DEVICE AND METHOD OF GENERATING AND DISTRIBUTING ACCESS PERMISSION TO DIGITAL OBJECT

• US 20100098248A1
• Filed: 10/31/2007
• Published: 04/22/2010
• Est. Priority Date: 10/31/2006
• Status: Abandoned Application

• Current Assignee: Agency For Science Technology and Research (Government of Singapore)
• Original Assignee: Agency For Science Technology and Research (Government of Singapore)
• Inventors: Anantharaman, Lakshminarayanan
• Application Number:
  US12/447,883
• Publication Number:
  US 20100098248A1
• Time in Patent Office: Days
• US Class Current: 380/44
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30

Abstract

A system is provided, which includes at least one digital object owner client computing device, a trusted server computing device and at least one digital object consumer client computing device. Each of said at least one digital object owner client computing device is configured to transmit a created or amended access permission message to the trusted server computing device. The trusted server computing device is configured to generate, from the created or amended access permission message, at least one personalized access permission message, each of which is uniquely addressed to one of the at least one digital object consumer client computing device. The at least one digital object consumer client computing device is configured to enforce a download, from the trusted server computing device, of the at least one personalized access permission message uniquely addressed to the at least one digital object consumer client computing device.

Claims

1. A system for generating and distributing access permission to at least one digital object, comprising:

at least one digital object owner client computing device, wherein each of said at least one digital object owner client computing device is configured to transmit a created or amended access permission message to a trusted server computing device;

the trusted server computing device configured to generate at least one personalized access permission message from the created or amended access permission message, wherein each of the at least one personalized access permission message is uniquely addressed to one of at least one digital object consumer client computing device;

the at least one digital object consumer client computing device configured to enforce a download, from the trusted server computing device, of the at least one personalized access permission message uniquely addressed to the at least one digital object consumer client computing device.

2. The system of claim 1 further comprising a digital object access permission server computing device

wherein each of said at least one digital object owner client computing device is configured to transmit the created or amended access permission message to the digital object access permission server computing device and the digital object access permission server computing device is configured to transmit the created or amended access permission message to the trusted server computing device;

and

wherein the trusted server is configured to transmit the at least one personalized access permission message to the digital object access permission server computing device and the at least one digital object consumer client computing device is configured to enforce a download, from the digital object access permission server computing device, of the at least one personalized access permission message uniquely addressed to the at least one digital object consumer client computing device.

3. The system of claim 1,

wherein the created or amended access permission message is encrypted using a public key of the trusted server computing device or using a symmetric key and/or digitally signed using a private key of the digital object owner client computing device.

6. The system of claim 1,

wherein the at least one digital object owner client computing device comprises an access permission creation circuit to generate the created or amended access permission message to the at least one digital object for a uniquely addressed digital object consumer client computing device.

9. The system of claim 1,

wherein the trusted server computing device is configured to generate the at least one personalized access permission message at a plurality of predetermined time instants.

10. The system of claim 9,

wherein the at least one personalized access permission message comprises all created or amended access permission to the at least one digital object, or comprises access permission which has been created or amended since the previous generated personalized access permission message.

12. The system of claim 1,

wherein the at least one digital object consumer client computing device comprises an enforcer circuit to enforce the download of the at least one personalized access permission message at a plurality of predetermined time instants.

13. The system of claim 1,

wherein the at least one digital object consumer client computing device comprises an access control circuit to control the access to the at least one digital object depending on the downloaded at least one personalized access permission message.

14. The system of claim 1,

wherein the at least one digital object consumer client computing device comprises a cryptographic circuit to provide at least one public key cryptographic algorithm, the cryptographic circuit being configured to authenticate the trusted server computing device using the public key of the trusted server computing device.

19. The system of claim 1,

wherein the created or amended access permission message include at least one of the following data items:

identity of the digital object owner client computing device;

time of the created or amended access permission message;

identity of at least one digital object consumer client computing device;

identity of the at least one digital object;

type, time and duration of new access permission associated with the at least one digital object and the at least one digital object consumer client computing device;

type and time of amended access permission associated with the at least one digital object and the at least one digital object consumer client computing device;

expiry date of the previous created or amended access permission,

digital signature of the digital object owner client computing device.

4-5. -5. (canceled)

7-8. -8. (canceled)

11. (canceled)

15-18. -18. (canceled)

20-24. -24. (canceled)

25. A trusted server computing device, comprising:

a receiver to receive at least one created or amended access permission message generated by at least one digital object owner client computing device;

an access permission creation circuit to generate at least one personalized access permission message for at least one digital object from the received created or amended access permission message,

wherein each of the at least one personalized access permission message is uniquely addressed to one of at least one digital object consumer client computing device;

a transmitter to transmit the at least one personalized access permission message.

27. The trusted server computing device of claim 25, further comprising

a cryptographic circuit to provide at least one public key cryptographic algorithm, wherein the cryptographic circuit is configured to protect the at least one personalized access permission message using its private key, or configured to encrypt the at least one personalized access permission message using a symmetric key.

26. (canceled)

28-36. -36. (canceled)

37. A method of generating and distributing access permission to at least one digital object, the method comprising:

receiving, by a trusted server computing device, a created or amended access permission message from each of at least one digital object owner client computing device;

generating, by the trusted server computing device, at least one personalized access permission message from the created or amended access permission message, wherein each of the at least one personalized access permission message is uniquely addressed to one of at least one digital object consumer client computing device;

enforcing a download of the at least one personalized access permission message from the trusted server computing device to the digital object consumer client computing device uniquely addressed in the at least one personalized access permission message.

38. The method of claim 37, further comprising:

receiving, by a digital object access permission server computing device, the created or amended access permission message from each of the at least one digital object owner client computing device;

receiving, by the trusted server computing device, the created or amended access permission message from the digital object access permission server computing device;

transmitting the at least one personalized access permission message to the digital object access permission server computing device; and

enforcing a download of the at least one personalized access permission message from the digital object access permission server computing device to the digital object consumer client computing device uniquely addressed in the at least one personalized access permission message.

40. The method of claim 37, further comprising

generating the created or amended access permission message to the at least one digital object by the at least one digital object owner client computing device.

41. The method of claim 37, further comprising

encrypting the created or amended access permission message using a public key of the trusted server computing device or using a symmetric key and/or digitally signing the created or amended access permission message using a private key of the at least one digital object owner client computing device.

44. The method of claim 37, further comprising

generating the at least one personalized access permission message at a plurality of predetermined time instants.

45. The method of claim 44,

wherein the at least one personalized access permission message comprises all created or amended access permission to the at least one digital object, or comprises access permission which has been created or amended since the previous generated personalized access permission message.

47. The method of claim 37,

wherein the download of the at least one personalized access permission message is enforced at a plurality of predetermined time instants.

48. The method of claim 37, further comprising

controlling, by the at least one digital object consumer client computing device, the access to the at least one digital object depending on the downloaded at least one personalized access permission message.

49. The method of claim 37, further comprising

authenticating, by the at least one digital object consumer client computing device, the trusted server computing device using the public key of the trusted server computing device.

39. (canceled)

42-43. -43. (canceled)

46. (canceled)

50-57. -57. (canceled)

58. A method of generating a personalized access permission message by a trusted server computing device, the method comprising:

receiving at least one created or amended access permission message;

generating at least one personalized access permission message for at least one digital object from the received created or amended access permission message,

wherein each of the at least one personalized access permission message is uniquely addressed to one of at least one digital object consumer client computing device;

transmitting the at least one personalized access permission message.

60. The method of claim 58, further comprising

providing at least one public key cryptographic algorithm, thereby cryptographically protecting the at least one personalized access permission message using its private key.

59. (canceled)

61-67. -67. (canceled)