Access to a computing environment by computing devices

• US 20060265598A1
• Filed: 03/23/2006
• Published: 11/23/2006
• Est. Priority Date: 03/31/2005
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Ricca, Marco, Plaquin, David, Balacheff, Boris
• Granted Patent: US 8,984,291 B2
• Time in Patent Office: Days
• US Class Current: 713/182
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols

Abstract

A method for managing access to a computing environment by a computing device includes providing at least one credential that identifies both the computing device and a user of the computing device, storing data at the computing environment relating to the computing device and the user in association with the credential, and selectively granting an access request received from the computing device using the credential in accordance with the data stored at the computing environment.

Claims

1. A method for managing access to a computing environment by a computing device comprising:

providing at least one credential at the computing device, the at least one credential identifying both the computing device and a user of the computing device;

storing data at the computing environment relating to the computing device and the user in association with the at least one credential; and

with the computing environment, selectively granting an access request received from the computing device using the at least one credential in accordance with the data stored at the computing environment in association with the at least one credential.

2. A method as claimed in claim 1 wherein the computing environment comprises a processor adapted to implement an asset management policy for the computing device, and wherein the data relating to the computing device and the user comprises data relating to management of the computing device in accordance with the asset management policy.

3. A method as claimed in claim 1, wherein the computing device comprises a trusted component at least logically protected from a main processing environment of the computing device, and wherein the trusted component holds the at least one credential.

4. A method as claimed in claim 1, wherein the computing device is adapted to use the at least one credential to make the access request only when the user has been authenticated by the computing device.

5. A method as claimed in claim 3, wherein the computing device is adapted to use the at least one credential to make the access request only when the user has been authenticated by the computing device and wherein the trusted component is adapted to authenticate the user.

6. A method as claimed in claim 2, further comprising:

flagging data associated with the at least one credential as inactive in the event of at least one predetermined condition associated with the computing device, whereupon the access request received from the computing device using the at least one credential is not granted.

7. A method as claimed in claim 6, wherein the at least one predetermined condition is selected from a group of predetermined conditions comprising:

a reported loss or theft of the computing device;

a decommissioning of the computing device; and

an expiry of a predetermined time period with respect to the computing device since at least one of;

a presentation for inspection;

a last maintenance;

an update of anti-virus software;

an update of system software;

an update of the credentials; and

a synchronisation of the stored data.

8. A computing device adapted to obtain access to a computing environment, the computing device comprising:

a memory in which is stored at least one credential, the at least one credential identifying both the computing device and a user of the computing device; and

a processor programmed to make an access request to the computing environment, the access request comprising the at least one credential.

9. A computing device as claimed in claim 8, wherein the computing device comprises a trusted component at least logically protected from a main processing environment of the computing device, and wherein the memory comprises a memory of the trusted component which holds the at least one credential.

10. A computing device as claimed in claim 8, wherein the processor of the computing device is adapted to use the at least one credential to make the access request only when the user has been authenticated by the computing device and wherein the processor is programmed to authenticate the user.

11. A method as claimed in claim 9, wherein the computing device is adapted to use the at least one credential to make the access request only when the user has been authenticated by the computing device and wherein a processor of the trusted component is programmed to authenticate the user.

12. A computing system adapted to provide a computing device with access to a computing environment, the computing system comprising:

a data store containing at least one credential identifying both the computing device and a user of the computing device, and data associated with the at least one credential; and

a processor programmed to selectively grant a request for access to the computing environment in accordance with the data associated with the at least one credential.

13. A computing system as claimed in claim 12 wherein the computing environment comprises a processor adapted to implement an asset management policy for the computing device, and wherein the data relating to the computing device and the user comprises data relating to management of the computing device in accordance with the asset management policy.

14. A computing system as claimed in claim 12 wherein the processor is comprised within an AAA server.

15. A computing system as claimed in claim 12, wherein the data relating to the computing device comprises asset data relating to the computing device as stored in an asset database.

16. A computing system as claimed in claim 12, wherein the data relating to the user comprises data controlled by a Lightweight Directory Access Protocol server.

17. A computing system as claimed in claim 16, wherein the data controlled by the Lightweight Directory Access Protocol server comprises both user data and computing device data.

18. A computing system as claimed in claim 14, wherein the AAA server is adapted to implement an asset management policy for the computing device, and wherein the data relating to the computing device and the user comprises data relating to management of the computing device in accordance with the asset management policy.

19. A computing system as claimed in claim 18, wherein data associated with the at least one credential is flagged as inactive in the event of at least one predetermined condition associated with the computing device, whereupon the computing system is adapted to not grant the access request received from the computing device.

20. A computing system as claimed in claim 19, wherein the at least one predetermined condition is selected from a group of conditions comprising:

a reported loss or theft of the computing device;

a decommissioning of the computing device; and

an expiry of a predetermined time period with respect to the computing device since at least one of;

a presentation for inspection;

a last maintenance;

an update of anti-virus software;

an update of system software;

an update of the credentials and, a synchronisation of the stored data.