SYSTEMS, METHODS AND COMPUTER PROGRAM PRODUCTS FOR GENERATING ANONYMOUS ASSERTIONS

• US 20090193509A1
• Filed: 01/30/2008
• Published: 07/30/2009
• Est. Priority Date: 01/30/2008
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Landman, Benjamin M., Yoder, Kent E., Halcrow, Michael A., Cardone, Richard J.
• Granted Patent: US 7,996,891 B2
• Time in Patent Office: Days
• US Class Current: 726/9
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: H04L 63/0414 during transmission, i.e. party's identity is protected against eavesdropping, e.g. by using temporary identifiers, but is known to the other party or parties involved in the communication
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

Systems, methods and computer program products for generating anonymous assertions. Exemplary embodiments include a method for generating anonymous assertions, the method comprising engaging anonymous role authentication via one or more authenticator services, generating an assertion token on a trusted assertion device that is booted into a trusted configuration, and processing the assertion and validating a right of the user to make the assertion for the event.

Claims

1. A method for generating anonymous assertions, the method comprising:

engaging anonymous role authentication via one or more authenticator services, including;

submitting an anonymous authorization token request and user credentials to the one or more authenticator services;

authenticating a user via the user credentials;

determining whether the user is authorized to make an assertion of the anonymous assertions, based on an assertion type that applies to an event;

determining whether the user has already authenticated with the one or more authenticator services for the event;

in response to authorizing the user to make the assertion in the event, completing a blind signature process;

supplying an anonymous authorization token to the user, the anonymous authorization token enabling the user to make the assertion in the event;

generating an assertion token on a trusted assertion device that is booted into a trusted configuration, wherein the assertion token is transmitted from any one of a plurality of locations and is transmitted via an Onion Routing method thereby preventing an assertion evaluator from tracing a location of the assertion token and an identity of the user, wherein the assertion token includes the anonymous authorization token coupled to an assertion descriptor, a platform configuration register and log, and an attestation identity key signature;

processing the assertion and validating a right of the user to make the assertion for the event, including;

verifying the attestation identity key signature, which is registered and trusted by the assertion evaluator;

verifying the anonymous authorization token signature, in which a key for the anonymous authorization token signature is registered and trusted by the assertion evaluator;

verifying the platform configuration registers and the log, which are device-specific and attest a state of the device at a time the assertion token is generated; and

interpreting the assertion descriptor and the assertion.

2. The method as claimed in claim 1 wherein verifying the platform configuration registers and the log is performed by the trusted assertion device.

3. The method as claimed in claim 2 further comprising taking action in accordance with the interpreted assertion.