Bea Systems, Inc.

Oracle International Corporation

Paul B Patrick

Jason Howes

Matthew Mihic

Ashok Aletty

Mingde Xu

Tolga Urhan

David Byrne

Mark A Falco

Richard J Riendeau

Chet Kapoor

Kenneth D Yagen

Jayaram Rajan Kasi

Mesut Gunduc

Juan Manuel Andrade

Jeff Michaud

Adam Bosworth

Naveen Gupta

Jay Kasi

Jayaram Kasi

A system and method for providing an infrastructure that can be provisioned for use with dynamic business applications. In accordance with an embodiment, the business application infrastructure comprises a plurality of drop-in components which can be added or provisioned as necessary to create a dynamic business application. For example, an integrated composition environment component can be provisioned to allow end-users to quickly develop business applications from an overall business process perspective. In accordance with other embodiments, the business application infrastructure can incorporate additional components as necessary to better support a particular business application, or a particular execution environment.

System and method for an infrastructure that enables provisioning of dynamic business applications

A system, method and media for a service oriented architecture. This description is not intended to be a complete description of, or limit the scope of, the invention. Other features, aspects and objects of the invention can be obtained from a review of the specification, the figures and the claims.

Secure service oriented architecture

Liquid computing can include using a service bus to interact with a number of heterogeneous systems.

Liquid computing

In accordance with one embodiment of the present invention, there are provided mechanisms and methods for securing access to data. These mechanisms and methods for securing access to data make it possible for systems to have improved control over accesses to information by redacting responses made by services based upon access policies. Requestors may be users, proxies or automated entities. This ability of a system to redact responses to queries or requests for services in accordance with access policies makes it possible to attain improved security in computing systems over conventional access control mechanisms that control based upon privileges for accessing a file, an account, a storage device or a machine upon which the information is stored.

Security data redaction

A pluggable architecture allows security and business logic plugins to be inserted into a security service hosted by a server, and to control access to one or more secured resources on that server, on another server within the security domain, or between security domains. The security service may act as a focal point for security enforcement, and access rights determination, and information used or determined within one login process can flow transparently and automatically to other login processes. Entitlements denote what a particular user may or may not do with a particular resource, in a particular context. Entitlements reflect not only the technical aspects of the secure environment (the permit or deny concept), but can be used to represent the business logic or functionality required by the server provider. In this way entitlements bridge the gap between a simple security platform, and a complex business policy platform.

System and method for dynamic role association

A system and method for supporting Service Networks in a SOA environment. In accordance with an embodiment, the principles governing the topology of computer networks can be similarly applied to the service space&#x2014;from small federated Service Segments (or sub-domains), to large public federated Service Domains. At the heart of the Service Network are one or more Service Routers, that are themselves responsible for transparently bridging between federated Service Segments. The Service Routers determine where services reside in the Service Network and, based on routing information gathered through interaction with other Service Routers, Network Routers and other mechanisms, deliver service requests, using optimal routes, from a source Service Segment to the target Service Segment. Working in concert with the Service Router, an Enterprise Service Bus (ESB) can abstract the location of services, and hide the existence of the Service Network from service requestors.

System and method for supporting service networks in a service-oriented architecture environment

A system, method and media for service infrastructure that enables dynamic service composition and orchestration. This description is not intended to be a complete description of, or limit the scope of, the invention. Other features, aspects and objects of the invention can be obtained from a review of the specification, the figures and the claims.

Dynamic service composition and orchestration

The invention provides a software component plugin framework. The system described supports dynamic loading, instantiation, and unloading of interface implementations (plugin modules), together with encapsulation of these interface implementations. The many benefits provided by the invention include software reuse, interoperability and fast product development cycles.

System and method for software component plug-in framework

A system, method and media for dynamically redacting data based on the evaluation of one or more policies. In one embodiment, the method comprises receiving a request to access one or more resources, receiving responses from the one or more resources and assembling a result set which includes several portions of data, determining current access policies for the requestor to the one or more resources, and redacting from the result set a portion of the data that the requestor is not permitted to receive, based on the current access policies.

System and method for dynamic data redaction

A system, method and media for a service oriented architecture, including in one embodiment, a method for configuring a service proxy, comprising configuring a transformation between a reception protocol and a transmission protocol, configuring a potential message processing path capable of processing a message that has been received with the reception protocol, providing the message for transmission to the transmission protocol, wherein the potential message processing path includes a message processing node capable of processing the message, and wherein the message processing node implements an interface and/or a protocol that is compatible with the service proxy. Other features, aspects and objects of the invention can be obtained from a review of the specification, the figures and the claims.

Dynamically configurable service oriented architecture

A computer-implemented system and method for policy inheritance, comprising, defining a first group wherein the first group refers to at least one of: a user and a group different from the first group, defining a second group wherein the second group is nested within the first group, defining a first policy wherein the first policy includes a resource, a subject and one of, an action and a role, and wherein the subject includes the first group, inheriting the first policy by the second group, wherein the resource is part of a resource hierarchy, and wherein the first policy can be used to control access to the resource.

Policy inheritance through nested groups

A method for adaptively authenticating a subject based on authentication information, comprising the steps of providing for the receipt of the authentication information; providing for the performance of Java Authentication and Authorization Service (JAAS) authentication of the subject based on the authentication information and wherein successful authentication of the subject results in the association of a principal with the subject; providing for the signing of the principal by determining an authentication code for the principal that is a function of the principal and a key.

System and method for authenticating a subject

A method for adaptively authenticating a subject, said method adapted to cooperate with a security provider interface hierarchy, said method comprising the steps of providing for the implementation of an authentication interface adapted to extend and implement at least a portion of the security provider hierarchy, providing for the authentication of the subject when so directed by the authentication interface, and providing for the association of a signed principal with the subject upon the successful authentication of the subject.

System and method for enterprise authentication

A system for distributing information from a first process to one or more security service modules. The system comprises a remote interface, capable of accepting first information from the first process, and a provisioning service provider (PSP) coupled to the remote interface. The PSP can obtain the first information from the remote interface, and also can provide second information to a local interface. The second information is based on the first information and is tailored for the one or more security service modules. The local interface can provide the second information to the one or more security service modules and the one or more security service modules can accept the second information and perform at least one of the following: adjust a configuration of the one or more security service modules to reflect the second information, and protect access to at least one resource based on the second information.

Security control module

A method for providing a security provider for a client comprises providing a service provider interface, that is compatible with a security framework layer, and one or more services. The one or more services include at least one of, authentication, authorization, auditing, role mapping and credential mapping. The one or more services can be exposed through the service provider interface and the framework layer can expose the one or more services to an application program interface.

Growing community of inventors

Manchester, NH, United States of America

Paul B Patrick