Certifying and grouping distributed objects

• US 20070028096A1
• Filed: 07/29/2005
• Published: 02/01/2007
• Est. Priority Date: 07/29/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Paramasivam, Muthukrishnan, England, Paul, Kurien, Thekkthalackal, Pandya, Ravindra, Rose, Charles
• Granted Patent: US 7,664,949 B2
• Time in Patent Office: Days
• US Class Current: 713/156
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

Disclosed herein is a technique for certifying distributable objects. The technique involves creating a certification for each distributable object to indicate properties of the object. Using certifications such as this, it is possible to accept objects having certain properties only from specified entities.

Claims

1. A method of certifying a distributable object, comprising:

creating a certification for each distributable object, the certification containing;

a description of one or more properties of the object;

a verifiable identification of an attesting entity who attests to said description; and

a verifiable identification of the distributable object;

making the certification available to potential users of the distributable object; and

referencing an authorization from a delegating entity in the certification, wherein the authorization authorizes the attesting entity to attest to one or more types of properties.

2. A method as recited in claim 1, wherein the authorization authorizes the attesting entity to attest to a limited number of properties.

3. A method as recited in claim 1, wherein creating the certification comprises creating a cryptographic certificate from the attesting entity, the verifiable identification of the distributable object comprising a hash of the distributable object.

4. A method as recited in claim 1, the authorized types of properties being specified by said authorization.

5. A method as recited in claim 1, further comprising conditioning use of distributable objects based on the properties of the objects and the identities of the entities who attest to those properties.

6. A method of certifying distributable objects, comprising:

authorizing different entities to attest to different properties of the distributable objects;

authorizing said different entities to authorize delegated entities to attest to sub-sets of the different properties to which said different entities are authorized to attest;

said properties of the distributable objects being attested to in certifications corresponding to the distributable objects.

7. A method as recited in claim 6, wherein a certification of a particular distributable object comprises:

a description of one or more properties of the particular distributable object;

a verifiable identification of the attesting entity who attests to said description; and

a verifiable identification of the distributable object.

8. A method as recited in claim 6, further comprising conditioning use of distributable objects based on the properties of the objects and the identities of the entities who attest to those properties.

9. A method as recited in claim 6, further comprising:

creating object groups, wherein a distributable object is a member of a group if its certification satisfies specified constraints; and

conditioning use of distributable objects depending on whether the distributable objects are members of one or more of the object groups.

10. A method as recited in claim 9, wherein an individual constraint comprises a particular property and an authorizing entity.

11. A method of qualifying distributable objects before using them, comprising:

obtaining certifications corresponding to the distributable objects, each certification comprising;

a description of one or more properties of the particular distributable object;

a verifiable identification of the attesting entity who attests to said description; and

a verifiable identification of the distributable object.

using any particular object if its certification indicates it meets one of a plurality of constraints, each constraint comprising one or more properties and one or more entities that are authorized to attest to said one or more properties.

12. A method as recited in claim 11, further comprising maintaining a list of said constraints.

13. A method as recited in claim 11, further comprising recognizing an attesting entity as being authorized to attest to a particular property if it has authorization from a delegating entity that is authorized to attest to said particular property.

14. A method as recited in claim 11, wherein the certification comprises a cryptographic certificate, the verifiable identification of the distributable object comprising a hash of the distributable object.

15. A method as recited in claim 11, further comprising:

maintaining object group definitions, wherein each object group definition comprises one or more of the constraints;

associating one or more permissions with each group definition;

granting permissions to a distributable object only if its certification satisfies the constraints of a group definition that is associated with those permissions.

16. A method as recited in claim 11, further comprising:

maintaining object group definitions as Boolean combinations of the constraints;

associating one or more permissions with each group definition;

granting permissions to a distributable object only if its certification satisfies the constraints of a group definition that is associated with those permissions.

17. A method as recited in claim 11, further comprising:

maintaining object group definitions, wherein each object group definition comprises one or more of the constraints;

associating one or more permissions with each group definition;

granting permissions to a distributable object only if its certification satisfies the constraints of a group definition that is associated with those permissions; and

creating a group identifier corresponding to each group definition, the group identifier being based on a hash of the group definition.

18. A method as recited in claim 11, further comprising:

maintaining object group definitions, wherein each object group definition comprises one or more of the constraints;

associating one or more permissions with each group definition;

assigning an unambiguous group identifier to each group definition; and

granting permissions to a distributable object only if its certification satisfies the constraints of a group definition that is associated with those permissions.

19. A method as recited in claim 11, further comprising:

maintaining object group definitions, wherein each object group definition comprises one or more of the constraints;

associating one or more permissions with each group definition;

assigning an unambiguous group identifier to each group definition;

granting permissions to a distributable object only if its certification satisfies the constraints of a group definition that is associated with those permissions; and

using the group identifiers to control access.

20. A method as recited in claim 11, further comprising:

maintaining object group definitions, wherein each object group definition comprises one or more of the constraints;

associating one or more permissions with each group definition;

granting permissions to a distributable object only if its certification satisfies the constraints of a group definition that is associated with those permissions; and

creating a group identifier corresponding to each group definition, the group identifier being based on a hash of the group definition;

wherein at least some of the object group definitions are combinations of other object group definitions.