Sap Ag

Sap Se

Maarten E Rits

Pascal T C Spadone

Laurent Y Gomez

Jochen Haller

Cedric R J Hebert

Yevgen Reznichenko

Cédric R J Hébert

Cédric S P Ulmer

Faisal Abdul Kadir

Mohammed Ashiqur Rahaman

Benjamin De Boe

A computer-implemented method for executing a workflow is described, wherein the workflow comprises a set of individual activities, the method comprising the operations of deriving a global workflow access type and receiving a request to execute a workflow. Execution of access control based on the global workflow access type is performed. If access is allowable, the user is authorized to execute all activities belonging to the workflow. If access is not allowable, the user is rejected before executing the workflow.

Optimization of workflow access control

A method and system to control an interaction of a plurality of participants in a workflow process. The method classifies the plurality of activities as (1) first activity of the workflow process, (2) first activity of a participant in an on-going workflow process, and (3) interaction activity. A set of access control policies is generated for each type of activity. The policies include workflow initialization policy, participation policy and interaction policies. The policies determine if a requesting participant is permitted to interact with a responding participant. In addition, the system includes a policy enforcement point for receiving a request from a requesting participant, wherein the request is for activating an activity of a responding participant. The policy enforcement point forwards the request to a policy decision point where the request is evaluated based on the set of access control policies.

Automated generation of access control policies in cross-organizational workflow

There is provided a computer-implemented method, computer-program product, system and security index structure for a security enforcement strategy for a composite application. The method comprises providing a workflow for the composite application, wherein the composite application is constructed from a set of sub-applications and wherein at least a plurality of the sub-applications has a policy. A consolidated workflow policy is generated for the workflow by combining the policies of the sub-applications and by taking into account a control flow of the workflow, wherein the control flow provides an order in which the set of sub-applications are performed. The consolidated workflow policy is enforced by providing a security index structure for the consolidated workflow policy adapted for checking authorization in the workflow.

Workflow authorizations evaluation in multi-layered applications

A system may include an attack preventing creator module that is configured to create at least one attack preventing head block for a message having message elements in a tree structure with one or more of the message elements being signed, wherein the attack preventing header block includes structure specific information that comprises at least a digest value of a pre-order traversal list of the tree structure and for each signed message element a unique ID attribute, a depth, a parent's name and a parent's ID attribute. The system may include an attack preventing verifier module that is configured to verify the at least one attack preventing header block by comparing the structure specific information which can be derived from the message with the structure specific information carried by the first attack preventing header block.

Method and system for protecting a message from an XML attack when being exchanged in a distributed and decentralized network system

Secure message transfer of at least one message from a sender to a receiver within a network system may be provided. For example, a message structure information regarding the at least one message may be computed on a sender-side and according to a pre-given scheme. The computed message structure information may be added as message account information into the at least one message to be sent. The message account information may be protected by a signature. The at least one message may be transferred through the network system to the receiver. On a receiver-side, the message account information may be validated after reception of the at least one message and according to the pre-given scheme.

Method and a system for protecting path and data of a mobile agent within a network system

The present description refers to a method for protecting data of a mobile agent (MA) from a first server (A) which are intended for at least one second server (B) within a network system against an attack and an unauthorized access, wherein the first server (A) as well as the at least one second server (B) have a pair of a public key (KA, KB) and a private key (PKA, PKB) associated therewith, respectively, the method comprising, starting from the first server, at least the steps of choosing an unique number (r0) and assigning it to the mobile agent (MA), choosing a secret symmetric key (SKo) and assigning it to the data (mB) to be protected, encoding the secret key (SKo) with the public key (KB) of the second server (B), encrypting the secret key (SKo) and the public key (KA) of the first server via a cryptographic wrapping function (h), thus forming a data authentication code (h(KA, SKo)), encoding the data (mB) with the secret key (SKo), and combining the unique number (r0), the encoded data ({mB}SKo) and the data authentication code (h (KA, SKo)) and encoding that combination with the private key (PKA) of the first server (A), thus forming a nested structure to be decoded successively for access to the data (mB).

Method and system for protecting data of a mobile agent within a network system

A method, a system, and a computer program product for access control using resource filters for a strict separation of application and security logic are described. The computer-implemented method for access control may include receiving at least one access request to at least one resource from an application; providing a resource hierarchy for the at least one resource, the resource having at least one resource class, wherein the resource hierarchy is defined in a single resource; providing a policy comprising at least one access control rule for accessing at least one element of the at least one resource class; verifying the at least one access request based on the policy through an authorization service; and processing the at least one access request through a service interface.

Method and system for securely extending a path of a mobile agent within a network system

Method and system for providing a secure message transfer within a network system

Systems and methods for reverse engineering access control include determining a set of potential access control target methods, functions and/or subroutines that may be used in software applications. A software application is then analyzed to determine if the access control targets are present in the software application. If an access control target is used by the software application, then the access control policy for the target is analyzed to determine the roles, privileges, or rights that are necessary to successfully execute the access control target. A report is then generated that provides information about the access control policy elements actually used by the software application.

Reverse engineering access control

There is proposed a method for executing a workflow, comprising providing the workflow comprising process level activities, at least one process level activity being able to access system resources, the access to the system resources being mediated by a plurality of backend modules. A backend module of the plurality of backend modules carries out the steps of receiving a hierarchical attribute certificate, validating the attribute certificate, checking whether the attribute certificate grants a right to execute the backend module, checking whether a predefined execution path from the process level activity to the backend module has been traversed, and if both checking steps are successful, executing the backend module. Moreover, there is proposed a respective device, computer program medium and computer program product.

Controlled path-based process execution

The present description refers to a method for securing processing of an order by a mobile agent from a first server (S) within a network system with a plurality of servers (S, S, . . . ,S), at least a number of which the mobile agent has to pass according to an appropriate succession, wherein each of the plurality of servers has a pair of a public key (KS, . . . ,KS, . . . , KS) and a private key (PKS, . . . ,PKS, . . . , PKS) associated therewith, respectively, the method comprising, starting from any one of the number of servers the mobile agent has to pass, called herein the i'th server at least the steps of receiving the mobile agent which has been prepared by the first server by choosing a unique number (r0) and assigning it to the mobile agent, encoding the chosen unique number (r0) with the private key (PKS) of the first server (S), thus forming an agent specific initialisation number (C) as basis for a sequence of checksums (C, . . . ,C, . . . ,C) to be computed successively by the number of servers (S, S, . . ., S), sending the mobile agent together with its initialisation number (C) on its route through the network system for processing the order passing thereby the number of servers (S, S, . . . ,S) successively, and initiating each server (S, . . . ,S) from which the mobile agent intends to take data with it when passing that server to encode the initialisation number (C) together with the data with the respective server's private key (PKS, . . . ,PKS, . . . , PKS) and to compute therewith a new server specific checksum (C, . . . ,C, . . . ,C) using the public key (KS) of the first server (S) and the checksum (C, . . . ,C, . . . ,C) computed by the server (S, . . . ,S) right before in the succession.

Method and a system for securing processing of an order by a mobile agent within a network system

A method for automatically filling an electronic timesheet includes extracting one or more calendar entries from an electronic calendar and matching each calendar entry of the one or more calendar entries to a corresponding project of a list of projects. An electronic timesheet is then filled based on each calendar entry matched with the corresponding project.

Growing community of inventors

Nice, France

Maarten E Rits