User access control to distributed resources on a data communications network

• US 20030084171A1
• Filed: 10/29/2001
• Published: 05/01/2003
• Est. Priority Date: 10/29/2001
• Status: Abandoned Application

• Current Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Levy, Moshe, de Jong, Eduard K., Leung, Albert Y.
• Application Number:
  US10/014,893
• Publication Number:
  US 20030084171A1
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0414 during transmission, i.e. party's identity is protected against eavesdropping, e.g. by using temporary identifiers, but is known to the other party or parties involved in the communication
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A method for controlling user access to distributed resources on a data communications network includes receiving a resource request. The request includes a rights key credential that includes at least one key to provide access to a resource on the data communications network. The rights key credential also includes a resource identifier that includes a resource server peer group ID and a randomized ID. The resource server peer group ID identifies a resource server peer group. The resource server peer group includes at least one server that maintains a mapping between a randomized ID and the at least one key. The method also includes providing access to the resource using the at least one key.

Claims

1. A method for controlling user access to distributed resources on a data communications network, the method comprising:

receiving a resource request, said request including a rights key credential, said rights key credential comprising;

at least one key to provide access to a resource on said data communications network; and

a resource identifier, said resource identifier comprising a resource server peer group ID and a randomized ID, said resource server peer group ID identifying a resource server peer group, said resource server peer group comprising at least one server that maintains a mapping between a randomized ID and said at least one key; and

providing access to said resource using said at least one key.

2. A method for controlling user access to distributed resources on a data communications network, the method comprising:

receiving a resource request, said request including a rights key credential, said rights key credential comprising;

at least one key, each of said at least one key providing access to at least one resource on said data communications network, each of said at least one resource stored on a separate secure device; and

a resource identifier, said resource identifier comprising a resource server peer group ID and a randomized ID, said resource server peer group ID identifying a resource server peer group, said resource server peer group comprising at least one server that maintains a mapping between a randomized ID and said at least one key; and

providing access to said resource using said at least one key.

3. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method for controlling user access to distributed resources on a data communications network, the method comprising:

receiving a resource request, said request including a rights key credential, said rights key credential comprising;

at least one key to provide access to a resource on said data communications network; and

a resource identifier, said resource identifier comprising a resource server peer group ID and a randomized ID, said resource server peer group ID identifying a resource server peer group, said resource server peer group comprising at least one server that maintains a mapping between a randomized ID and said at least one key; and

providing access to said resource using said at least one key.

4. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method for controlling user access to distributed resources on a data communications network, the method comprising:

receiving a resource request, said request including a rights key credential, said rights key credential comprising;

at least one key, each of said at least one key providing access to at least one resource on said data communications network, each of said at least one resource stored on a separate secure device; and

a resource identifier, said resource identifier comprising a resource server peer group ID and a randomized ID, said resource server peer group ID identifying a resource server peer group, said resource server peer group comprising at least one server that maintains a mapping between a randomized ID and said at least one key; and

providing access to said resource using said at least one key.

5. An apparatus for controlling user access to distributed resources on a data communications network, the apparatus comprising:

means for receiving a resource request, said request including a rights key credential, said rights key credential comprising;

at least one key to provide access to a resource on said data communications network; and

a resource identifier, said resource identifier comprising a resource server peer group ID and a randomized ID, said resource server peer group ID identifying a resource server peer group, said resource server peer group comprising at least one server that maintains a mapping between a randomized ID and said at least one key; and

means for providing access to said resource using said at least one key.

6. An apparatus for controlling user access to distributed resources on a data communications network, the apparatus comprising:

means for receiving a resource request, said request including a rights key credential, said rights key credential comprising;

at least one key, each of said at least one key providing access to at least one resource on said data communications network, each of said at least one resource stored on a separate secure device; and

a resource identifier, said resource identifier comprising a resource server peer group ID and a randomized ID, said resource server peer group ID identifying a resource server peer group, said resource server peer group comprising at least one server that maintains a mapping between a randomized ID and said at least one key; and

means for providing access to said resource using said at least one key.