System and method for privilege delegation and control

• US 20040034774A1
• Filed: 08/15/2002
• Published: 02/19/2004
• Est. Priority Date: 08/15/2002
• Status: Active Grant

• Current Assignee: Assa Abloy AB
• Original Assignee: ActivCard Co.
• Inventors: Le Saint, Eric F.
• Granted Patent: US 7,770,212 B2
• Time in Patent Office: Days
• US Class Current: 713/169
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869

Abstract

This invention provides a privilege delegation mechanism, which allows a privilege and associated control attributes to be delegated from a security token to another security token or an intelligent device such as a computer system. The privilege may be in the form of an attribute certificate, a key component of a cryptographic key, a complete cryptographic key, digital certificate, digital right, license or loyalty credits. The purpose of the delegation is to allow another security token or computer system to act as a surrogate for the security token or to access a resource which requires components from both units before access is permitted. Attributes associated with the delegated privilege control the scope and use of the privilege. The delegation may allow the surrogate to perform authentications, access data or resources included on another security token or computer system. Authentications are performed prior to transferring of the delegable privileges.

Claims

1. A system for delegating a privilege and associated attributes from a security token to at least a first data processing unit, said privilege enabling access to at least one resource by said at least a first data processing unit subject to requirements prescribed in said associated attributes comprising:

i. said security token including said privilege and said associated attributes and delegation means for delegating said privilege to said at least a first data processing unit,

ii. said at least a first data processing unit including privilege processing means for implementing said privilege in accordance with said requirements prescribed in said associated attributes,

iii. communications means for performing data exchanges between said security token and said at least a first data processing unit.

2. The system according to claim 1 wherein mutual authentication is performed between said security token and said at least a first data processing unit before said privilege is delegated.

3. The system according to claim 2 wherein said communications means includes a secure messaging protocol.

4. The system according to claim 3 wherein said data exchanges includes authentication data, said privilege or said associated attributes.

5. The system according to claim 1 wherein said privilege is updateable by replacement of at least a portion of said associated attributes with one or more new associated attributes.

6. The system according to claim 1 wherein said at least a first data processing unit is an intelligent device.

7. The system according to claim 1 wherein said at least a first data processing unit is another security token.

8. The system according to claim 1 wherein said associated attributes includes control aspects.

9. The system according to claim 8 wherein said control aspects includes security policies.

10. The system according to claim 9 wherein said control aspects includes at least one privilege state.

11. The system according to claim 1 wherein said privilege includes a key component, a cryptographic key, a privilege attribute certificate, a digital ticket, a license, a digital right, a digital credential, a password, a biometric template, a biometric sample or a loyalty credit.

12. The system according to claim 1 wherein said at least one resource is accessible to said first data processing unit only if said privilege is present in said first data processing and verified by at least a second data processing unit.

13. The system according to claim 12 wherein said privilege facilitates said at least a first data processing unit to perform a function selected from the group consisting of;

surrogate operations for said security token, terminal activation, personalization of an intelligent device, access to said at least one resource or loyalty credit management.

14. A system for delegating a privilege from a security token to at least a first data processing unit, wherein said privilege enables said at least a first data processing unit to perform a function selected from the group consisting of;

surrogate operations for said security token, terminal activation, personalization of an intelligent device, access to a resource included in or accessible through at least a second data processing unit, or loyalty credit management.

15. The system according to claim 14 further including attributes associated with said privilege, wherein said attributes provides sufficient information to said first data processing unit to use said privilege and enforce one or more control aspects stated in said associated attributes including security policies and at least one privilege state.

16. A method for delegating a privilege having associated attributes from a security token to at least a first data processing unit, said privilege enabling said at least a first data processing unit to use said privilege subject to requirements prescribed in said associated attributes, said method comprising:

i. performing a mutual authentication transaction between said security token and said at least a first data processing unit,

ii. securely transferring said privilege including said associated attributes to said at least a first data processing unit,

iii. using said privilege as prescribed by said associated attributes.

17. The method according to claim 16 wherein said at least a first data processing unit is a computer system.

18. The method according to claim 17 wherein said at least a first data processing unit is another security token.

19. The method according to claim 16 wherein said privilege is updateable by replacing said associated attributes with at least one new associated attribute.

20. The method according to claim 18 wherein said privilege is transferred from said security token to said at least a first data processing unit using a secure messaging protocol.

21. A privilege delegation system comprising:

i. a security token including at least one delegable privilege and attributes associated with said delegable privilege,

ii. at least a first data processing unit including means to use said privilege subject to requirements prescribed in said associated attributes.

22. The system according to claim 21 wherein said at least a first data processing unit is a computer system.

23. The system according to claim 21 wherein said at least a first data processing unit is another security token.

24. The system according to claim 21 wherein said privilege is updateable by replacing said associated attributes with at least one new associated attribute.

25. The system according to claim 21 wherein said privilege is transferred from said security token to said at least a first data processing unit using a secure messaging protocol.

26. The system according to claim 25 wherein said security token and said at least a first data processing unit are mutually authenticated before said privilege is transferred.

27. The system according to claim 21, wherein said privilege enables said at least a first data processing unit to perform a function selected from the group consisting of;

surrogate operations for said security token, terminal activation, personalization of an intelligent device, access to a resource included in or accessible through at least a second data processing unit, or loyalty credit management.

28. A privilege delegation system comprising:

i. a security token including at least a first part of a delegable privilege and attributes associated with said first part of said delegable privilege and transfer means for transferring said first part of said delegable privilege and said attributes to at least a first data processing unit,

ii. said at least a first data processing unit including a second part of said delegable privilege, first combining means for combining said first part of said delegable privilege with said second part of said delegable privilege to form an operable privilege.

29. The system according to claim 28 wherein said second part of said delegable privilege is contained in a second data processing unit.

30. The system according to claim 29 wherein said first part of said delegable privilege and said associated attributes are transferred from said first data processing unit to said second data processing unit.

31. The system according to claim 30 wherein said second data processing unit includes second combining means for combining said first part of said delegable privilege with said second part of said delegable privilege.

32. The system according to claim 29 wherein said at least a first data or said second data processing unit is a computer system.

33. The system according to claim 29 wherein said at least a first data or said second processing unit is another security token.

34. The system according to claim 28 wherein said privilege is transferred from said security token to said at least a first data processing unit using a secure messaging protocol.

35. The system according to claim 28 wherein access to a resource is enabled by combining said first part of said delegable privilege with said second part of said delegable privilege.

36. The system according to claim 30 wherein said privilege is transferred from said at least a first data processing unit to said second data processing unit using a secure messaging protocol.

37. The system according to claim 31 wherein said second part of said delegable privilege is transferred from said second data processing unit to said first data processing unit.

38. The system according to claim 37 wherein said resource is contained in said first data processing unit.

39. The system according to claim 37 wherein said resource is contained in said second data processing unit.

40. The system according to claim 39 wherein said resource is transferred from said second data processing unit to said first data processing unit.

41. The system according to claim 39 wherein said resource is transferred from said first data processing unit to said second data processing unit.

42. The system according to claim 28 wherein said operable privilege is generated by combining a plurality of partial privileges in a single data processing unit.