Umethod, system and program for managing relationships among entities to exchange encryption keys for use in providing access and authorization to resources

• US 20010020228A1
• Filed: 03/22/2001
• Published: 09/06/2001
• Est. Priority Date: 07/09/1999
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Cantu, Arthur, Gladney, Henry Martin
• Application Number:
  US09/814,624
• Publication Number:
  US 20010020228A1
• Time in Patent Office: Days
• US Class Current: 705/1
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 2209/42 Anonymization, e.g. involving pseudonyms
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/0414 during transmission, i.e. party's identity is protected against eavesdropping, e.g. by using temporary identifiers, but is known to the other party or parties involved in the communication
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps

Abstract

Provided is a method, system, and program for managing access to resources. Encryption keys are exchanged among a first entity, second entity, third entity, and a fourth entity. Each entity has one relationship with one other entity and the encryption keys are exchanged pursuant to the relationships. Electronic messages are encrypted with the encryption keys concerning digital enrollments to provide to the first entity. The digital enrollment is associated with at least one digital ticket that authorizes access to a resource managed by the fourth entity. Presentation of the digital enrollment causes the presentation of one digital ticket associated with the digital enrollment to authorize the first entity to access the resource.

Claims

1. A method for managing access to resources, comprising:

exchanging encryption keys among a first entity, second entity, third entity, and a fourth entity, wherein each entity has one relationship with one other entity, and wherein the encryption keys are exchanged pursuant to the relationships; and

encrypting with the encryption keys electronic messages concerning digital enrollments to provide to the first entity, wherein the digital enrollment is associated with at least one digital ticket that authorizes access to a resource managed by the fourth entity, wherein presentation of the digital enrollment causes the presentation of one digital ticket associated with the digital enrollment to authorize the first entity to access the resource.

2. The method of

claim 1

, wherein the first entity and the second entity have a first relationship such that the first entity is associated with the second entity and wherein the second entity and third entity have a second relationship through which entities associated with the second entity can access resources managed by the fourth entity.

3. The method of

claim 2

, wherein the third entity and fourth entity have a third relationship through which the fourth entity makes managed resources available to entities designated by the third entity.

4. The method of

claim 3

, wherein exchanging the encryption keys further comprises:

transmitting, with the fourth entity, the fourth entity encryption key to the third entity;

transmitting, with the third entity, the third entity and fourth entity encryption keys to the second entity after receiving the fourth entity encryption key from the fourth entity; and

transmitting, with the second entity, the second entity, third entity, and fourth entity encryption keys to the first entity after receiving the third entity and fourth entity encryption keys from the third entity.

5. The method of

claim 3

, wherein exchanging the encryption keys further comprises:

transmitting, with the first entity, the first entity encryption key to the second entity;

transmitting, with the second entity, the first entity and second entity encryption keys to the third entity after receiving the fist entity encryption key from the first entity; and

transmitting, with the third entity, the first entity, second entity, and third entity encryption keys to the first entity after receiving the first and second entity encryption keys from the second entity.

6. The method of

claim 1

, further comprising:

using, with the second entity, the first entity encryption key received during the exchange of encryption keys to encrypt a message including at least one digital enrollment to the first entity that the first entity can use to access the resource; and

using, with the first entity, the second entity encryption key received during the exchange of encryption keys to decrypt the message received from the second entity providing the digital enrollment.

7. The method of

claim 6

, further comprising:

using, with the second entity, the second entity encryption key to encrypt the message including the digital enrollment before encrypting the message with the first entity encryption key.

8. The method of

claim 1

, further comprising:

using, with the first entity, the encryption key of the fourth entity received during the exchange of encryption keys to encrypt a message including the digital enrollment to access the resource managed by the fourth entity; and

using, with the fourth entity, the first entity encryption key received during the exchange of encryption keys to decrypt the message received from the first entity providing the digital enrollment.

9. The method of

claim 1

, wherein exchanging the encryption keys further comprises exchanging the encryption keys with a fifth entity, further comprising:

maintaining, with the fifth entity, a mapping of digital enrollment to associated digital tickets;

using, with the first entity, the encryption key of the fifth entity received during the exchange of encryption keys to encrypt a message including the digital enrollment to transmit to the fifth entity;

using, with the fifth entity, the first entity encryption key received during the exchange of encryption keys to decrypt the message received from the first entity providing the digital enrollment;

processing the mapping to determine the digital tickets associated with the received enrollment; and

using, with the fifth entity, the first entity encryption key received during the exchange of encryption keys to encrypt a message including the digital tickets to transmit to the first entity to use to access the resource from the fourth entity.

10. The method of

claim 9

, further comprising:

using, with the first entity, the encryption key of the fourth entity received during the exchange of encryption keys to encrypt a message including the digital ticket received from the fifth entity to send to the fourth entity; and

using, with the fourth entity, the first entity encryption key received during the exchange of encryption keys to decrypt the message received from the first entity providing the digital tickets;

granting, with the fourth entity, the first entity access to the resource if the digital ticket included in the decrypted message authorizes access to the resource.

11. The method of

claim 1

, wherein the resource consists of a resource that is a member of the set of resources comprising:

data, computer programs, and control of an electromechanical machine.

12. A system for managing access to resources, comprising:

means for exchanging encryption keys among a first entity, second entity, third entity, and a fourth entity, wherein each entity has one relationship with one other entity, and wherein the encryption keys are exchanged pursuant to the relationships; and

means for encrypting with the encryption keys electronic messages concerning digital enrollments to provide to the first entity, wherein the digital enrollment is associated with at least one digital ticket that authorizes access to a resource managed by the fourth entity, wherein presentation of the digital enrollment causes the presentation of one digital ticket associated with the digital enrollment to authorize the first entity to access the resource.

13. The system of

claim 12

, wherein the first entity and the second entity have a first relationship such that the first entity is associated with the second entity and wherein the second entity and third entity have a second relationship through which entities associated with the second entity can access resources managed by the fourth entity.

14. The system of

claim 13

, wherein the third entity and fourth entity have a third relationship through which the fourth entity makes managed resources available to entities designated by the third entity.

15. The system of

claim 14

, wherein the means for exchanging the encryption keys further performs:

transmitting, with the fourth entity, the fourth entity encryption key to the third entity;

transmitting, with the third entity, the third entity and fourth entity encryption keys to the second entity after receiving the fourth entity encryption key from the fourth entity; and

transmitting, with the second entity, the second entity, third entity, and fourth entity encryption keys to the first entity after receiving the third entity and fourth entity encryption keys from the third entity.

16. The system of

claim 14

, wherein the means for exchanging the encryption keys further performs:

transmitting, with the first entity, the first entity encryption key to the second entity;

transmitting, with the second entity, the first entity and second entity encryption keys to the third entity after receiving the fist entity encryption key from the first entity; and

transmitting, with the third entity, the first entity, second entity, and third entity encryption keys to the first entity after receiving the first and second entity encryption keys from the second entity.

17. The system of

claim 12

, further comprising:

means for using, with the second entity, the first entity encryption key received during the exchange of encryption keys to encrypt a message including at least one digital enrollment to the first entity that the first entity can use to access the resource; and

means for using, with the first entity, the second entity encryption key received during the exchange of encryption keys to decrypt the message received from the second entity providing the digital enrollment.

18. The system of

claim 17

, further comprising:

means for using, with the second entity, the second entity encryption key to encrypt the message including the digital enrollment before encrypting the message with the first entity encryption key.

19. The system of

claim 12

, further comprising:

means for using, with the first entity, the encryption key of the fourth entity received during the exchange of encryption keys to encrypt a message including the digital enrollment to access the resource managed by the fourth entity; and

means for using, with the fourth entity, the first entity encryption key received during the exchange of encryption keys to decrypt the message received from the first entity providing the digital enrollment.

20. The system of

claim 12

, wherein the means for exchanging the encryption keys further performs exchanging the encryption keys with a fifth entity, further comprising:

means for maintaining, with the fifth entity, a mapping of digital enrollment to associated digital tickets;

means for using, with the first entity, the encryption key of the fifth entity received during the exchange of encryption keys to encrypt a message including the digital enrollment to transmit to the fifth entity;

means for using, with the fifth entity, the first entity encryption key received during the exchange of encryption keys to decrypt the message received from the first entity providing the digital enrollment;

means for processing the mapping to determine the digital tickets associated with the received enrollment; and

means for using, with the fifth entity, the first entity encryption key received during the exchange of encryption keys to encrypt a message including the digital tickets to transmit to the first entity to use to access the resource from the fourth entity.

21. The system of

claim 20

, further comprising:

means for using, with the first entity, the encryption key of the fourth entity received during the exchange of encryption keys to encrypt a message including the digital ticket received from the fifth entity to send to the fourth entity; and

means for using, with the fourth entity, the first entity encryption key received during the exchange of encryption keys to decrypt the message received from the first entity providing the digital tickets; and

means for granting, with the fourth entity, the first entity access to the resource if the digital ticket included in the decrypted message authorizes access to the resource.

22. The system of

claim 12

, wherein the resource consists of a resource that is a member of the set of resources comprising:

data, computer programs, and control of an electromechanical machine.

23. An article of manufacture including code executed by a first entity, second entity, third entity, and fourth entity to manage access to a resource, comprising:

code executed by the first, second, third, and fourth entities to receive encryption keys of all the other entities wherein each entity has one relationship with one other entity, and wherein the encryption keys are exchanged pursuant to the relationships; and

code executed by the first entity to receive electronic messages concerning digital enrollments encrypted with the encryption keys of at least one of the first, second, and third entities, wherein the digital enrollment is associated with at least one digital ticket that authorizes access to a resource managed by the fourth entity, wherein presentation of the digital enrollment causes the presentation of one digital ticket associated with the digital enrollment to authorize the first entity to access the resource.

24. The article of manufacture of

claim 23

, wherein the first entity and the second entity have a first relationship such that the first entity is associated with the second entity and wherein the second entity and third entity have a second relationship through which entities associated with the second entity can access resources managed by the fourth entity.

25. The article of manufacture of

claim 24

, wherein the third entity and fourth entity have a third relationship through which the fourth entity makes managed resources available to entities designated by the third entity.

26. The article of manufacture of

claim 23

, further comprising:

code executed by the second entity to use the first entity encryption key received during the exchange of encryption keys to encrypt a message including at least one digital enrollment to the first entity that the first entity can use to access the resource; and

code executed by the first entity to use the second entity encryption key received during the exchange of encryption keys to decrypt the message received from the second entity providing the digital enrollment.

27. The article of manufacture of

claim 26

, further comprising:

code executed by the second entity to use the second entity encryption key to encrypt the message including the digital enrollment before encrypting the message with the first entity encryption key.

28. The article of manufacture of

claim 23

, further comprising:

code executed by the first entity to use the encryption key of the fourth entity received during the exchange of encryption keys to encrypt a message including the digital enrollment to access the resource managed by the fourth entity; and

code executed by the fourth entity to use the first entity encryption key received during the exchange of encryption keys to decrypt the message received from the first entity providing the digital enrollment.

29. The article of manufacture of

claim 23

, wherein exchanging the encryption keys further comprises exchanging the encryption keys with a fifth entity, further comprising:

code executed by the fifth entity to maintain a mapping of digital enrollments to associated digital tickets;

code executed by the first entity to use the encryption key of the fifth entity received during the exchange of encryption keys to encrypt a message including the digital enrollment to transmit to the fifth entity;

code executed by the fifth entity to use the first entity encryption key received during the exchange of encryption keys to decrypt the message received from the first entity providing the digital enrollment;

code executed by the fifth entity to process the mapping to determine the digital tickets associated with the received enrollment; and

code executed by the fifth entity to use the first entity encryption key received during the exchange of encryption keys to encrypt a message including the digital tickets to transmit to the first entity to use to access the resource from the fourth entity.

30. The article of manufacture of

claim 29

, further comprising:

code executed by the first entity to use the encryption key of the fourth entity received during the exchange of encryption keys to encrypt a message including the digital ticket received from the fifth entity to send to the fourth entity; and

code executed by the fourth entity to use the first entity encryption key received during the exchange of encryption keys to decrypt the message received from the first entity providing the digital tickets; and

code executed by the fourth entity to grant the first entity access to the resource if the digital ticket included in the decrypted message authorizes access to the resource.

31. The article of manufacture of

claim 23

, wherein the resource consists of a resource that is a member of the set of resources comprising:

data, computer programs, and control of an electromechanical machine.