Methods and apparatus for access control in service-oriented computing environments

1. In a service-oriented environment comprising a plurality of services, a method for authenticating a client, the method comprising the steps:

a client invoking a composite service, the composite service comprising a plurality of different services and different principles, wherein the principles are entities that invoke the different services of the composite service;

maintaining state information comprising an identify of at least one service that is associated with the composite service; and

using the state information to enforce access control on invocation of the at least one service,

wherein at least a portion of the state information is stored in the form of a composite principle, wherein the composite principle comprises a temporally ordered sequence of the different principles that are responsible for nested invocation of the different services associated with the composite service, and

wherein using the state information to enforce access control on invocation of the at least one service comprises:

obtaining one or more rules that are used to determine if the client can invoke the composite service, wherein the one or more rules define access control policies which are specified using a pure-past linear temporal logic based specification language having past time temporal operators, and which support a temporal predicate on the composite principle; and

processing the one or more rules against the composite principle to verify whether invocation of the composite service by the client satisfies the one or more rules.

2. The method of claim 1 , wherein at least a portion of the state information is stored in the form of an audit/logging service.

3. The method of claim 1 , wherein the access control policies are stored in a policy database.

4. The method of claim 1 , wherein the client is authenticated based on an access control decision.

5. The method of claim 4 , wherein the access control decision is made in accordance with at least one temporal predicate on the composite principle.

6. The method of claim 4 , wherein the access control decision is made in accordance with at least one scoped access control rule.

7. The method of claim 4 , wherein the access control decision is made in accordance with at least one role translation.

8. The method of claim 4 , wherein the access control decision is made in accordance with at least one scoped role.

9. The method of claim 4 , wherein the access control decision is made in accordance with at least one Boolean predicate.

10. The method of claim 4 , wherein the access control decision is made in accordance with at least one constraint.

11. The method of claim 10 , wherein the at least one constraint comprises one or more of a role constraint, a privilege constraint, a Boolean constraint, a separation of duty constraint and a scope constraint.

12. An article of manufacture for authenticating a client in a service-oriented environment comprising a plurality of services, the article comprising a computer readable tangible storage medium containing one or more computer programs, which when executed implement the steps of claim 1 .

13. In a service-oriented environment comprising at least one service, a method for access control, the method comprising the steps of:

providing a rule specification language, wherein said rule specification language is based on pure-past linear temporal logic having past time temporal operators;

specifying at least one rule using the rule specification language, wherein the rule is used for determining whether a client can access a composite service, the composite service comprising a plurality of different services and different principles, wherein the principles are entities that invoke the different services of the composite service;

verifying whether an invocation of the composite service by the client satisfies the at least one rule; and

granting the client access to the composite service if the invocation of the composite service by the client satisfies the at least one rule,

wherein said rule specification language supports a temporal predicate on at least one composite principle, wherein the composite principle comprises a temporally ordered sequence of the different principles that are responsible for nested invocation of the different services associated with the composite service.

14. The method of claim 13 , wherein said rule specification language further supports at least one of: a scoped access control rule; a role translation; a scoped role, a Boolean predicate; a temporal constraint; a role constraint; a privilege constraint; a Boolean constraint; a separation of duty constraint, and a scope constraint.

15. An article of manufacture for authenticating a client in a service-oriented environment comprising a plurality of services, the article comprising a computer readable tangible storage medium containing one or more computer programs, which when executed implement the steps of claim 13 .

16. Apparatus for authenticating a client in a service-oriented environment comprising a plurality of services, the apparatus comprising:

a memory; and

at least one processor coupled to the memory and operative to:

invoke a composite service, the composite service comprising a plurality of different services and different principles, wherein the principles are entities that invoke the different services of the composite service;

maintain state information comprising an identify of at least one service that is associated with the composite service; and

use the state information to enforce access control on invocation of the at least one service,

wherein at least a portion of the state information is stored in the form of a composite principle, wherein the composite principle comprises a temporally ordered sequence of the different principles that are responsible for nested invocation of the different services associated with the composite service, and

wherein in using the state information to enforce access control on invocation of the at least one service, the at least one processor is further operative to:

obtain one or more rules that are used to determine if the client can invoke the composite service, wherein the one or more rules define access control policies which are specified using a pure-past linear temporal logic based specification language having past time temporal operators, and which support a temporal predicate on the composite principle; and

process the one or more rules against the composite principle to verify whether invocation of the composite service by the client satisfies the one or more rules.

17. Apparatus for access control in a service-oriented environment comprising a plurality of services, the apparatus comprising:

a memory; and

at least one processor coupled to the memory and operative to:

provide a rule specification language, wherein said rule specification language is based on pure-past linear temporal logic having past time temporal operators;

specify at least one rule using the rule specification language, wherein the rule is used for determining whether a client can access a composite service, the composite service comprising a plurality of different services and different principles, wherein the principles are entities that invoke the different services of the composite service;

verify whether an invocation of the composite service by the client satisfies the at least one rule; and

grant the client access to the composite service if the invocation of the composite service by the client satisfies the at least one rule,

wherein said rule specification language supports a temporal predicate on at least one composite principle, wherein the composite principle comprises a temporally ordered sequence of the different principles that are responsible for nested invocation of the different services associated with the composite service.