Electrical computers and digital processing systems: support – Multiple computer communication using cryptography – Protection at a particular protocol layer
Reexamination Certificate
1998-06-05
2004-04-06
Hayes, Gail (Department: 2131)
Electrical computers and digital processing systems: support
Multiple computer communication using cryptography
Protection at a particular protocol layer
C713S175000
Reexamination Certificate
active
06718470
ABSTRACT:
FIELD OF THE INVENTION
The invention relates generally to systems and methods for granting security privilege in a communication systems and more particularly to systems and methods for granting security privilege in communication systems employing cryptography based security, such as public key cryptography security systems.
BACKGROUND OF THE INVENTION
Information security is becoming increasingly important as more and more information is communicated over electronic communication links. Public key cryptography systems are well known as a mechanism for securely protecting digital information. Typically, public key certificates are used by a subscriber unit sending a message to a relying party unit, such as another subscriber or commercial institution or other entity. Generally, a subscriber unit may be for example a network computer node, a software application(s) or other entity communicating within a communication system or systems. A relying party unit may be a software application, computer node or other entity that relies on information associated with the subscriber unit.
Public key certificates, as known in the art, are data structures that serve as a vehicle by which public keys may be stored, distributed or forwarded over unsecured media without danger of undetectable manipulation. A certification authority is a trusted third party whose digital signature appears on the certificate and vouches for the authenticity of the public key bound to the subject subscriber sending the certificate.
Other data structures, such as attribute certificates, are intended to allow specification of information other than public keys so that the information may be conveyed in a trusted manner. Attributes certificates, as known in the art, may be associated with a specific public key by binding the attribute information (specific information), to the public key by the serial number of a corresponding public key certificate, or to a hash-value of the public key or certificate, or in any other suitable manner. Data appearing in the attribute certificate may include, for example, data representing limited liability resulting from a digital signature or a financial transaction, data representing a constraint of the use of a public key, such as whether the public key will be used during certain hours, or other suitable information. In some instances, attributes certificates may include data representing privileges for specific services of a relying party, such as a banking institution, software application parameters, or other suitable information. Privilege information may include, for example, the membership role of a subscriber where the subscriber is allowed specific access to certain information controlled by a relying party unit. Such privilege data may be useful, for example, in global communication networks; such as where a subscriber unit may only gain access to a specific site or section within a site reserved for employees only.
Several types of public key infrastructure systems exists. One type is sometimes referred to as an open public key infrastructure. In an open public key infrastructure system, a certificate is issued for a subscriber for a general purpose use, and not for a particular system or relying party. Typically, such systems do not include privilege data and do not authenticate a user based on privilege information, but typically only authenticate based on user identification data. Some open public infrastructure systems use access control lists that list users that are allowed to access services provided by a relying party or other subscribers. Generally, there is no implied privilege associated with a subscriber certificate until the subscriber is listed on the access control list. The certificates are such that any person or entity is entitled to receive a certificate, and the issuer of the certificate does not have any information about any subsequent relying parties to suitably restrict usage through certificate information.
A closed public key infrastructure system typically includes certification authorities that only grant certificates to subscribers within a defined group. Hence certificates are only issued to qualified subscribers, thereby eliminating the need for an access control list as used in typical open public key infrastructure systems. In closed public key infrastructure systems, the attribute certificates may be issued by a certificate issuing authority. Many attribute certificates may be issued for a given subscriber or one attribute certificate may include data representing many privileges for a given subscriber.
When a relying party unit, such as a software application, communicates with a subscriber, typical closed public key infrastructure systems require the subscriber to present all attribute certificates to the relying party. When sending the group of certificates to a relying party, some certificates may contain privilege data that is not needed by relying party and may include sending privilege information to a non-privileged party. In the case where many privileges are represented by privilege data within one certificate, sending the one certificate to a relying party may include sending privilege information to a non-privileged party. For example, a banking institution may receive an attribute certificate containing other privilege information such as a non-listed telephone number in the attribute certificate when the relying banking institution does not have privilege to obtain this information. Hence, security can be compromised.
In the instances where many attribute certificates have been issued to a subscriber unit, a relying party unit receiving multiple attributes certificates needs to process the information to determine which information within any one or more of the received attribute certificates is necessary to complete the transaction. This requires the use of unnecessary overhead in the transfer and evaluation of unnecessary information between a subscriber unit and a relying party unit. Moreover, if a subscriber wishes to operate in a different community, such as an employee of one company wishing to send information to an employee in a different company when the two companies use different attribute certificate structures, a subscribing party may have to send all attribute certificates to allow the other subscriber in the different community to obtain the necessary information to determine whether or not privilege should be granted to the subscriber.
Consequently, there exists a need for a system and method that facilitates granting of privilege in a selective manner to help reduce processing loads and to avoid communication of privileged data to non privileged parties.
REFERENCES:
patent: 5339403 (1994-08-01), Parker
patent: 5560008 (1996-09-01), Johnson et al.
patent: 5659616 (1997-08-01), Sudia
patent: 5717757 (1998-02-01), Micali
patent: 5757920 (1998-05-01), Misra et al.
patent: 5758069 (1998-05-01), Olsen
patent: 5774552 (1998-06-01), Grimmer
patent: 5815574 (1998-09-01), Fortinsky
patent: 5832211 (1998-11-01), Blakley et al.
patent: 5894556 (1999-04-01), Grimm et al.
patent: 5899990 (1999-05-01), Maritzen et al.
patent: 5903882 (1999-05-01), Asay et al.
patent: 5987134 (1999-11-01), Shin et al.
patent: 6006333 (1999-12-01), Nielsen
patent: 6044466 (2000-03-01), Anand et al.
patent: 6088805 (2000-07-01), Davis et al.
patent: 6105027 (2000-08-01), Schneider et al.
patent: 6108788 (2000-08-01), Moses et al.
patent: 6115040 (2000-09-01), Bladow et al.
patent: 6141760 (2000-10-01), Abadi et al.
patent: 6182229 (2001-01-01), Nielsen
patent: 6189096 (2001-02-01), Haverty
patent: 6275941 (2001-08-01), Saito et al.
patent: 6339830 (2002-01-01), See et al.
patent: 6484258 (2002-11-01), Haverty
patent: 6574655 (2003-06-01), Libert et al.
patent: WO 95/22810 (1995-08-01), None
patent: WO 00/10303 (2000-02-01), None
Pretty, Lisa “Attribute Certificates”, www.baltimore.com, crsc.nist.gov/pki/twg/presentations/twg-99-67.pdf.*
Press, Jim “Secure Transfer of Identity and Privilege Attributes in an Open Systems Environment” use
Entrust Technologies Limited
Hayes Gail
Revak Christopher
Vedder Price Kaufman & Kammholz P.C.
LandOfFree
System and method for granting security privilege in a... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with System and method for granting security privilege in a..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and System and method for granting security privilege in a... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-3235195