Identifying a computing device

• US 20080301298A1
• Filed: 02/25/2003
• Published: 12/04/2008
• Est. Priority Date: 07/29/2002
• Status: Abandoned Application

• Current Assignee: BEA Systems Incorporated (Oracle Corporation)
• Original Assignee: BEA Systems Incorporated (Oracle Corporation)
• Inventors: Douglas, David C., Traub, Kenneth R., Birger, Chet, Bernardi, Linda, Rosenthal, Steven
• Application Number:
  US10/372,398
• Publication Number:
  US 20080301298A1
• Time in Patent Office: Days
• US Class Current: 709/226
• CPC Class Codes: H04L 61/50 Address allocation
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]

Abstract

A computer architecture for enterprise device applications that provides a real-time, bi-directional communication layer for device communication. An identity-based communications layer provides for secure, end-to-end telemetry and control communications by enabling mutual authentication and encryption between the devices and the enterprise. A unique identity is assigned to each device, user and application to provide security services. The unique identity is independent of a network-address. Security information and a network address may be associated with the unique identity.

Claims

1. A method for identifying a computing device connected to a network, the method comprising:

associating a network-address-independent identity identifier with a computing device connected to a network, the identity identifier being independent of a network address of the computing device and unique across computing devices connected to the network;

associating with the identity identifier security information for use in authentication of the computing device; and

associating a network address of the computing device with the identity identifier, wherein the network address comprises a global address that specifies a protocol, a network identifier, and an address meaningful for the combination of the protocol and a network identified by the network identifier.

2. The method of claim 1 wherein the identity identifier is not modifiable.

3. The method of claim 2 wherein the security information is modifiable.

4. The method of claim 2 wherein the network address of the computing device is modifiable.

5. The method of claim 1 wherein the identity identifier includes a realm portion associated with an issuing authority and a unique identifier portion that is unique across all identity identifiers issued by the issuing authority.

6. The method of claim 5 wherein the realm portion is an Internet domain name.

8. The method of claim 1 further comprising associating a hierarchical identifier with the identity identifier, the hierarchical identifier being a unique identifier across all hierarchical identifiers maintained by an issuing authority.

9. The method of claim 8 wherein the hierarchical identifier is user-modifiable.

10. The method of claim 8 wherein the hierarchical identifier is based on a hierarchical path from a root node of a directory tree to a node associated with the identity identifier.

11. The method of claim 1 further comprising associating user-defined information with the identity identifier.

12. The method of claim 11 wherein the user-defined information comprises an attribute name and an attribute value.

13. The method of claim 11 wherein the user-defined information comprises a series of attribute names, with each attribute name being associated with an attribute value.

14. The method of claim 11 further comprising associating a version identifier with the user-defined information.

15. The method of claim 14 wherein the version identifier comprises an integer that is incremented each time the user-defined information is modified.

16. The method of claim 1 wherein the security information comprises a cryptographic key.

17. The method of claim 16 wherein the cryptographic key comprises a symmetric key.

18. The method of claim 17 further comprising:

providing the symmetric key to an authentication service; and

authenticating the computing device by sending to the computing device a challenge, receiving from the computing device the result of using the symmetric key to encrypt the challenge, encrypting the challenge using the symmetric key, comparing the received result with the encrypted challenge, and determining the computing device is authentic when the received result matches the encrypted challenge.

19. The method of claim 1 further comprising associating policy rules with the identity identifier.

20. The method of claim 1 further comprising:

associating a second identity identifier with an entity having significance within the context of an application involving the computing device; and

associating with the second identity identifier security information for use in authenticating the entity.

21. The method of claim 20 wherein the entity is a user.

22. The method of claim 20 wherein the entity is a software application.

23. The method of claim 20 further comprising creating a composite identity by:

associating a third identity identifier with two or more identity identifiers, wherein the third identity identifier being the identity identifier of the composite identity; and

associating with the third identity identifier security information for use in authenticating the composite identity.

24. The method of claim 23 wherein at least one of the two or more identity identifiers associated with the composite identity comprises the identity identifier associated with the computing device.

25. The method of claim 23 wherein at least one of the two or more identity identifiers associated with the composite identity comprises the second identity identifier associated with the entity having significance within the context of an application involving the computing device.

26. The method of claim 23 wherein the composite identity identifier is associated with an authentication credential.

27. The method of claim 23 further comprising creating the composite identity only when each of the two or more identity identifiers of the composite identity have been authenticated.

28. The method of claim 23 wherein at least one of the two or more identity identifiers associated with the composite identity comprises an identity identifier for another composite identity.

29. The method of claim 23 further comprising:

authenticating each of two or more identity identifiers using the security information associated with each such identity identifier; and

only associating the third identity identifier with the two or more identity identifiers when all of the two or more identity identifiers are successfully authenticated.

30. The method of claim 23 further comprising associating data sent by the entity from the computing device with the third identity identifier.

31. The method of claim 1 further comprising associating data sent from the computing device over the network with the identity identifier.

32. The method of claim 28 further comprising associating data sent by the entity from the computing device with the third identity identifier.

33. The method of claim 1 further comprising having the computing device use an identity identifier of a second computing device to communicate with the second endpoint, wherein an application associated with the computing device provides to an identity-based communication layer (1) a message directed to the second computing device and (2) the identity identifier of the second computing device.

34. The method of claim 33 further comprising:

associating a network address with the identity identifier of the second computing device, and

having the identity-based communication layer transmit the message to the second computing device using the network address.

35. The method of claim 34 wherein:

the network address of the second computing device specifies a protocol, a network identifier, and an address meaningful for the combination of the protocol and a network identified by the network identifier; and

transmitting the message to the second computing device comprises selecting an appropriate network layer based on the protocol and network identifier, and providing to the network layer (1) the message directed to the second computing device and (2) the address meaningful for the combination of the protocol and network identified by the network identifier.

36. The method of claim 35 wherein the selected networking layer transmits the message using the protocol specified by the network address of the second endpoint.

37. The method of claim 34 further comprising:

having the second computing device announce the network address of the second computing device through the use of the presence/availability service that provides the global address in response to a received identity identifier; and

having the identity-based communication layer use the presence/availability service to determine the network address associated with the identity identifier of the second computing device.

7. (canceled)

38. A computer-readable medium having embodied thereon a computer program configured to identify a computing device connected to a network, the medium comprising one or more code segments configured to:

associate a network-address-independent identity identifier with a computing device connected to a network, the identity identifier being independent of a network address of the computing device and unique across computing devices connected to the network;

associate with the identity identifier security information for use in authentication of the computing device; and

associate a network address of the computing device with the identity identifier, wherein the network address comprises a global address that specifies a protocol, a network identifier, and an address meaningful for the combination of the protocol and a network identified by the network identifier.

39. The medium of claim 38 wherein the identity identifier includes a realm portion associated with an issuing authority and a unique identifier portion that is unique across all identity identifiers issued by the issuing authority.

41. The medium of claim 38 wherein the one or more code segments are further configured to associate a hierarchical identifier with the identity identifier, the hierarchical identifier being a unique identifier across all hierarchical identifiers maintained by an issuing authority.

42. The medium of claim 38 wherein the one or more code segments are further configured to associate user-defined information with the identity identifier.

43. The medium of claim 42 wherein the user-defined information includes a version identifier having an integer that is incremented each time the user-defined information is modified.

44. The medium of claim 38 wherein the one or more code segments are further configured to associate policy rules with the identity identifier.

45. The medium of claim 38 wherein the one or more code segments are further configured to:

associate a second identity identifier with an entity having significance within the context of an application involving the computing device; and

associate with the second identity identifier security information for use in authenticating the entity.

46. The medium of claim 45 wherein the one or more code segments are further configured to create a composite identity by:

associating a third identity identifier with two or more identity identifiers, wherein the third identity identifier being the identity identifier of the composite identity; and

associating with the third identity identifier security information for use in authenticating the composite identity.

47. The medium of claim 46 wherein at least one of the two or more identity identifiers associated with the composite identity comprises the identity identifier associated with the computing device.

48. The medium of claim 46 wherein at least one of the two or more identity identifiers associated with the composite identity comprises the second identity identifier associated with the entity having significance within the context of an application involving the computing device.

49. The medium of claim 46 wherein the composite identity identifier is associated with an authentication credential.

50. The medium of claim 38 wherein the one or more code segments are further configured to have the computing device use an identity identifier of a second computing device to communicate with the second endpoint, wherein an application associated with the computing device provides to an identity-based communication layer (1) a message directed to the second computing device and (2) the identity identifier of the second computing device.

51. The medium of claim 50 wherein the one or more code segments are further configured to:

associate a network address with the identity identifier of the second computing device, and

have the identity-based communication layer transmit the message to the second computing device using the network address.

52. The medium of claim 51 wherein:

the network address of the second computing device specifies a protocol, a network identifier, and an address meaningful for the combination of the protocol and a network identified by the network identifier; and

the one or more code segments are configured to transmit the message to the second computing device by selecting an appropriate network layer based on the protocol and network identifier, and providing to the network layer (1) the message directed to the second computing device and (2) the address meaningful for the combination of the protocol and network identified by the network identifier.

40. (canceled)

53. A system for identifying a computing device connected to a network, the system comprising a processor connected to a storage device and one or more input/output devices, wherein the processor is configured to:

associate a network-address-independent identity identifier with a computing device connected to a network, the identity identifier being independent of a network address of the computing device and unique across computing devices connected to the network;

associate with the identity identifier security information for use in authentication of the computing device; and

associate a network address of the computing device with the identity identifier, wherein the network address comprises a global address that specifies a protocol, a network identifier, and an address meaningful for the combination of the protocol and a network identified by the network identifier.

54. The system of claim 53 wherein the identity identifier includes a realm portion associated with an issuing authority and a unique identifier portion that is unique across all identity identifiers issued by the issuing authority.

56. The system of claim 53 wherein the processor is further configured to associate a hierarchical identifier with the identity identifier, the hierarchical identifier being a unique identifier across all hierarchical identifiers maintained by an issuing authority.

57. The system of claim 53 wherein the processor is further configured to associate user-defined information with the identity identifier.

58. The system of claim 57 wherein the user-defined information includes a version identifier having an integer that is incremented each time the user-defined information is modified.

59. The system of claim 53 wherein the processor is further configured to associate policy rules with the identity identifier.

60. The system of claim 53 wherein the processor is further configured to:

associate a second identity identifier with an entity having significance within the context of an application involving the computing device; and

associate with the second identity identifier security information for use in authenticating the entity.

61. The system of claim 60 wherein the processor is further configured to create a composite identity by:

associating a third identity identifier with two or more identity identifiers, wherein the third identity identifier being the identity identifier of the composite identity; and

associating with the third identity identifier security information for use in authenticating the composite identity.

62. The system of claim 61 wherein at least one of the two or more identity identifiers associated with the composite identity comprises the identity identifier associated with the computing device.

63. The system of claim 61 wherein at least one of the two or more identity identifiers associated with the composite identity comprises the second identity identifier associated with the entity having significance within the context of an application involving the computing device.

64. The system of claim 61 wherein the composite identity identifier is associated with an authentication credential.

65. The system of claim 53 wherein the processor is further configured to have the computing device use an identity identifier of a second computing device to communicate with the second endpoint, wherein an application associated with the computing device provides to an identity-based communication layer (1) a message directed to the second computing device and (2) the identity identifier of the second computing device.

66. The system of claim 65 wherein the processor is further configured to:

associate a network address with the identity identifier of the second computing device, and

have the identity-based communication layer transmit the message to the second computing device using the network address.

67. The system of claim 66 wherein:

the network address of the second computing device specifies a protocol, a network identifier, and an address meaningful for the combination of the protocol and a network identified by the network identifier; and

the processor is configured to transmit the message to the second computing device by selecting an appropriate network layer based on the protocol and network identifier, and providing to the network layer (1) the message directed to the second computing device and (2) the address meaningful for the combination of the protocol and network identified by the network identifier.

55. (canceled)