Security Architecture

• US 20060143466A1
• Filed: 02/07/2006
• Published: 06/29/2006
• Est. Priority Date: 06/07/1999
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: Muller, Thomas, Roter, Martin
• Granted Patent: US 8,286,221 B2
• Time in Patent Office: Days
• US Class Current: 713/182
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 88/18 Service support devices; Network management devices

Abstract

A device for communicating with other devices to allow them to access applications, comprises: at least a first application; authentication means for authenticating a communicating device; and access control means accessible by a communicating device requesting access to the first application without the communicating device having been authenticated by the authentication means. The device is further arranged to arbitrate whether access of the communicating device to the first application is granted or refused wherein if the arbitration requires an authentication of the communicating device, the access control means instructs the authentication means to authenticate the communicating device.

Claims

1. A device for providing services and allowing access by other devices to the provided services, comprising:

an interface for communicating with the other devices and receiving requests to access a service therefrom;

arbitration means, for determining whether a requesting device communicating through the interface can access a service it has requested access to, arranged to store trust indications in association with requesting devices and arranged to receive from the interface an indication, originating from the other device, identifying the other device, wherein, if the requesting device has a stored trust indication associated therewith no user authorization is required and if the requesting device has no stored trust indication associated therewith user authorization is requirable; and

a user interface for providing user authorization.

2. A device as claimed in claim 1, wherein the arbitration means receives indications originating from the requesting device identifying the requesting device and the service requested.

3. A device as claimed in claim 1 comprising a plurality of services and a plurality of arbitration means where each service has an arbitration means connected to it.

4. A device as claimed in claim 3 wherein the plurality of arbitration means are arranged in a hierarchy, wherein a first arbitration means at the lowest level in the hierarchy provides access to at least a second arbitration means and access to one or both of a third arbitration means and a service, wherein access to each service is provided via one or more arbitration means including the first arbitration means and the service'"'"'s connected arbitration means, if different, and wherein any arbitration means is accessible by a requesting device requesting access to one of its connected services without the requesting device having been authorized, and is arranged to arbitrate whether access of the requesting device to the one connected service is granted or refused, wherein, if the requesting device has a stored trust indication associated therewith no user authorization is required and if the requesting device has no stored trust indication associated therewith user authorization is requirable.

5. A device as claimed in claim 1 having a device database which stores trust indications of different devices.

6. A device as claimed in claim 1 being portable, having a radio transceiver and wherein the user interface comprises a display and user input means.

7. A device for providing services and allowing access by other devices to the provided services, comprising:

an interface for communicating with the other devices and receiving requests to access a service therefrom;

arbitration means, for determining whether a requesting device communicating through the interface can access a service it has requested access to, arranged to store trust indications in association with requesting devices and store security indications in association with provided services and arranged to receive from the interface indications, originating from the other device, identifying the other device and the service requested, wherein, if the requesting device has a stored trust indication associated therewith no user authorization is required and if the requesting device has no stored trust indication associated therewith user authorization is required in dependence upon the stored security indication associated with the requested service; and

a user interface for providing user authorization.

8. A device as claimed in claim 7 wherein the stored security indications associated with services are indicative of whether user authorization is or is not required during arbitration, in independence of the identity of the requesting device.

9. A device as claimed in claim 7 wherein the arbitration means receives indications originating from the requesting device identifying the requesting device and the service requested.

10. A device as claimed in claim 7 comprising a plurality of services and a plurality of arbitration means where each service has an arbitration means connected to it.

11. A device as claimed in claim 10 wherein the plurality of arbitration means are arranged in a hierarchy, wherein a first arbitration means at the lowest level in the hierarchy provides access to at least a second arbitration means and access to one or both of a third arbitration means and a service, wherein access to each service is provided via one or more arbitration means including the first arbitration means and the service'"'"'s connected arbitration means, if different, and wherein any arbitration means is accessible by a requesting device requesting access to one of its connected services without the requesting device having been authorized, and is arranged to arbitrate whether access of the requesting device to the one connected service is granted or refused, wherein, if the requesting device has a stored trust indication associated therewith no user authorization is required and if the requesting device has no stored trust indication associated therewith user authorization is required in dependence upon the stored security indication associated with the requested service.

12. A device as claimed in claim 7 having a device database which stores trust indications of different devices.

13. A device as claimed in claim 7 having a service database for storing security indications of the accessible services.

14. A device as claimed in claim 7 being portable, having a radio transceiver and wherein the user interface comprises a display and user input means.