A system and method for providing security to a graph of interconnected nodes includes a grouping multiplexing layer configured to monitor calls to the system, a graphing dynamic link layer configured to transmit and receive data to and from the graph, and a group security manager coupled to the grouping multiplexing layer and coupled to the graphing dynamic link layer; the group security manager is configured to perform security-related acts via interacting with a group database to propagate security-related information to members of a group within the graph. The group security manager is configured to provide role-based authorization on publication of one or more records and provide membership control for admission to a graph of interconnected nodes. The group security manager provides membership control by providing credentials to potential members of the graph to enable a connection and by providing a governed system for renewal and revocation of members.
1. A method for a member in a group within a graph of interconnected peer nodes to renew a certificate granting privileges, the method comprising:
receiving a request to renew the certificate, wherein the certificate is published in a graph database;
performing renewal of the published certificate according to an authorization from an administrator or based on one or more security policies;
contacting one or more authorized members with a shorter chain in the graph of interconnected nodes before contacting authorized members with a longer chain in the graph of interconnected nodes; and
performing one or more renewal attempts to achieve a chain that is of shorter length, wherein number of renewal attempts are proportional to length of the chain; and if a chain is beyond a predetermined length, performing an offline renewal to shorten the chain.
2. The method of claim 1 wherein more than one authorized member in the group is active, each authorized member in the group enabled to process the renewal request, the method further comprising:
providing each authorized member in the group with a random back-off period prior to attempting to process the renewal request, the random back-off proportional to a length of the chain of the authorized member.
3. A method for ensuring that a publisher of information in a record to a secure group in a graph of interconnected nodes has authority to publish to the secure group, the method comprising:
creating a token for the publisher, the token containing information located in a role assigned to the publisher, the role identifying privileges of the publisher; and
matching the token against a security descriptor for the record to be published, the security descriptor providing a list of rights associated with each role, wherein the token is published in a graph database, the graph database makes available security related information including the published token to each member of the secure group,
wherein the graph database enables deferred record validation by enabling a group member to defer until required security information is available to the group member.
4. A computer storage media having computer-executable instructions storage thereon to perform acts for a member in a group within a graph of interconnected peer nodes to renew a certificate granting privileges, the computer-executable instructions performing acts comprising:
receiving a request to renew the certificate, wherein the certificate is published in a graph database;
performing renewal of the published certificate according to an authorization from an administrator or based on one or more security policies;
contacting one or more authorized members with a shorter chain in the graph of interconnected nodes before contacting authorized members with a longer chain in the graph of interconnected nodes; and
performing one or more renewal attempts to achieve a chain that is of shorter length, wherein number of renewal attempts are proportional to length of the chain; and
if a chain is beyond: a predetermined length, performing an offline renewal to shorten the chain.
5. The computer-readable medium of claim 4 wherein more than one authorized member is the group is active, each authorized member in the group enabled to process the renewal request, the method further comprising:
providing each authorized member in the group with a random back-off period prior to attempting to process the renewal request, the random back-off proportional to a length of the chain of the authorized member.
6. A computer storage media having computer-executable instructions stored thereon to perform acts for ensuring that a publisher of information in a record to a secure group in a graph of interconnected nodes has authority to publish to the secure group, the computer-executable instructions performing acts comprising:
creating a token for the publisher, the token containing information located in a role assigned to the publisher, the role identifying privileges of the publisher; and
matching the token against a security descriptor tbr the record to be published, the security descriptor providing a list of rights associated with each role, wherein the token is published in a graph database, the graph database makes available security related information including the published token to each member of the secure group;
wherein the graph database enables deferred record validation by enabling a group member to defer until required security information is available to the group member.