Method and apparatus for issuing a credential for an incident area network

• US 10,104,526 B2
• Filed: 06/01/2016
• Issued: 10/16/2018
• Est. Priority Date: 06/01/2016
• Status: Active Grant

• Current Assignee: Motorola Solutions, Inc.
• Original Assignee: Motorola Solutions, Inc.
• Inventors: Metke, Anthony R., Lewis, Adam C., Thomas, Shanthi E.
• Primary Examiner(s): Cervetti, David Garcia
• Application Number:
  US15/170,683
• Publication Number:
  US 20170353451A1
• Time in Patent Office: 867 Days
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/61 Time-dependent
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 4/90 Services for handling of emergency or hazardous situations, e.g. earthquake and tsunami warning systems [ETWS]

Abstract

A method and apparatus for issuing an incident-issued credential for an incident area network. One embodiment provides an identity server including an electronic processor configured to receive an agency-issued credential and retrieve a first set of attributes from the agency-issued credential. The electronic processor is also configured to map the first set of attributes to a scope of a service available through an incident area network. The electronic processor is further configured to generate the incident-issued credential for the incident area network including the scope and issue the incident-issued credential to a user device.

Claims

1. An identity server comprising:

an electronic processor configured to

receive an agency-issued credential, wherein the agency-issued credential includes attributes that specify a user device'"'"'s authenticity, authority, rights, or combination thereof,

retrieve a first set of attributes from the agency-issued credential,

map the first set of attributes to a scope of a computer-based service available through an incident area network,

generate an incident-issued credential for the incident area network including the scope of the computer-based service available through the incident area network, and

issue the incident-issued credential to the user device.

2. The identity server of claim 1, wherein the electronic processor is further configured to map the first set of attributes to a second set of attributes, wherein the incident-issued credential includes the second set of attributes.

3. The identity server of claim 2, wherein the second set of attributes includes an incident command system attribute.

4. The identity server of claim 2, wherein the electronic processor is configured to map the first set of attributes to the scope based on the second set of attributes.

5. The identity server of claim 2, wherein the electronic processor is configured to map the first set of attributes to the second set of attributes based on a context of an incident associated with the incident area network, the context including at least one selected from the group consisting of a type of the incident, a size of the incident, a condition of the incident, a location of the incident, a time of day, a number of resources at the incident, a type of resource at the incident, and a needed but missing resource at the incident.

6. The identity server of claim 1, wherein the electronic processor is configured to map the first set of attributes to the scope based on a context of an incident associated with the incident area network, the context including at least one selected from the group consisting of a type of the incident, a size of the incident, a condition of the incident, a location of the incident, a time of day, a number of resources at the incident, a type of resource at the incident, and a needed but missing resource at the incident.

7. The identity server of claim 1, wherein the agency-issued credential is associated with a user of the user device and wherein the electronic processor is further configured to prompt the user device for data identifying the user device and map the first set of attributes to the scope based on the data identifying the user device.

8. The identity server of claim 1, wherein the agency-issued credential is associated with a user of the user device and wherein the first set of attributes includes at least one selected from the group consisting of a level of capability of the user, a level of qualification of the user, and a level of training of the user.

9. The identity server of claim 1, wherein the agency-issued credential is a first agency-issued credential and is associated with a user of the user device and wherein the electronic processor is further configured to receive a second agency-issued credential associated with the user device and wherein the electronic processor is configured to map the first set of attributes to the scope based on the first agency-issued credential and the second agency-issued credential.

10. The identity server of claim 9, wherein the second agency-issued credential includes a third set of attributes, wherein the third set of attributes include at least one selected from the group consisting of a type of the user device, a model number of the user device, an assurance level of the user device, and a security capability of the user device.

11. The identity server of claim 1, wherein the electronic processor is further configured to update an attribute provider based on the scope.

12. An identity server comprising:

an electronic processor configured to

receive an agency-issued credential, wherein the agency-issued credential includes attributes that specify a user device'"'"'s authenticity, authority, rights, or combination thereof,

retrieve a first set of attributes from the agency-issued credential,

map the first set of attributes to a second set of attributes based on a context of an incident associated with an incident area network, wherein the second set of attributes specify the user device'"'"'s authenticity, authority, rights, or combination thereof to access computer-based services available through the incident area network,

generate an incident-issued credential for the incident area network associated with the incident including the second set of attributes, and

issue the incident-issued credential to the user device.

13. The identity server of claim 12, wherein the context includes at least one selected from the group consisting of a type of the incident, a size of the incident, a condition of the incident, a location of the incident, a time of day, number of resources at the incident, a type of resource at the incident, and a needed but missing resources at the incident.

14. The identity server of claim 12, wherein the agency-issued credential is associated with a user of the user device and wherein the electronic processor is further configured to prompt the user device for data identifying the user device and wherein the electronic processor is configured to map the first set of attributes to the second set of attributes based on the data identifying the user device.

15. The identity server of claim 12, wherein the agency-issued credential is associated with a user of the user device and wherein the first set of attributes includes at least one selected from the group consisting of a level of capability of the user, a level of qualification of the user, and a level of training of the user.

16. The identity server of claim 12, wherein the agency-issued credential is a first agency-issued credential and is associated with a user of the user device and wherein the electronic processor is further configured to receive a second agency-issued credential associated with the user device and wherein the electronic processor is configured to map the first set of attributes to the second set of attributes based on the first agency-issued credential and the second agency-issued credential.

17. The identity server of claim 16, wherein the second agency-issued credential includes a third set of attributes, wherein the third set of attributes include at least one selected from the group consisting of a type of the user device, a model number of the user device, an assurance level of the user device, and a security capability of the user device.

18. The identity server of claim 12, wherein the incident-issued credential includes a long term incident-issued credential and wherein the electronic processor is further configured to receive a request to access a service available through the incident area network, the request including the long term incident-issued credential, query an attribute provider for the second set of attributes, and generate a short term incident-issued credential in response to the request based on the second set of attributes.

19. A method of issuing an incident-issued credential for an incident area network, the method comprising:

receiving, with an identity server, an agency-issued credential, wherein the agency-issued credential includes attributes that specify a user device'"'"'s authenticity, authority, rights, or combination thereof;

retrieving, with the identity server, a first set of attributes from the agency-issued credential;

mapping, with the identity server, the first set of attributes to a second set of attributes based a context of an incident associated with the incident area network, wherein the second set of attributes specify the user device'"'"'s authenticity, authority, rights, or combination thereof to access computer-based services available through the incident area network;

generating the incident-issued credential based on the second set of attributes; and

issuing, with the identity server, the incident-issued credential to the user device.

20. The method of claim 19, wherein the context includes at least one selected from the group consisting of a type of the incident, a size of the incident, a condition of the incident, a location of the incident, a time of day, number of resources at the incident, a type of resource at the incident, and a needed but missing resource at the incident.