Configuring Security Mechanisms Utilizing A Trust System

• US 20080301779A1
• Filed: 05/31/2007
• Published: 12/04/2008
• Est. Priority Date: 05/31/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Panasyuk, Anatoliy, Garg, Neeraj, Brewer, Jason
• Granted Patent: US 7,853,992 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Implementations of configuring security mechanisms utilizing a trust system are described. In one implementation, a request to communicate is received at a protected device. Before permission to communicate can be granted, a list of trusted devices is accessed. If information, such as an identity or a secret, associated with the device sending the request to communicate correlates to information found on the list of trusted devices, then communication can be allowed. Otherwise, communication between the device and the protected device can be denied.

Claims

1. A method comprising:

receiving a request at a protected device to communicate with a second device, the request including information associated with the second device;

accessing a list of trusted devices; and

allowing communication between the protected device and the second device if the information associated with the second device correlates to information on the list of trusted devices.

2. A method as recited in claim 1, wherein receiving includes receiving an identity of the second device via one or more of:

a certificate;

a physical layer address;

an Internet protocol (IP) address;

an IP security (Ipsec) designation.

3. A method as recited in claim 1, wherein receiving includes receiving information indicating that the second device has access to one or more secrets on the list of trusted devices.

4. A method as recited in claim 1, wherein accessing includes accessing the list of trusted devices from a location in memory on a device remote from the protected device.

5. A method as recited in claim 4, further comprising periodically synchronizing the list of trusted devices residing in a location in memory on the protected device with a second list of trusted devices residing on a device remote from the protected device.

6. A method as recited in claim 1, wherein allowing includes enabling one or more types of communication between the protected device and the second device consistent with a policy associated with the list of trusted devices.

7. A method as recited in claim 1, wherein allowing includes enabling a most secure form of communication as is possible between the protected device and the second device.

8. A method as recited in claim 1, further comprising updating the list of trusted devices by allowing a trusted user to access and amend the list of trusted devices through one or more of:

a webpage;

a pop up window.

9. A computer-readable medium having a set of computer-readable instructions residing thereon that, when executed, perform acts comprising:

accepting a request from a requesting device to communicate with a protected device;

accepting information associated with the requesting device from the requesting device;

querying a list of trusted devices for the information associated with the requesting device;

establishing a path of communication between the requesting device and the protected device if the information associated with the requesting device correlates to information on the list of trusted devices.

10. A computer-readable medium as recited in claim 9 having a set of computer-readable instructions that, when executed, perform acts further comprising restricting communication between the requesting device and the protected device to one or more types of communication found in a policy associated with the list of trusted devices.

11. A computer-readable medium as recited in claim 9 having a set of computer-readable instructions that, when executed, perform acts further comprising updating the list of trusted devices by synchronizing the list of trusted devices with a second list of trusted devices residing on a remote device.

12. A computer-readable medium as recited in claim 9 having a set of computer-readable instructions that, when executed, perform acts further comprising configuring a firewall associated with the protected device to allow communication between the requesting device and the protected device if the information associated with the requesting device correlates to information on the list of trusted devices.

13. A computer-readable medium as recited in claim 9 having a set of computer-readable instructions that, when executed, perform acts further comprising routing the path of communication between the requesting device and the protected device through a trusted server.

14. A computing-based device comprising:

a processor;

a memory including a communication security module, the communication security module comprising;

a communication request module configured to receive a request from a requesting device to communicate with the computing-based device, the requesting device having associated information;

a communication enforcement module configured to access a list of trusted devices and allow communication between the computing-based device and the requesting device if the associated information correlates to information on the list of trusted devices.

15. A computing-based device as recited in claim 14, wherein the associated information includes one or more of:

an identity of the computing-based device;

a secret.

16. A computing-based device as recited in claim 14, wherein the communication enforcement module is further configured to implement a most secure method of communication possible between the requesting device and the computing-based device if the associated information correlates to information on the list of trusted devices.

17. A computing-based device as recited in claim 14, wherein the communication enforcement module is further configured to configure a firewall associated with the computing-based device to allow communication between the requesting device and the computing-based device if the associated information correlates to information on the list of trusted devices.

18. A computing-based device as recited in claim 14, wherein the list of trusted devices is stored in the memory.

19. A computing-based device as recited in claim 18, wherein the communication enforcement module is further configured to synchronize the list of trusted devices stored in the memory with a second list of trusted devices stored on a trusted server remote from the computing-based device.

20. A computing-based device as recited in claim 14, further comprising a list modification module configured to allow a trusted user to modify the list of trusted devices.