DISTRIBUTED PROTOCOL FOR AUTHORISATION

• US 20100313246A1
• Filed: 10/02/2008
• Published: 12/09/2010
• Est. Priority Date: 10/05/2007
• Status: Abandoned Application

• Current Assignee: ITI Scotland Limited (Scottish Government)
• Original Assignee: ITI Scotland Limited (Scottish Government)
• Inventors: McDiarmuid, Alisdair, Irvine, James
• Application Number:
  US12/680,151
• Publication Number:
  US 20100313246A1
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

A decentralised, distributed approach to performing authorisation involves receiving an authorisation request at a service providing device, for example “Carol”, and then retrieving trust information from other peer devices in the network. The gathered information is used by the device “Carol” to make a well-informed authorisation decision.

Claims

1. A method of performing authorisation between a first device and a second device in a wireless communications network, the method comprising the steps of:

sending a request for authorisation from the first device to the second device;

sending a first query message from the second device to at least one third device;

returning a first response message from the at least one third device to the second device;

wherein the first response message contains first authorisation data for use by the second device in determining whether to authorise the first device.

2. A method as claimed in claim 1, further comprising the steps of:

forwarding a second query message from a third device to a fourth device;

returning a second response message from the fourth device to the second device;

wherein the second response message from the fourth device contains second authorisation data for use by the second device in determining whether to authorise the first device.

3. A method as claimed in claim 2, wherein the second response message is returned from the fourth device to the second device via the third device.

4. A method as claimed in claim 1, wherein the first authorisation data comprises one or more predetermined assertions relating to the first device.

5. A method as claimed in claim 4, wherein a predetermined assertion relates to historical data between a device and the first device.

6. A method as claimed in claim 4, wherein a predetermined assertion comprises at least one trust value.

7. A method as claimed in claim 4, wherein a predetermined assertion comprises a first trust value and a second trust value.

8. A method as claimed in claim 6, further comprising the steps of:

determining a trust score at the second device based on one or more trust values received in one or more response messages; and

performing an authorisation decision at the second device using the determined trust score.

9. A method as claimed in claim 8, wherein the authorisation decision comprises the step of comparing the trust score with a threshold value, and authorising the first device if the trust score is higher than, or equal to, the threshold value.

10. A method as claimed in claim 1, further comprising the steps of:

including authentication data in a second response message sent from a device to the second device;

sending corresponding authentication data from said device to the first device; and

using the authentication data at the second device to perform authentication between the first device and the second device.

11. A method as claimed in claim 1, further comprising the step of transmitting messages between devices in a secure manner.

12. A method as claimed in claim 11, wherein the step of transmitting messages in a secure manner comprises the step of encrypting transmitted data and decrypting received data.

13. A method as claimed in claim 1, further comprising the step of providing a count value in a query message, wherein the count value is used to control whether a query message is forwarded from a particular device to another device.

14. A wireless network comprising:

a first device adapted to send a request for authorisation to a second device;

said second device being adapted to send a query message to at least one third device;

wherein the second device is further adapted to determine whether to authorise the first device using authorisation data sent to the second device by one or more of the third devices in response to receiving the query message.

15. A wireless network as claimed in claim 14, wherein a third device is adapted to forward the query message received from the second device to a fourth device, and wherein the fourth device is adapted to return a response message to the second device, the response message comprising authorisation data for use by the second device in determining whether to authorise the first device.

16. A wireless network as claimed in claim 15, wherein the fourth device is adapted to return the response message to the second device via the third device.

17. A wireless network as claimed in claim 14, wherein the authorisation data comprises one or more predetermined assertions relating to the first device.

18. A wireless network as claimed in claim 17, wherein a predetermined assertion relates to historical data between a device and the first device.

19. A wireless network as claimed in claim 17, wherein a predetermined assertion comprises at least one trust value.

20. A wireless network as claimed in claim 17, wherein a predetermined assertion comprises a first trust value and a second trust value.

21. A wireless network as claimed in claim 19, wherein the second device is further adapted to:

determine a trust score based on one or more trust values received in one or more response messages; and

perform an authorisation decision using the determined trust score.

22. A wireless network as claimed in claim 21, wherein the second device is adapted to compare the determined trust score with a threshold value, and authorise the first device if the trust score is higher than, or equal to, the threshold value.

23. A wireless network as claimed in claim 14, wherein the network is further adapted to:

transmit authentication data in a second response message sent from a device to the second device;

send corresponding authentication data from said device to the first device; and

use the authentication data at the second device to perform authentication between the first device and the second device.

24. A wireless network as claimed in claim 14, wherein the network is adapted to transmit messages between devices in a secure manner.

25. A wireless network as claimed in claim 24, wherein a device is adapted to encrypt transmitted data and decrypt received data.

26. A wireless network as claimed in claim 14, wherein a device is adapted to:

check a count value in a received message;

determine if the count value is equal to a predetermined value and, if not, decrement the count value and forward the received message to another connected device.

27. A device for use in a wireless network, the device being adapted to:

transmit a query message to at least one other device in the network in response to receiving a request for authorization from an unauthorised device that is not yet authorised for use in the network; and

determine whether to authorise the unauthorised device using authorisation data received from one or more of the at least one other device.