOR MAINTAINING SECURITY IN A DISTRIBUTED COMPUTER NETWORK, by Mark Moriconi et al., issued Dec. 5, 2000. U.S. patent application Ser. No. 09/878,536, entitled SYSTEM AND METHOD FOR SERVER SECURITY AND ENTITLEMENT PROCESSING, by Paul Patrick, filed Jun. 11, 2001, now U.S. Patent Publication No. US2002-0188869, published on Dec. 12, 2002;
| Number | Name | Date | Kind |
|---|---|---|---|
| 5173939 | Abadi et al. | Dec 1992 | A |
| 5237614 | Weiss | Aug 1993 | A |
| 5265221 | Miller | Nov 1993 | A |
| 5335345 | Frieder et al. | Aug 1994 | A |
| 5341478 | Travis, Jr. et al. | Aug 1994 | A |
| 5347653 | Flynn et al. | Sep 1994 | A |
| 5355474 | Thuraisngham et al. | Oct 1994 | A |
| 5369702 | Shanton | Nov 1994 | A |
| 5426747 | Weinreb et al. | Jun 1995 | A |
| 5481700 | Thuraisingham | Jan 1996 | A |
| 5544322 | Cheng et al. | Aug 1996 | A |
| 5557747 | Rogers et al. | Sep 1996 | A |
| 5577209 | Boyle et al. | Nov 1996 | A |
| 5619710 | Travis, Jr. et al. | Apr 1997 | A |
| 5627886 | Bowman | May 1997 | A |
| 5757669 | Christie et al. | May 1998 | A |
| 5774551 | Wu et al. | Jun 1998 | A |
| 5797128 | Birnbaum | Aug 1998 | A |
| 5809230 | Pereira | Sep 1998 | A |
| 5825883 | Archibald et al. | Oct 1998 | A |
| 5826000 | Hamilton | Oct 1998 | A |
| 5826268 | Schaefer et al. | Oct 1998 | A |
| 5835726 | Shwed et al. | Nov 1998 | A |
| 5841869 | Merkling et al. | Nov 1998 | A |
| 5848396 | Gerace | Dec 1998 | A |
| 5867667 | Butman et al. | Feb 1999 | A |
| 5872928 | Lewis et al. | Feb 1999 | A |
| 5889953 | Thebaut et al. | Mar 1999 | A |
| 5918210 | Rosenthal et al. | Jun 1999 | A |
| 5925126 | Hsieh | Jul 1999 | A |
| 5941947 | Brown et al. | Aug 1999 | A |
| 5950195 | Stockwell et al. | Sep 1999 | A |
| 5954798 | Shelton et al. | Sep 1999 | A |
| 5956400 | Chaum et al. | Sep 1999 | A |
| 5956521 | Wang | Sep 1999 | A |
| 5966707 | Van Huben et al. | Oct 1999 | A |
| 5968176 | Nessett et al. | Oct 1999 | A |
| 5983270 | Abraham et al. | Nov 1999 | A |
| 5983350 | Minear et al. | Nov 1999 | A |
| 5987469 | Lewis et al. | Nov 1999 | A |
| 5987611 | Freund | Nov 1999 | A |
| 5991877 | Luckenbaugh | Nov 1999 | A |
| 5991879 | Still | Nov 1999 | A |
| 5999978 | Angal et al. | Dec 1999 | A |
| 6005571 | Pachauri | Dec 1999 | A |
| 6006194 | Merel | Dec 1999 | A |
| 6009507 | Brooks et al. | Dec 1999 | A |
| 6029144 | Barrett et al. | Feb 2000 | A |
| 6029182 | Nehab et al. | Feb 2000 | A |
| 6029196 | Lenz | Feb 2000 | A |
| 6029246 | Bahr | Feb 2000 | A |
| 6035399 | Klemba et al. | Mar 2000 | A |
| 6052531 | Waldin et al. | Apr 2000 | A |
| 6054910 | Tada et al. | Apr 2000 | A |
| 6055515 | Consentino et al. | Apr 2000 | A |
| 6055636 | Hillier et al. | Apr 2000 | A |
| 6055637 | Hudson et al. | Apr 2000 | A |
| 6058392 | Sampson et al. | May 2000 | A |
| 6070244 | Orchier et al. | May 2000 | A |
| 6073242 | Hardy et al. | Jun 2000 | A |
| 6083276 | Davidson et al. | Jul 2000 | A |
| 6088451 | He et al. | Jul 2000 | A |
| 6088679 | Barkley | Jul 2000 | A |
| 6098173 | Elgressy et al. | Aug 2000 | A |
| 6105027 | Schneider et al. | Aug 2000 | A |
| 6108687 | Craig | Aug 2000 | A |
| 6122647 | Horowitz et al. | Sep 2000 | A |
| 6141010 | Hoyle | Oct 2000 | A |
| 6141686 | Jackowski et al. | Oct 2000 | A |
| 6148333 | Guedalia et al. | Nov 2000 | A |
| 6154741 | Feldman | Nov 2000 | A |
| 6154844 | Touboul et al. | Nov 2000 | A |
| 6157924 | Austin | Dec 2000 | A |
| 6158010 | Moriconi et al. | Dec 2000 | A |
| 6167407 | Nachenberg et al. | Dec 2000 | A |
| 6167445 | Gai et al. | Dec 2000 | A |
| 6170009 | Mandal et al. | Jan 2001 | B1 |
| 6182226 | Reid et al. | Jan 2001 | B1 |
| 6182277 | DeGroot et al. | Jan 2001 | B1 |
| 6185587 | Bernardo et al. | Feb 2001 | B1 |
| 6199204 | Donohue | Mar 2001 | B1 |
| 6202066 | Barkley et al. | Mar 2001 | B1 |
| 6202157 | Brownlie et al. | Mar 2001 | B1 |
| 6202207 | Donohue | Mar 2001 | B1 |
| 6209101 | Mitchem et al. | Mar 2001 | B1 |
| 6216231 | Stubblebine | Apr 2001 | B1 |
| 6226745 | Wiederhold | May 2001 | B1 |
| 6230271 | Wadlow et al. | May 2001 | B1 |
| 6233686 | Zenchelsky et al. | May 2001 | B1 |
| 6241608 | Torango | Jun 2001 | B1 |
| 6243747 | Lewis et al. | Jun 2001 | B1 |
| 6253321 | Nikander et al. | Jun 2001 | B1 |
| 6256741 | Stubblebine | Jul 2001 | B1 |
| 6260050 | Yost et al. | Jul 2001 | B1 |
| 6269393 | Yost et al. | Jul 2001 | B1 |
| 6269456 | Hodges et al. | Jul 2001 | B1 |
| 6275941 | Saito et al. | Aug 2001 | B1 |
| 6285366 | Ng et al. | Sep 2001 | B1 |
| 6285985 | Horstmann | Sep 2001 | B1 |
| 6292900 | Ngo et al. | Sep 2001 | B1 |
| 6295607 | Johnson | Sep 2001 | B1 |
| 6301613 | Ahlstrom et al. | Oct 2001 | B1 |
| 6304881 | Halim et al. | Oct 2001 | B1 |
| 6308163 | Du et al. | Oct 2001 | B1 |
| 6317868 | Grimm et al. | Nov 2001 | B1 |
| 6321336 | Applegate et al. | Nov 2001 | B1 |
| 6324685 | Balassanian | Nov 2001 | B1 |
| 6327594 | Van Huben et al. | Dec 2001 | B1 |
| 6327618 | Ahlstrom et al. | Dec 2001 | B1 |
| 6327628 | Anuff et al. | Dec 2001 | B1 |
| 6339423 | Sampson et al. | Jan 2002 | B1 |
| 6339826 | Hayes et al. | Jan 2002 | B2 |
| 6341352 | Child et al. | Jan 2002 | B1 |
| 6353886 | Howard et al. | Mar 2002 | B1 |
| 6360363 | Moser et al. | Mar 2002 | B1 |
| 6366930 | Parker et al. | Apr 2002 | B1 |
| 6377973 | Gideon | Apr 2002 | B2 |
| 6381579 | Gervais et al. | Apr 2002 | B1 |
| 6385627 | Cragun | May 2002 | B1 |
| 6393474 | Eichert et al. | May 2002 | B1 |
| 6397222 | Zellweger | May 2002 | B1 |
| 6397231 | Salisbury et al. | May 2002 | B1 |
| 6408336 | Schneider et al. | Jun 2002 | B1 |
| 6412070 | Van Dyke et al. | Jun 2002 | B1 |
| 6412077 | Roden et al. | Jun 2002 | B1 |
| 6418448 | Sarkar | Jul 2002 | B1 |
| 6430556 | Goldberg et al. | Aug 2002 | B1 |
| 6438749 | Chamberlain | Aug 2002 | B1 |
| 6453345 | Trcka et al. | Sep 2002 | B2 |
| 6453353 | Win et al. | Sep 2002 | B1 |
| 6457007 | Kikuchi et al. | Sep 2002 | B1 |
| 6460141 | Olden | Oct 2002 | B1 |
| 6463470 | Mohaban et al. | Oct 2002 | B1 |
| 6466239 | Ishikawa | Oct 2002 | B2 |
| 6466932 | Dennis et al. | Oct 2002 | B1 |
| 6466947 | Arnold et al. | Oct 2002 | B2 |
| 6473791 | Al-Ghosein et al. | Oct 2002 | B1 |
| 6477543 | Huang et al. | Nov 2002 | B1 |
| 6477575 | Koeppel et al. | Nov 2002 | B1 |
| 6484177 | Van Huben et al. | Nov 2002 | B1 |
| 6484261 | Wiegel | Nov 2002 | B1 |
| 6487594 | Bahlmann | Nov 2002 | B1 |
| 6510513 | Danieli | Jan 2003 | B1 |
| 6519647 | Howard et al. | Feb 2003 | B1 |
| 6530024 | Proctor | Mar 2003 | B1 |
| 6539375 | Kawasaki | Mar 2003 | B2 |
| 6539380 | Moran | Mar 2003 | B1 |
| 6539414 | Klein et al. | Mar 2003 | B1 |
| 6542993 | Erfani | Apr 2003 | B1 |
| 6571247 | Danno et al. | May 2003 | B1 |
| 6574736 | Andrews | Jun 2003 | B1 |
| 6581054 | Bogrett | Jun 2003 | B1 |
| 6581071 | Gustman et al. | Jun 2003 | B1 |
| 6584454 | Hummel et al. | Jun 2003 | B1 |
| 6587849 | Mason et al. | Jul 2003 | B1 |
| 6587876 | Mahon et al. | Jul 2003 | B1 |
| 6615218 | Mandal et al. | Sep 2003 | B2 |
| 6618806 | Brown et al. | Sep 2003 | B1 |
| 6633538 | Tanaka et al. | Oct 2003 | B1 |
| 6651249 | Waldin et al. | Nov 2003 | B2 |
| 6654747 | Van Huben et al. | Nov 2003 | B1 |
| 6665677 | Wotring et al. | Dec 2003 | B1 |
| 6668354 | Chen et al. | Dec 2003 | B1 |
| 6678827 | Rothermel et al. | Jan 2004 | B1 |
| 6684369 | Bernardo et al. | Jan 2004 | B1 |
| 6687823 | Al-Salqan et al. | Feb 2004 | B1 |
| 6697805 | Choquier et al. | Feb 2004 | B1 |
| 6715077 | Vasudevan et al. | Mar 2004 | B1 |
| 6721888 | Liu et al. | Apr 2004 | B1 |
| 6732144 | Kizu et al. | May 2004 | B1 |
| 6735586 | Timmons | May 2004 | B2 |
| 6735701 | Jacobson | May 2004 | B1 |
| 6738789 | Multer et al. | May 2004 | B2 |
| 6751659 | Fenger et al. | Jun 2004 | B1 |
| 6754672 | McLauchlin | Jun 2004 | B1 |
| 6757698 | McBride et al. | Jun 2004 | B2 |
| 6757822 | Feiertag et al. | Jun 2004 | B1 |
| 6769095 | Brassard et al. | Jul 2004 | B1 |
| 6769118 | Garrison et al. | Jul 2004 | B2 |
| 6772332 | Boebert et al. | Aug 2004 | B1 |
| 6779002 | Mwaura | Aug 2004 | B1 |
| 6785728 | Schneider et al. | Aug 2004 | B1 |
| 6789202 | Ko et al. | Sep 2004 | B1 |
| 6792537 | Liu et al. | Sep 2004 | B1 |
| 6807636 | Hartman et al. | Oct 2004 | B2 |
| 6832313 | Parker | Dec 2004 | B1 |
| 6834284 | Acker et al. | Dec 2004 | B2 |
| 6854035 | Dunham et al. | Feb 2005 | B2 |
| 6856999 | Flanagin et al. | Feb 2005 | B2 |
| 6857012 | Sim et al. | Feb 2005 | B2 |
| 6865549 | Connor | Mar 2005 | B1 |
| 6873988 | Herrmann et al. | Mar 2005 | B2 |
| 6880005 | Bell et al. | Apr 2005 | B1 |
| 6889222 | Zhao | May 2005 | B1 |
| 6901403 | Bata et al. | May 2005 | B1 |
| 6904454 | Stickler | Jun 2005 | B2 |
| 6920457 | Pressmar | Jul 2005 | B2 |
| 6922695 | Skufca et al. | Jul 2005 | B2 |
| 6931549 | Ananda | Aug 2005 | B1 |
| 6934934 | Osborne et al. | Aug 2005 | B1 |
| 6941472 | Moriconi et al. | Sep 2005 | B2 |
| 6957261 | Lortz | Oct 2005 | B2 |
| 6961897 | Peel et al. | Nov 2005 | B1 |
| 6965999 | Fox et al. | Nov 2005 | B2 |
| 6970445 | O'Neill et al. | Nov 2005 | B2 |
| 6970876 | Hotti et al. | Nov 2005 | B2 |
| 6978379 | Goh et al. | Dec 2005 | B1 |
| 6985915 | Somalwar et al. | Jan 2006 | B2 |
| 6988138 | Alcorn et al. | Jan 2006 | B1 |
| 7003578 | Kanada et al. | Feb 2006 | B2 |
| 7013485 | Brown et al. | Mar 2006 | B2 |
| 7035879 | Shi et al. | Apr 2006 | B2 |
| 7035944 | Fletcher et al. | Apr 2006 | B2 |
| 7047522 | Dixon et al. | May 2006 | B1 |
| 7051316 | Charisius et al. | May 2006 | B2 |
| 7054910 | Nordin et al. | May 2006 | B1 |
| 7062490 | Adya et al. | Jun 2006 | B2 |
| 7062511 | Poulsen | Jun 2006 | B1 |
| 7076652 | Ginter et al. | Jul 2006 | B2 |
| 7080000 | Cambridge | Jul 2006 | B1 |
| 7085755 | Bluhm et al. | Aug 2006 | B2 |
| 7085994 | Gvily | Aug 2006 | B2 |
| 7089584 | Sharma | Aug 2006 | B1 |
| 7093200 | Schreiber et al. | Aug 2006 | B2 |
| 7093261 | Harper et al. | Aug 2006 | B1 |
| 7093283 | Chen et al. | Aug 2006 | B1 |
| 7124192 | High et al. | Oct 2006 | B2 |
| 7124413 | Klemm et al. | Oct 2006 | B1 |
| 7143151 | Kayashima et al. | Nov 2006 | B1 |
| 7171441 | Shiouchi et al. | Jan 2007 | B2 |
| 7174563 | Brownlie et al. | Feb 2007 | B1 |
| 7185192 | Kahn | Feb 2007 | B1 |
| 7185332 | Waldin et al. | Feb 2007 | B1 |
| 7216125 | Goodwin | May 2007 | B2 |
| 7219140 | Marl et al. | May 2007 | B2 |
| 7234168 | Gupta et al. | Jun 2007 | B2 |
| 7272625 | Hannel et al. | Sep 2007 | B1 |
| 7318237 | Moriconi et al. | Jan 2008 | B2 |
| 7350226 | Moriconi et al. | Mar 2008 | B2 |
| 20010007133 | Moriconi et al. | Jul 2001 | A1 |
| 20010023421 | Numao et al. | Sep 2001 | A1 |
| 20010029517 | De Meno et al. | Oct 2001 | A1 |
| 20010032128 | Kepecs | Oct 2001 | A1 |
| 20010034771 | Hutsch et al. | Oct 2001 | A1 |
| 20010039586 | Primak et al. | Nov 2001 | A1 |
| 20010047485 | Brown et al. | Nov 2001 | A1 |
| 20020005867 | Gvily | Jan 2002 | A1 |
| 20020016777 | Seamons et al. | Feb 2002 | A1 |
| 20020019827 | Shiman et al. | Feb 2002 | A1 |
| 20020029296 | Anuff et al. | Mar 2002 | A1 |
| 20020059394 | Sanders | May 2002 | A1 |
| 20020062451 | Scheidt et al. | May 2002 | A1 |
| 20020067370 | Forney et al. | Jun 2002 | A1 |
| 20020069261 | Bellare et al. | Jun 2002 | A1 |
| 20020087571 | Stapel et al. | Jul 2002 | A1 |
| 20020103818 | Amberden | Aug 2002 | A1 |
| 20020104071 | Charisius et al. | Aug 2002 | A1 |
| 20020107913 | Rivera et al. | Aug 2002 | A1 |
| 20020107920 | Hotti | Aug 2002 | A1 |
| 20020111998 | Kim | Aug 2002 | A1 |
| 20020112171 | Ginter et al. | Aug 2002 | A1 |
| 20020120685 | Srivastava et al. | Aug 2002 | A1 |
| 20020124053 | Adams et al. | Sep 2002 | A1 |
| 20020135617 | Samid | Sep 2002 | A1 |
| 20020143819 | Han et al. | Oct 2002 | A1 |
| 20020147645 | Alao et al. | Oct 2002 | A1 |
| 20020152267 | Lennon | Oct 2002 | A1 |
| 20020152279 | Sollenberger et al. | Oct 2002 | A1 |
| 20020161903 | Besaw | Oct 2002 | A1 |
| 20020166052 | Garg et al. | Nov 2002 | A1 |
| 20020169893 | Chen et al. | Nov 2002 | A1 |
| 20020169975 | Good | Nov 2002 | A1 |
| 20020173971 | Stirpe et al. | Nov 2002 | A1 |
| 20020178119 | Griffin et al. | Nov 2002 | A1 |
| 20020188869 | Patrick | Dec 2002 | A1 |
| 20020194267 | Flesner et al. | Dec 2002 | A1 |
| 20030014394 | Fujiwara et al. | Jan 2003 | A1 |
| 20030014442 | Shiigi et al. | Jan 2003 | A1 |
| 20030032409 | Hutcheson et al. | Feb 2003 | A1 |
| 20030046576 | High et al. | Mar 2003 | A1 |
| 20030065721 | Roskind | Apr 2003 | A1 |
| 20030069874 | Hertzog et al. | Apr 2003 | A1 |
| 20030078959 | Yeung et al. | Apr 2003 | A1 |
| 20030078972 | Tapisser et al. | Apr 2003 | A1 |
| 20030088617 | Clark et al. | May 2003 | A1 |
| 20030105974 | Griffin et al. | Jun 2003 | A1 |
| 20030110073 | Briel et al. | Jun 2003 | A1 |
| 20030110172 | Selman et al. | Jun 2003 | A1 |
| 20030110448 | Haut et al. | Jun 2003 | A1 |
| 20030115292 | Griffin et al. | Jun 2003 | A1 |
| 20030115484 | Moriconi et al. | Jun 2003 | A1 |
| 20030117437 | Cook et al. | Jun 2003 | A1 |
| 20030120686 | Kim et al. | Jun 2003 | A1 |
| 20030126236 | Marl et al. | Jul 2003 | A1 |
| 20030126464 | McDaniel et al. | Jul 2003 | A1 |
| 20030126558 | Griffin | Jul 2003 | A1 |
| 20030131113 | Reeves et al. | Jul 2003 | A1 |
| 20030135490 | Barrett et al. | Jul 2003 | A1 |
| 20030140308 | Murthy et al. | Jul 2003 | A1 |
| 20030145275 | Qian et al. | Jul 2003 | A1 |
| 20030146937 | Lee | Aug 2003 | A1 |
| 20030149722 | Jolley et al. | Aug 2003 | A1 |
| 20030154401 | Hartman et al. | Aug 2003 | A1 |
| 20030167315 | Chowdhry et al. | Sep 2003 | A1 |
| 20030167455 | Iborra et al. | Sep 2003 | A1 |
| 20030182577 | Mocek | Sep 2003 | A1 |
| 20030187956 | Belt et al. | Oct 2003 | A1 |
| 20030200350 | Kumar et al. | Oct 2003 | A1 |
| 20030204481 | Lau | Oct 2003 | A1 |
| 20030212766 | Giles et al. | Nov 2003 | A1 |
| 20030216938 | Shour | Nov 2003 | A1 |
| 20030220913 | Doganata et al. | Nov 2003 | A1 |
| 20030220963 | Golovinsky et al. | Nov 2003 | A1 |
| 20030229501 | Copeland et al. | Dec 2003 | A1 |
| 20030229623 | Chang et al. | Dec 2003 | A1 |
| 20040003071 | Mathew et al. | Jan 2004 | A1 |
| 20040010719 | Daenen | Jan 2004 | A1 |
| 20040019650 | Auvenshine | Jan 2004 | A1 |
| 20040024812 | Park et al. | Feb 2004 | A1 |
| 20040030744 | Rubin et al. | Feb 2004 | A1 |
| 20040030795 | Hesmer et al. | Feb 2004 | A1 |
| 20040078371 | Worrall et al. | Apr 2004 | A1 |
| 20040098467 | Dewey et al. | May 2004 | A1 |
| 20040098606 | Tan et al. | May 2004 | A1 |
| 20040107360 | Herrmann et al. | Jun 2004 | A1 |
| 20040153451 | Phillips et al. | Aug 2004 | A1 |
| 20040162905 | Griffin et al. | Aug 2004 | A1 |
| 20040162906 | Griffin et al. | Aug 2004 | A1 |
| 20040167880 | Smith | Aug 2004 | A1 |
| 20040167899 | Patadia et al. | Aug 2004 | A1 |
| 20040205473 | Fisher et al. | Oct 2004 | A1 |
| 20040205557 | Bahrs et al. | Oct 2004 | A1 |
| 20040215650 | Shaji et al. | Oct 2004 | A1 |
| 20040230546 | Rogers | Nov 2004 | A1 |
| 20040236760 | Arkeketa et al. | Nov 2004 | A1 |
| 20040243824 | Jones | Dec 2004 | A1 |
| 20050021502 | Chen et al. | Jan 2005 | A1 |
| 20050021656 | Callegari | Jan 2005 | A1 |
| 20050050184 | Boden et al. | Mar 2005 | A1 |
| 20050060324 | Johnson et al. | Mar 2005 | A1 |
| 20050086206 | Balasubramanian et al. | Apr 2005 | A1 |
| 20050097008 | Ehring et al. | May 2005 | A1 |
| 20050198617 | Kim et al. | Sep 2005 | A1 |
| 20050256894 | Talanis et al. | Nov 2005 | A1 |
| 20050257267 | Williams et al. | Nov 2005 | A1 |
| 20060059107 | Elmore et al. | Mar 2006 | A1 |
| 20060085412 | Johnson et al. | Apr 2006 | A1 |
| 20060122882 | Brown et al. | Jun 2006 | A1 |
| 20060167858 | Dennis et al. | Jul 2006 | A1 |
| 20070083484 | McVeigh et al. | Apr 2007 | A1 |
| Number | Date | Country |
|---|---|---|
| 0 398 645 | Nov 1990 | EP |
| 1 256 889 | Nov 2002 | EP |
| 2360107 | Sep 2001 | GB |
| 2385969 | Sep 2003 | GB |
| 2002-528815 | Sep 2002 | JP |
| WO 9840987 | Sep 1998 | WO |
| WO 9840992 | Sep 1998 | WO |
| WO 9854644 | Dec 1998 | WO |
| WO 9957624 | Nov 1999 | WO |
| WO 0025214 | May 2000 | WO |
| WO0038078 | Jun 2000 | WO |
| WO0114962 | Aug 2000 | WO |
| WO 0167285 | Sep 2001 | WO |
| Number | Date | Country | |
|---|---|---|---|
| 20050081062 A1 | Apr 2005 | US |
| Number | Date | Country | |
|---|---|---|---|
| 60508427 | Oct 2003 | US |
