Secured and access controlled peer-to-peer resource sharing method and apparatus

• US 20030177186A1
• Filed: 03/15/2002
• Published: 09/18/2003
• Est. Priority Date: 03/15/2002
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Goodman, Brian D., Subramanian, Ramesh, Sweeney, William C., Rooney, John W.
• Granted Patent: US 7,120,691 B2
• Time in Patent Office: Days
• US Class Current: 709/205
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks
• CPC Class Codes: H04L 67/1068 Discovery involving direct consultation or announcement among potential requesting and potential source peers
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

A peer-to-peer network propagates searches from client to client. Resources within each client are selectively searched in response to authentication and authorization processes. Authentication information may be included in a search request or may be performed by an authentication process external to the client. Authorization is performed by a process external to the client. Only after authentication or authorization may resources of any particular client be accessed. The system allows for secure propagated searches and resource access in a peer-to-peer network environment. The network may further include a server for maintaining a list of clients connected to the peer-to-peer network in order to more efficiently facilitate peer-to-peer communications.

Claims

1. In a peer-to-peer network a method of securely conducting a resource search initiated by a first client, the resource search included with a search request having a credentials signal indicative of the first client, the method comprising the steps of:

communicating the search request from the first client to a second client, the second client having a multiplicity of second resources, each of the multiplicity of second resources having at least one corresponding access attribute;

at the second client, selectively searching the multiplicity of second resources in response to comparison of the credentials signal and the at least one access attribute of each of the multiplicity of second resources;

communicating the search request from the second client to a third client, the third client having a multiplicity of third resources, each of the multiplicity of third resources having at least one corresponding access attribute; and

at the third client, selectively searching the multiplicity of third resources in response to comparison of the credentials signal and the at least one access attribute of each of the multiplicity of third resources.

2. The method according to claim 1 further comprising the steps of:

at the third client, determining a matching resource in response to said step of selectively searching the multiplicity of third resources; and

communicating a matching signal indicative of the matching resource from the third client to the first client.

3. The method according to claim 1 wherein

the credentials signal includes an identification signal indicative of the first client and

the access attributes of the second and third resources includes an authorization signal indicative of at least one of a plurality of clients, the plurality of clients including the first client, and further wherein

said step of selectively searching the second multiplicity of resources searches one of the second multiplicity of resources if the identification signal substantially matches the authorization signal included with the corresponding access attributes, and

said step of selectively searching the third multiplicity of resources searches one of the third multiplicity of resources if the identification signal substantially matches the authorization signal included with the corresponding access attributes.

4. The method according to claim 1 wherein

the credentials signal includes an identification signal indicative of the first client and

the access attributes of the second and third resources includes an authorization signal indicative of at least one of a plurality of clients, the plurality of clients including the first client, wherein

said step of selectively searching the second multiplicity of resources further includes the steps of:

communicating from the second client to an authentication process external to the first, second and third clients the identification signal;

receiving from the authentication process an authenticated signal indicative of the first client in response thereto; and

searching one of the second multiplicity of resources if the authenticated signal substantially matches the authorization signal included with the corresponding access attributes, and

said step of selectively searching the third multiplicity of resources further includes the steps of;

communicating from the third client to the authorization process the identification signal;

receiving from the authorization process the authenticated signal indicative of the first client in response thereto; and

searching one of the third multiplicity of resources if the authenticated signal substantially matches the authorization signal included with the corresponding access attributes.

5. The method according to claim 4 further comprising the steps:

at the second client, storing the identification signal and the received authenticated signal in a cache memory at the second client; and

at the second client searching the cache memory for the identification signal and the received authentication signal prior to said step communicating from the second client to the authentication process, wherein

said step communicating from the second client to the authentication process is not performed if said step of searching the cache memory finds the identification signal and the received authentication signal stored therein, and

said step of searching one of the second multiplicity of resources uses the authenticated signal stored in the cache memory, thereby reducing communication between the second client and the authentication process.

6. The method according to claim 4 further comprising the steps:

at the third client, storing the identification signal and the received authenticated signal in a cache memory at the third client; and

at the third client searching the cache memory for the identification signal and the received authentication signal prior to said step communicating from the third client to the authentication process, wherein

said step communicating from the third client to the authentication process is not performed if said step of searching the cache memory finds the identification signal and the received authentication signal stored therein, and

said step of searching one of the third multiplicity of resources uses the authenticated signal stored in the cache memory, thereby reducing communication between the third client and the authentication process.

7. The method according to claim 4 wherein said step of communicating the search request from the second client to the third client and said step of selectively searching the multiplicity of third resources are not performed if the authentication signal is not received from the authentication process by the second client.

8. The method according to claim 1 wherein

the credentials signal includes an identification signal indicative of the first client and

the access attributes of the second and third resources includes an authorization signal indicative of at least one of a plurality of client classes, wherein

said step of selectively searching the second multiplicity of resources further includes the steps of:

communicating from the second client to an authorization process external to the second client the identification signal;

receiving from the authorization process a client class signal indicative which of the plurality of client classes are associated with the identification signal; and

searching one of the second multiplicity of resources if the client class signal substantially matches the authorization signal included with the corresponding access attributes, and

said step of selectively searching the third multiplicity of resources further includes the steps of;

communicating from the third client to the authorization process external to the third client the identification signal;

receiving from the authorization process the client class signal indicative which of the plurality of client classes are associated with the identification signal; and

searching one of the third multiplicity of resources if client class signal substantially matches the authorization signal included with the corresponding access attributes.

9. The method according to claim 8 further comprising the steps:

at the second client, storing the identification signal and the received client class signal in a cache memory at the second client; and

at the second client searching the cache memory for the identification signal and the received client cache signal prior to said step communicating from the second client to the authorization process, wherein

said step communicating from the second client to the authorization process is not performed if said step of searching the cache memory finds the identification signal and the received client cache signal stored therein, and

said step of searching one of the second multiplicity of resources uses the client cache signal stored in the cache memory, thereby reducing communication between the second client and the authorization process.

10. The method according to claim 8 further comprising the steps:

at the third client, storing the identification signal and the received client class signal in a cache memory at the third client; and

at the third client searching the cache memory for the identification signal and the received client cache signal prior to said step communicating from the third client to the authorization process, wherein

said step communicating from the third client to the authorization process is not performed if said step of searching the cache memory finds the identification signal and the received client class signal stored therein, and

said step of searching one of the third multiplicity of resources uses the client class signal stored in the cache memory, thereby reducing communication between the third client and the authentication process.

11. The method according to claim 1 wherein the peer-to-peer network further including a multiplicity of clients including the first, second and third clients, each of the multiplicity of clients having a unique client address, and a server having a list of client addresses, said method further comprising the steps of:

communicating from the server to the first client a first seed list comprising a first portion of the list of client addresses; and

communicating from the server to the second client a second seed list comprising a second portion of the list of client addresses, the first seed list including a second client address corresponding to the second client and the second seed list including a third client address corresponding to the third client, wherein

said step of communicating the search request from the first client to the second client communicates to the second client in response to the second client address included in the first seed list, and

said step of communicating the search request from the second client to the third client communicates to the third client in response to the third client address included in the second seed list.

12. The method according to claim 11 wherein each of the multiplicity of clients may be either connect to or disconnect from the peer-to-peer network at any time, and the method further comprising the steps of:

at the server, determining which of the multiplicity of clients is connected to the peer-to-peer network;

at the server, generating a list of connected client addresses in response said step of determining; and

at the server, generating the first and second seed lists from the list of connected client addresses.

13. The method according to claim 12 further comprising the steps of:

communicating a connection signal from one of the multiplicity of clients to the server in response to the one of the multiplicity of clients connecting to the peer-to-peer network; and

at the server, adding a newly connected client address corresponding to the one of the multiplicity of clients to the list of connected client addresses in response thereto.

14. A client included in a peer-to-peer network having a multiplicity of clients, the client comprising:

a peer-to-peer network dispatcher for receiving a resource search request from a second client of the multiplicity of clients, the search request initiating from an initiating client of the multiplicity of clients, the search request including a credentials signal having an identification signal indicative of the initiating client;

a memory for storing a plurality of resources, each of the plurality of resources having at least one corresponding access attribute; and

a search engine for selectively searching at least one of the plurality of resources in response to a comparison of the credentials signal and the at least one access attribute of each of the plurality of resources.

15. The client according to claim 14 further wherein

said peer-to-peer network dispatcher communicates the identification signal to an authentication process external to the client and receives an authenticated signal if the identification signal is authenticated by the authentication process, and

said search engine does not search any of the plurality of resources if the authenticated signal is not received from the authentication process.

16. The client according to claim 15 further wherein

said peer-to-peer network dispatcher communicates the resource search request to a third client of the multiplicity of clients if the authenticated signal is received from the authentication process, or does not communicate the resource search request to the third client if the authenticated signal is not received from the authentication process

17. The client according to claim 14 further wherein the access attribute is indicative of a class of clients permitted to access to the corresponding resource,

said peer-to-peer network dispatcher communicates the identification signal to an authorization process external to the client and receives a client class signal in response thereto, and

said search engine selectively searches the at least one of the plurality of resources in response to a comparison of the client class signal and the at least one access attribute of each of the plurality of resources.

18. The client according to claim 14 wherein the peer-to-peer network further includes a server and each of the multiplicity of clients has a unique client address, the client further comprises

a seed list receiver for receiving and storing a seed list of client address from the server, and

said peer-to-peer network search dispatcher forwards the resource search request to client addresses of the seed list.

19. In a peer-to-peer network a method of securely conducting a resource search initiated by a first client, the resource search included with a search request having a credentials signal indicative of the first client, the method comprising the steps of:

communicating the search request from the first client to a second client;

communicating the search request from the second client to a third client, the third client having a multiplicity of third resources, each of the multiplicity of third resources having at least one corresponding access attribute; and

at the third client, selectively searching the multiplicity of third resources in response to comparison of the credentials signal and the at least one access attribute of each of the multiplicity of third resources.

20. The method according to claim 19 wherein the peer-to-peer network further including a multiplicity of clients including the first, second and third clients, each of the multiplicity of clients having a unique client address, and a server having a list of client addresses, said method further comprising the steps of:

communicating from the server to the first client a first seed list comprising a first portion of the list of client addresses; and

communicating from the server to the second client a second seed list comprising a second portion of the list of client addresses, the first seed list including a second client address corresponding to the second client and the second seed list including a third client address corresponding to the third client, wherein

said step of communicating the search request from the first client to the second client communicates to the second client in response to the second client address included in the first seed list, and

said step of communicating the search request from the second client to the third client communicates to the third client in response to the third client address included in the second seed list.