Trust Management Systems and Methods
2 Assignments
0 Petitions
Accused Products
Abstract
The present invention provides systems and methods for making efficient trust management decisions. A trust management engine is provided that processes requests for system resources, authorizations or certificates, and the identity of one or more root authorities that are ultimately responsible for granting or denying the requests. To determine whether a request should be granted, the trust management engine identifies a set principals from whom authorization may flow, and interprets each of the certificates as a function of the state of one or more of the principals. The processing logic iteratively evaluates the functions represented by the certificates, updates the states of the principals, and repeats this process until a reliable determination can be made as to whether the request should be granted or denied. The certificates may be evaluated until the state of the root authority indicates that the request should be granted, or until further evaluation of the certificates is ineffective in changing the state of the principals.
76 Citations
38 Claims
-
1-20. -20. (canceled)
-
21. In a computer-implemented authorization management system, a method for controlling a user'"'"'s access to a computing resource that is managed by said computer-implemented authorization management system, the method including:
-
receiving an electronic request for the computing resource from a first principal;
identifying a set of principals associated with a group of computer-readable authorization certificates, each certificate in the group of computer-readable authorization certificates containing at least one computer-readable authorization by at least one principal, at least one certificate having been issued by a second principal;
initializing a set of authorization values associated with the principals of said set of principals;
evaluating a certificate as a monotone function, at least in part, of one or more authorization values associated with one or more of the principals;
updating the one or more authorization values associated with the one or more of the principals if the result of said evaluating step indicates that an authorization value of a principal should be changed; and
repeating said evaluating and updating steps until an endpoint is reached. - View Dependent Claims (22, 23, 24, 25, 26, 27, 28, 29)
-
-
30. A computer-implemented system for controlling access to electronic resources, the system comprising:
-
a first computer system for processing electronic requests for access to electronic resources, the first computer system comprising;
a computer network interface configured to receive digital certificates from a second computer system and for electronically receiving and processing requests to access electronic resources, wherein at least some of the requests are received from the second computer system;
a memory device in communication with said first computer system for storing electronic resources and one or more computer-readable authorization certificates relating to authorization for controlling access thereto; and
a trust management engine for processing digital certificates and requests for electronic resources, and for making access control decisions by creating a set of monotone authorization values and performing an endpoint computation using said authorization values. - View Dependent Claims (31, 32, 33, 34, 35, 36, 37, 38)
-
Specification