Systems and methods for organizing devices in a policy hierarchy

• US 10,630,686 B2
• Filed: 03/10/2016
• Issued: 04/21/2020
• Est. Priority Date: 03/12/2015
• Status: Active Grant

• Current Assignee: Fornetix LLC
• Original Assignee: Fornetix LLC
• Inventors: White, Charles, Edwards, Stephen
• Primary Examiner(s): Patel, Ashokkumar B
• Assistant Examiner(s): Jones, William B
• Application Number:
  US15/067,074
• Publication Number:
  US 20160269373A1
• Time in Patent Office: 1,503 Days
• Field of Search: 713168
• CPC Class Codes: H04L 63/064 Hierarchical key distribution, e.g. by multi-tier trusted parties
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

In various embodiments, there is provide a method for organizing devices in a policy hierarchy. The method includes creating a first node. The method further includes assigning a first policy to the first node. The method further includes creating a second node, the second node referencing the first node as a parent node such that the second node inherits the first policy of the first node.

Claims

1. A method for organizing devices in a policy hierarchy, the method comprising:

creating a first node;

assigning a first policy to the first node;

creating a second node, the second node referencing the first node as a parent node such that the second node inherits the first policy of the first node;

receiving an encryption key having a key attribute;

determining acceptability of a securance of the encryption key based on the key attribute conforming to at least the first policy inherited by the second node from the first node;

registering a second device to the second node by referencing a unique identifier of the second node such that the second device is bound by at least the first policy inherited from the first node;

assigning a second policy to the second node such that the second node is assigned the first policy and the second policy; and

performing an applied key management operation including one of key management, key distribution, or key federation on the second device registered to the second node such that the applied key management operation is evaluated based on at least one of the first or second policies of the second node,

wherein the encryption key is distributed to the second device in response to determining that the encryption key is acceptable.

2. The method of claim 1, further comprising creating a third node, the third node referencing the second node as a parent node such that the third node inherits the first policy and the second policy of the second node.

3. The method of claim 1, further comprising:

registering a first device to the first node such that the first device is bound by the first policy of the first node.

4. The method of claim 3, wherein the registering the first device comprises referencing an identifier of the first node.

5. The method of claim 3, wherein the applied key management operation is evaluated based on the first and second policies of the second node.

6. The method of claim 3, wherein:

the encryption key having the key attribute is received from the first device; and

the determining of the acceptability of the encryption key is based on the key attribute and the first and second policies of the second device associated with the second node.

7. The method of claim 3, further comprising:

creating a third policy; and

assigning the third policy to the second node such that the second node is assigned the first policy, the second policy, and the third policy.

8. The method of claim 7, further comprising updating the second device to be bound by the first, second, and third policies of the second node.

9. The method of claim 1, wherein the assigning of the first policy to the first node comprises referencing an identifier of the first node.

19. The method of claim 1, wherein the determining of the acceptability of the securance of the encryption key is based on security and cryptographic considerations.

20. The method of claim 1, wherein the second device is configured to follow the first policy inherited from the first node by referencing a unique identifier of the first node.

21. The method of claim 1, wherein the second device is configured to disassociate with the first policy of the first node in response to the first policy being disassociated with the first node.

10. A system for organizing devices in a policy hierarchy, the system comprising:

a memory; and

a processor configured to;

create a first node;

assign a first policy to the first node;

create a second node, the second node referencing the first node as a parent node such that the second node inherits the first policy of the first node

receive an encryption key having a key attribute;

determine acceptability of a securance of the encryption key based on the key attribute conforming to at least the first policy inherited by the second node from the first node;

register a second device to the second node by referencing a unique identifier of the second node such that the second device is bound by at least the first policy inherited from the first node;

assign a second policy to the second node such that the second node is assigned the first policy and the second policy; and

perform an applied key management operation including one of key management, key distribution, or key federation on the second device registered to the second node such that the applied key management operation is evaluated based on at least one of the first or second policies of the second node,

wherein the encryption key is distributed to the second device in response to determining that the encryption key is acceptable.

11. The system of claim 10, wherein the processor is further configured to create a third node, the third node referencing the second node as a parent node such that the third node inherits the first policy and the second policy of the second node.

12. The system of claim 10, wherein the processor is further configured to:

register a first device to the first node such that the first device is bound by the first policy of the first node.

13. The system of claim 12, wherein the registering the first device comprises referencing an identifier of the first node.

14. The system of claim 12, wherein the applied key management operation is evaluated based on the first and second policies of the second node.

15. The system of claim 12, wherein:

the encryption key having the key attribute is received from the first device; and

the determining of the acceptability of the securance of the encryption key is based on the key attribute and the first and second policies of the second device associated with the second node.

16. The system of claim 12, wherein the processor is further configured to:

create a third policy; and

assign the third policy to the second node such that the second node is assigned the first policy, the second policy, and the third policy.

17. The system of claim 16, wherein the processor is further configured to update the second device to be bound by the first, second, and third policies of the second node.

18. The system of claim 10, wherein the assigning of the first policy to the first node comprises referencing an identifier of the first node.