Cross Domain Security Information Conversion via Canonical Format
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cross domain security information mapping techniques are inefficient, require extensive programming, and are not easily extensible, often resulting in poorly written and unreliable systems that can bring down entire systems due to errors, despite only a small portion of security information being needed for access.
Innovation Solution
The solution involves receiving security information in a native format from a first security domain, translating it to a canonical format, transforming it using a predefined mapping to a second security domain, and then translating it back to the native format of the second domain, employing procedural software functions and XSL mappings for efficient and robust conversion.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If conventional mapping techniques use a shared library or plug-in architecture with traditional programming languages, then security information mapping can be performed, but the system becomes difficult to extend and requires extensive programming
Solution Approach 1:
The patent introduces an intermediary mapping framework that sits between different security information formats. This framework uses standardized intermediate representations and mapping templates to translate between formats without requiring direct programming for each format pair, thereby improving extensibility while reducing complexity.
Solution Approach 2:
The patent employs template-based mapping where common mapping patterns are copied and reused across different security information formats. Instead of writing unique mapping code for each format combination, developers can replicate and adapt existing mapping templates, significantly reducing programming effort and improving extensibility.
2Reliability
If conventional mapping techniques require extensive programming, then mapping functionality can be achieved, but the system becomes unreliable and prone to segmentation faults
Solution Approach 1:
The patent implements error handling and validation mechanisms beforehand in the mapping framework. By pre-defining error boundaries, validation rules, and fallback mechanisms in the mapping templates, the system prevents segmentation faults and other critical errors before they can crash the entire system, thereby improving reliability without requiring more programming.
Solution Approach 2:
The intermediary mapping framework acts as a buffer between different security information formats, isolating potential errors to the mapping layer rather than allowing them to propagate through the entire system. This mediator approach contains faults locally and improves overall system reliability.
3Productivity
If conventional mapping techniques map all security information, then complete information is available, but the process becomes inefficient when only a small portion is needed
Solution Approach 1:
The patent enables selective extraction of only the necessary security information elements needed for access control. The mapping framework allows specifying which fields to extract and transform, rather than mapping entire security information structures. This improves efficiency by processing only relevant data while maintaining completeness of the required information.
Solution Approach 2:
The patent implements partial mapping where only the subset of security information needed for a specific access control decision is mapped and transformed. Rather than performing complete mapping of all security information fields, the system performs just enough mapping to satisfy access requirements, improving productivity without losing necessary information.
Data Source
AI summary
Methods, systems, and computer program products are provided for cross domain security information conversion. Embodiments include receiving from a system entity, in a security service, security information in a native format of a first security domain regarding a system entity having an identity in at least one security domain; translating the security information to a canonical format for security information; transforming the security information in the canonical format using a predefined mapping from the first security domain to a second security domain; translating the transformed security information in the canonical format to a native format of the second security domain; and returning to the system entity the security information in the native format of the second security domain.