Electrical computers and digital processing systems: support – Multiple computer communication using cryptography – Protection at a particular protocol layer
Reexamination Certificate
1997-12-08
2001-03-13
Butler, Dennis M. (Department: 2787)
Electrical computers and digital processing systems: support
Multiple computer communication using cryptography
Protection at a particular protocol layer
C709S229000, C709S237000
Reexamination Certificate
active
06202157
ABSTRACT:
BACKGROUND OF THE INVENTION
The invention relates generally to computer network security systems and more particularly to computer network security systems and methods having enforceable policy provisions.
Computer network security systems such as those employing public key cryptography techniques to encrypt and decrypt data, typically use a certification authority, such as a network server, to generate certificates that are used by network nodes to verify, among other things, that other communications sent by users are valid. Computer network security systems are known which allow network nodes to have several software applications that use the same security enforcement rules by having a cryptographic application which is accessible by each of the applications. For example, an E-mail application may access the cryptographic engine to encrypt E-mail messages. Likewise a financial document generation application may also allow access to the cryptographic engine to encrypt financial documents that may be transferred over communication links.
Conventional systems typically hard code security policy rules in the network nodes so that a node requires upgraded software each time a security officer changes a policy rule. Some global policies include for example a lifetime of a password, whether or not passwords can be reused, password length, the type of cryptographic keys allowable for a particular node and other policies. Hard-coded policy rules become cumbersome and can be costly to change in large systems. Moreover, such systems do not typically allow differing policies to be set for differing nodes or for differing environments, such as corporate email systems run on several servers and nodes in various organizations.
Some systems allow non-hard coded policy provisions to be used, but such systems do not typically allow the policy provisions to be definable through a centralized authority. It is desirable to have central control to institute policies to facilitate a more controlled environment particularly where a compromised communication can cause great damage to members of the network.
However, it is also desirable to provide policy flexibility in instances where policy rules need to be changed on a per application and/or per node basis. For example, where a node is used by a temporary employee or where the node is used by a user requiring a very high level security or high-security application, differing lengths of passwords or password life times may be necessary for each of the independent network nodes or applications.
Some systems employ attribute certificates to allow specification of information (attributes) other than public keys (but related to a certificate issuing authority, entity or public key), so that it is conveyed in a trusted manner to a relying party. Attribute certificates are conventionally associated with a specific signature public key by binding the attribute information to the key by the method by which the key is identified. For example the binding may be by the serial number of a corresponding public key certificate, or to a hash-value of the public key or certificate.
Typically, attributes may be signed by an attribute certificate authority, created in conjunction with an attribute registration authority, and distributed in conjunction with an attribute directory service. More generally, any party with a signature key and appropriate recognizable authority may create an attribute certificate. Typically, such attribute certificates are associated with a signature public key and forwarded by a party with a signed message to a relying party that verifies the signature on the received message and uses the attribute certificate to verify proper authority associated with the signature key. One known application is to certify authorization or privilege information related to a public key. More specifically, this may be used, for example, to limit liability resulting from a digital signature, or to constrain the use of a public key (e.g., to transactions of limited values, certain types, or during certain hours). However, such methods can unnecessarily increase system overhead and complexity since the attribute certificates are generally associated with a public key and must be verified by a relying party before a privilege is honored.
Consequently there exists a need for a computer network security system and method having enforceable security policy provisions that allows flexibility from a centralized authority to ensure more consistent control and implementation of the policies while offering flexibility to change policies when needed. Such a system should also allow enforcement of the policies to occur at the network nodes to help reduce overhead requirements of a central authority.
REFERENCES:
patent: 5148481 (1992-09-01), Abraham et al.
patent: 5164988 (1992-11-01), Matyas et al.
patent: 5204961 (1993-04-01), Barlow
patent: 5218676 (1993-06-01), Ben-Ayed et al.
patent: 5265164 (1993-11-01), Matyas et al.
patent: 5315657 (1994-05-01), Abadi et al.
patent: 5577209 (1996-11-01), Boyle et al.
patent: 5606668 (1997-02-01), Shwed
patent: 5621889 (1997-04-01), Lermuzeaux et al.
patent: 5671279 (1997-09-01), Elgamal
patent: 5745574 (1998-04-01), Muftic
patent: 5828832 (1998-10-01), Holden et al.
patent: 5848161 (1998-12-01), Luneau et al.
patent: 5903652 (1999-05-01), Mital
patent: 5903878 (1999-05-01), Talati et al.
patent: 5987611 (1999-11-01), Freund
patent: 6061796 (2000-05-01), Chen et al.
patent: 6067620 (2000-05-01), Holden et al.
Brownlie Michael
Hillier Stephen
Van Oorschot Paul C.
Butler Dennis M.
Entrust Technologies Limited
Mai Rijue
Markison & Reckamp, P.C.
LandOfFree
Computer network security system and method having... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Computer network security system and method having..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Computer network security system and method having... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-2508937