System and method for implementing a secure web application entitlement service

摘要

System and method for implementing a secure web application entitlement service are described. One embodiment of the system comprises a plurality of entitlement point records each comprising a unique identifier associated therewith such that each of the enforcement point records can be associated with an enforcement point within an application; an identity service (“IS”) configured to provide a first token for enabling a user to access the application; an access gateway configured to provide a second token, the second token including a list of at least a portion of the unique identifiers; an entitlement server (“ES”) configured to receive an entitlement request from the application, the entitlement request including the second token, the ES further configured to associate the entitlement request with a user-authenticated session in the IS; and a policy decision point (“PDP”) configured to receive the list of at least a portion of the unique identifiers and to render a decision on the entitlement request based at least in part on policy information associated with ones of the enforcement point records identified by the unique identifiers of the list and attribute information from the IS; wherein subsequent to the rendering of a decision by the PDP, the decision is communicated to the application.

主权项

1. A secure web application entitlement service comprising:
a plurality of entitlement point records each comprising a unique identifier that permits each of enforcement point records to be associated with an enforcement point within an application; an identity service (“IS”) configured to provide a first token for enabling a user to access the application; an access gateway configured to provide a second token, the second token including a list of at least a portion of the unique identifiers; a hardware server having an entitlement server (“ES”) to receive an entitlement request from the application, the entitlement request including the second token, the ES further configured to link a protected indicator for a user-authenticated session with the application to the entitlement request in the IS and include a digital signature of the application with the second token; and a policy decision point (“PDP”) configured to receive the list of at least a portion of the unique identifiers and to render a decision on the entitlement request based at least in part on policy information associated with ones of the enforcement point records identified by the unique identifiers of the list and attribute information from the IS, the attribute information dictated by the policy information and the PDP is configured to provide compliance events to a compliance enforcer that is configured to correlate the compliance events and compare against a best practice policy with deviations arising from a manner in which the ES, PDP, and the application are interoperating resulting in mitigation actions by the compliance enforcer, wherein at least one action, processed by the compliance enforcer, directs the user-authenticated session to a honeypot based on a particular deviation that occurs after the user-authenticated session was established and the at least one action based on a particular compliance event that is permitted by some of the policy information but overridden to be impermissible based on other ones of the compliance events and thereby producing the particular deviation; wherein subsequent to the rendering of a decision by the PDP, the decision is communicated to the application; andthe compliance enforcer for correlating and analyzing the compliance events received from at least one of the PDP, ES, and the application and, based on the correlating and analyzing, determining whether the mitigation actions are necessary.