METHODS, SYSTEMS, AND COMPUTER PROGRAM PRODUCTS FOR AUTHENTICATING AN ENTITY THROUGH USE OF A GLOBAL IDENTITY OF THE ENTITY THAT SERVES AS A PROXY FOR ONE OR MORE LOCAL IDENTITIES OF THE ENTITY

• US 20120159571A1
• Filed: 12/15/2010
• Published: 06/21/2012
• Est. Priority Date: 12/15/2010
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Novack, Brian, Toretti, Gary, Birkes, Jerry, Drake, Alton
• Granted Patent: US 9,241,003 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals

Abstract

A method of authenticating an entity includes associating a local identity of the entity with a global identity of the entity, the local identity being associated with a first one of a plurality of restricted access zones, associating the global identity of the entity with particular ones of the plurality of restricted access zones for granting access to the particular ones of the plurality of restricted access zones, receiving an authentication request from the entity to access a second one of the plurality of access zones where the authentication request includes the local identity of the entity, and authenticating the entity for access to the second one of the plurality of access zones responsive to receiving the authentication request when the second one of the plurality of restricted access zones is one of the particular ones of the plurality of restricted access zones that are associated with the global identity of the entity,

Claims

1. A method of authenticating an entity, comprising:

associating a local identity of the entity with a global identity of the entity, the local identity being associated with a first one of a plurality of restricted access zones;

associating the global identity of the entity with particular ones of the plurality of restricted access zones for granting access to the particular ones of the plurality of restricted access zones;

receiving an authentication request from the entity to access a second one of the plurality of access zones, the authentication request comprising the local identity of the entity; and

authenticating the entity for access to the second one of the plurality of access zones responsive to receiving the authentication request when the second one of the plurality of restricted access zones is one of the particular ones of the plurality of restricted access zones that are associated with the global identity of the entity.

2. The method of claim 1, wherein the entity has a plurality of local identities and wherein associating the local identity of the entity with the global identity of the entity comprises:

associating the plurality of local identities of the entity with the global identity of the entity.

3. The method of claim 1, wherein the restricted access zones are part of a common organization.

4. The method of claim 1, wherein the restricted access zones are unrelated to each other.

5. The method of claim 1, wherein the restricted access zones comprise a plurality of different geographic regions.

6. The method of claim 1, wherein associating the global identity with particular ones of the plurality of restricted access zones comprises:

receiving input from the entity that identifies the particular ones of the plurality of restricted access zones.

7. The method of claim 1, wherein associating the global identity of the entity with particular ones of the plurality of restricted access zones comprises:

receiving requests from the particular ones of the plurality of restricted access zones to associate the global identity of the entity with the particular ones of the plurality of restricted access zones, respectively.

8. A method of authenticating a node in a hierarchical network of nodes, comprising:

associating a local identity of the node with a global identity of the node;

associating the global identity of the node with a hierarchical position in the network of nodes;

receiving an authentication request from the node to connect to the hierarchical network of nodes at a requested hierarchical position, the authentication request comprising the local identity of the node; and

authenticating the node for a connection to the hierarchical network of nodes at the requested hierarchical position responsive to receiving the authentication request when the requested hierarchical position in the hierarchical network of nodes matches the hierarchical position in the network of nodes associated with the global identity.

9. The method of claim 8, wherein the hierarchical network of nodes comprises a plurality of restricted access zones, the method further comprising:

associating the global identity of the node with particular ones of the plurality of restricted access zones for granting access to the particular ones of the plurality of restricted access zones;

wherein receiving the authentication request from the node to connect to the hierarchical network of nodes comprises;

receiving an authentication request from the node to access one of the plurality of restricted access zones;

wherein authenticating the node for the connection to the hierarchical network of nodes comprises;

authenticating the node for the connection to the hierarchical network of nodes at the requested hierarchical position responsive to receiving the authentication request from the node to access the one of the plurality of restricted access zones when the one of the plurality of restricted access zones is one of the particular ones of the plurality of restricted access zones that are associated with the global identity of the node.

10. The method of claim 9, wherein the node has a plurality of local identities and wherein associating the local identity of the node with the global identity of the node comprises:

associating the plurality of local identities of the node with the global identity of the node.

11. The method of claim 9, wherein the restricted access zones are part of a common organization.

12. The method of claim 9, wherein the restricted access zones are unrelated to each other.

13. The method of claim 9, wherein the restricted access zones comprise a plurality of different geographic regions.

14. The method of claim 9, wherein associating the global identity of the node with particular ones of the plurality of restricted access zones comprises:

receiving requests from the particular ones of the plurality of restricted access zones to associate the global identity of the node with the particular ones of the plurality of restricted access zones, respectively.

15. The method of claim 8, wherein the hierarchical network of nodes comprises a hierarchical network topology of nodes.

16. The method of claim 8, wherein the hierarchical network of nodes comprises a hierarchical classification of the nodes that is based on geography.

17. The method of claim 8, wherein the hierarchical network of nodes comprises a hierarchical classification of the nodes that is based on associations between the respective ones of the nodes and respective organizations.

18. The method of claim 8, wherein at least one of the hierarchical network of nodes detects a presence of the node prior to authenticating the node for the connection to the hierarchical network of nodes.

19. The method of claim 8, wherein the node detects a presence of at least one of the hierarchical network of nodes prior to authenticating the node for the connection to the hierarchical network of nodes.

20. A system for authenticating an entity, comprising:

a processor; and

a memory coupled to the processor having computer readable program code stored therein that when executed by the processor is configured to cause the processor to

associate a local identity of the entity with a global identity of the entity, the local identity being associated with a first one of a plurality of restricted access zones, to associate the global identity of the entity with particular ones of the plurality of restricted access zones for granting access to the particular ones of the plurality of restricted access zones, to receive an authentication request from the entity to access a second one of the plurality of access zones, the authentication request comprising the local identity of the entity, and to authenticate the entity for access to the second one of the plurality of access zones responsive to receiving the authentication request when the second one of the plurality of restricted access zones is one of the particular ones of the plurality of restricted access zones that are associated with the global identity of the entity.