System and method for providing secure resource management

• US 20040088548A1
• Filed: 11/06/2002
• Published: 05/06/2004
• Est. Priority Date: 11/06/2002
• Status: Active Grant

• Current Assignee: Xerox Corporation (Xerox Holdings Corp.)
• Original Assignee: Xerox Corporation (Xerox Holdings Corp.)
• Inventors: Smetters, Diana Kathryn, Izadi, Shahram, Edwards, Warren Keith, Newman, Mark Webster, Sedivy, Jana Zdislava, Balfanz, Dirk, Smith, Trevor, Wong, Hao-Chi
• Granted Patent: US 7,904,720 B2
• Time in Patent Office: Days
• US Class Current: 713/175
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2147 Locking files
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 9/3265 using certificate chains, trees or paths; Hierarchical trust model

Abstract

System and method for providing secure resource management. The system includes a first device that creates a secure, shared resource space and a corresponding root certificate for the shared space. The first device associates one or more resources that it can access with the shared space. The first device invites one or more other devices to join as members of the space, and establishes secure communication channels with the devices that accept this invitation. The first device generates a member certificate for each accepting device, and sends the root certificate and the generated member certificate to the device through the secure channel. These devices may then access resources associated with the shared space by presenting their member certificates. Further, members of the shared space may invite other device to join the space, and may create member certificates in the same manner as the first device.

Claims

1. A method comprising:

obtaining at a first member a first representation of a shared space; and

accessing at the first member a first set of at least one resource associated with the shared space and accessible to the first member through the first representation, access to the at least one resource is provided to the first representation by at least one of the first member, a second member and a plurality of other members.

2. The method as set forth in claim 1 further comprising creating the shared space at least one of the first member, the second member and the plurality of other members.

3. The method as set forth in claim 1 further comprising establishing a secure communication channel between the first member and at least one of the second member and the plurality of other members.

4. The method as set forth in claim 3 wherein the establishing a secure communication channel further comprises using range-limited signals to transfer a commitment to a public key between the first member and at least one of the second member and the plurality of other members.

5. The method as set forth in claim 3 further comprising creating a set of credentials at the first member for authorizing at least one of the first member, the second member and the plurality of other members to access the first representation of the shared space, and providing the set of credentials to at least one of the second member and the plurality of other members through the secure communication channel.

6. The method as set forth in claim 1 further comprising:

obtaining at the second member a second representation of the shared space; and

accessing at the second member a second set of at least one resource associated with the shared space and accessible to the second member through the second representation, the second set of at least one resource provided to the second representation by at least one of the first member, the second member and the plurality of other members.

7. The method as set forth in claim 6 wherein the second member obtains the second representation of the shared space from at least one of the first member and the plurality of other members.

8. The method as set forth in claim 6 wherein at least one of the first member, the second member and the plurality of other members associates a third set of at least one resource with the shared space.

9. The method as set forth in claim 1 wherein the first member provides first current state information of the shared space to the second member.

10. The method as set forth in claim 9 wherein at least one of the plurality of other members provides second current state information to at least one of the first member and the second member.

11. The method as set forth in claim 1 wherein the first member disassociates at least one of the second member and the plurality of other members from the shared space.

12. The method as set forth in claim 1 further comprising:

hosting at the first member the first set of resources associated with the shared space, the first member being trusted by at least one of the second member and the plurality of other members, the first member providing at least one of the second member and the plurality of other members with a copy of the first representation; and

accessing at least one of the second member and the plurality of other members the first set of the at least one resource associated with the shared space and accessible to the second member and the plurality of other members through their respective copy of the first representation, the at least one resource provided to the first representation copies by at least one of the first member, the second member and a plurality of other members.

13. The method as set forth in claim 1 wherein at least one of the first member, the second member and the plurality of other members store a copy of the first set of the at least one resource of the shared space.

14. The method as set forth in claim 1 wherein at least one of the first member, the second member and the plurality of other members maintain a record log of operations involving the shared space.

15. The method as set forth in claim 1 wherein the first member obtains a representation of at least one other shared space.

16. A computer-readable medium having stored thereon instructions, which when executed by at least one processor, causes the processor to perform:

obtaining at a first member a first representation of a shared space; and

accessing at the first member a first set of at least one resource associated with the shared space and accessible to the first member through the first representation, access to the at least one resource is provided to the first representation by at least one of the first member, a second member and a plurality of other members.

17. The medium as set forth in claim 16 further comprising creating the shared space at least one of the first member, the second member and the plurality of other members.

18. The medium as set forth in claim 16 further comprising establishing a secure communication channel between the first member and at least one of the second member and the plurality of other members.

19. The medium as set forth in claim 18 wherein the establishing a secure communication channel further comprises using range-limited signals to transfer a commitment to a public key between the first member and at least one of the second member and the plurality of other members.

20. The medium as set forth in claim 18 further comprising creating a set of credentials at the first member for authorizing at least one of the first member, the second member and the plurality of other members to access the first representation of the shared space, and providing the set of credentials to at least one of the second member and the plurality of other members through the secure communication channel.

21. The medium as set forth in claim 16 further comprising:

obtaining at the second member a second representation of the shared space; and

accessing at the second member a second set of at least one resource associated with the shared space and accessible to the second member through the second representation, the second set of at least one resource provided to the second representation by at least one of the first member, the second member and the plurality of other members.

22. The medium as set forth in claim 21 wherein the second member obtains the second representation of the shared space from at least one of the first member and the plurality of other members.

23. The medium as set forth in claim 21 wherein at least one of the first member, the second member and the plurality of other members associates a third set of at least one resource with the shared space.

24. The medium as set forth in claim 16 wherein the first member provides first current state information of the shared space to the second member.

25. The medium as set forth in claim 24 wherein at least one of the plurality of other members provides second current state information to at least one of the first member and the second member.

26. The medium as set forth in claim 16 wherein the first member disassociates at least one of the second member and the plurality of other members from the shared space.

27. The medium as set forth in claim 16 further comprising:

hosting at the first member the first set of resources associated with the shared space, the first member being trusted by at least one of the second member and the plurality of other members, the first member providing at least one of the second member and the plurality of other members with a copy of the first representation; and

accessing at least one of the second member and the plurality of other members the first set of the at least one resource associated with the shared space and accessible to the second member and the plurality of other members through their respective copy of the first representation, the at least one resource provided to the first representation copies by at least one of the first member, the second member and a plurality of other members.

28. The medium as set forth in claim 16 wherein at least one of the first member, the second member and the plurality of other members store a copy of the first set of the at least one resource of the shared space.

29. The medium as set forth in claim 16 wherein at least one of the first member, the second member and the plurality of other members maintain a record log of operations involving the shared space.

30. The medium as set forth in claim 16 wherein the first member obtains a representation of at least one other shared space.

31. A system comprising:

a first representation of a shared space located at a first member, the shared space has a first set of at least one resource, the first set of at least one resource is accessible to the first member through the first representation, the at least one resource is accessible to the first representation through at least one of the first member, a second member and a plurality of other members.

32. The system as set forth in claim 31 further comprising a second representation of a shared space located at the second member, the shared space has a second set of at least one resource, the second set of at least one resource is accessible to the second member through the second representation, the at least one resource is accessible to the second representation through at least one of the first member, the second member and the plurality of other members.

33. The system as set forth in claim 31 further comprising a secure communication channel over which a commitment to a public key is encoded into range-limited signals and transferred between the first member and at least one of the second member and the plurality of other members.

34. The system as set forth in claim 31 wherein the first member has authorization information that describes at least one of the second member and the plurality of other members as being valid members of the shared space.

35. The system as set forth in claim 31 wherein at least one of the first member, the second member and the plurality of other members has current state information of the shared space.

36. The system as set forth in claim 31 wherein the first set of resources associated with the shared space is hosted at the first member, the first member being trusted by at least one of the second member and the plurality of other members, at least one of the second member and the plurality of other members having a copy of the first representation, the first set of the at least one resource associated with the shared space being accessible to at least one of the second member and the plurality of other members through their respective copy of the first representation, the at least one resource being provided to the first representation copies by at least one of the first member, the second member and a plurality of other members.

37. The system as set forth in claim 31 wherein at least one of the first member, the second member and the plurality of other members has a stored copy of the first set of the at least one resource of the shared space.

38. The system as set forth in claim 31 wherein at least one of the first member, the second member and the plurality of other members has a record log of operations involving the shared space.

39. The system as set forth in claim 31 wherein the first member has a representation of at least one other shared space.

40. The system as set forth in claim 31 wherein the first set of the at least one resource is associated with at least one of the first member, the second member and the plurality of other members.