System and method for enabling authorization of a network device using attribute certificates

• US 20050228886A1
• Filed: 04/12/2004
• Published: 10/13/2005
• Est. Priority Date: 04/12/2004
• Status: Active Grant

• Current Assignee: Piece Future Pte., Ltd.
• Original Assignee: Nokia, Inc. (Nokia Corporation)
• Inventors: Cain, Adam, Barrett, Jeremey, Watkins, Craig R.
• Granted Patent: US 7,650,409 B2
• Time in Patent Office: Days
• US Class Current: 709/226
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

Methods and devices are directed to authorizing a network device to a resource over a network. An access server determines based, in part, on an attribute of the network device associated with the attribute certificate, whether the network device may be authorized access to the resource over the network. The attribute may be associated with a capability granted to the network device, a condition to be satisfied for the attribute to be valid, and the like. The attribute may belong to a group of network devices, or one or more users accessing the network through the network device. In one embodiment, the attribute certificate may be provided based on an automated security scan of the network device. In another embodiment, the access server may make the attribute available to a network resource associated with the access server.

Claims

1. A method for authorizing a network device, comprising:

determining an attribute based, in part, on a capability of the network device;

generating an attribute certificate based, in part, on the attribute;

storing the attribute certificate including the attribute; and

if the attribute certificate is valid, authorizing access to a resource over a network based, in part, on the attribute associated with the attribute certificate.

2. The method of claim 1, wherein the attribute is further determined based, in part, on an automated security scan of the network device.

3. The method of claim 1, wherein the attribute is further determined based, in part, on a condition to be satisfied.

4. The method of claim 1, wherein the attribute is further associated with a group of network devices.

5. The method of claim 1, wherein the attribute is further associated with a group of users.

6. The method of claim 1, wherein the attribute certificate is generated by at least one of the network device, an access server, and an attribute authority.

7. The method of claim 1, wherein the attribute certificate is stored in at least one of the network device, and an attribute repository.

8. The method of claim 7, wherein the attribute certificate is provided to an access server through the use of at least one of a cookie, a program, and a manual upload.

9. A network device for managing authorization to a resource over a network, comprising:

a first component configured to generate an attribute certificate, wherein the attribute certificate is based, in part, on a capability of another network device;

a second component, coupled to the first component, configured to store the attribute certificate; and

a third component, coupled to the second component, configured to authorize the other network device to the resource over the network based, in part, on the attribute of the other network device associated with the attribute certificate.

10. The network device of claim 9, wherein the first component is further configured to generate the attribute certificate based on a condition to be satisfied.

11. The network device of claim 9 further comprising a fourth component that is configured to perform an automated security scan of the other network device.

12. The network device of claim 11, wherein the first component is further configured to generate the attribute certificate based on the automated security scan of the other network device.

13. The network device of claim 9, wherein the second component is further configured to send the attribute certificate to the other network device to be stored, and the third component it further configured to receive the attribute certificate.

14. A network device for managing authorization to a resource over a network, comprising:

a means for generating an attribute certificate, wherein the attribute certificate is based on a capability of another network device;

a means for storing the attribute certificate; and

a means for authorizing the other network device to the resource over the network based, in part, on the attribute of the other network device associated with the attribute certificate.