MANAGING NETWORK IDENTITIES

• US 20130298258A1
• Filed: 05/03/2012
• Published: 11/07/2013
• Est. Priority Date: 05/03/2012
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP AG (SAP SE)
• Inventors: Puri, Sunil
• Granted Patent: US 8,875,307 B2
• Time in Patent Office: Days
• US Class Current: 726/28
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: H04L 12/44 Star or tree networks
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

Techniques for managing network identities include generating, with a local computing system, a tree structure representing a network comprising a plurality of entities, the tree structure comprising a plurality of nodes, each node of the plurality of nodes representing an entity of the plurality of entities, at least one entity of the plurality of entities is represented by more than one node of the plurality of nodes; assigning a unique identifier to each node; identifying each node of the plurality of nodes as being a protected node or an unprotected node; and transmitting, to a remote computing system, the tree structure, the unique identifiers for the protected nodes, and identity information of the entities for the unprotected nodes.

Claims

1. A method for managing network identities, the method comprising:

generating, with a local computing system, a tree structure representing a network comprising a plurality of entities, the tree structure comprising a plurality of nodes, each node of the plurality of nodes representing an entity of the plurality of entities, at least one entity of the plurality of entities is represented by more than one node of the plurality of nodes;

assigning a unique identifier to each node;

identifying each node of the plurality of nodes as being a protected node or an unprotected node; and

transmitting, to a remote computing system, the tree structure, the unique identifiers for the protected nodes, and identity information of the entities for the unprotected nodes.

2. The method of claim 1, wherein assigning a unique identifier to each node comprises:

generating a number by combining an identification number of the entity associated with the node and identification numbers of entities associated with nodes along a path from a root node of the tree structure to the node; and

encrypting the combined number.

3. The method of claim 1, wherein assigning a unique identifier to each node comprises:

assigning a unique number to each node based on a path from a root node of the tree structure to the node.

4. The method of claim 1, wherein assigning a unique identifier to each node comprises:

assigning a unique number to each node based on an order that a user of the remote computing system expands the nodes of the tree structure.

5. The method of claim 1, further comprising:

maintaining a mapping of each unique identifier to information about the entity associated with the node associated with the unique identifier.

6. The method of claim 1, wherein identifying each node of the plurality of nodes as being a protected node or an unprotected node comprises:

determining that a user of the remote computing system has permission to view identity information of the entity associated with the node; and

identifying the node as being an unprotected node.

7. The method of claim 1, wherein identifying each node of the plurality of nodes as being a protected node or an unprotected node comprises:

determining that a user of the remote computing system does not have permission to view identity information of the entity associated with the node; and

identifying the node as being a protected node.

8. The method of claim 1, wherein the at least one entity represented by more than one node of the plurality of nodes is associated with at least one protected node.

9. A computer storage medium encoded with a computer program, the program comprising instructions that when executed by one or more computers cause the one or more computers to perform operations comprising:

generating, with a local computing system, a tree structure representing a network comprising a plurality of entities, the tree structure comprising a plurality of nodes, each node of the plurality of nodes representing an entity of the plurality of entities, at least one entity of the plurality of entities is represented by more than one node of the plurality of nodes;

assigning a unique identifier to each node;

identifying each node of the plurality of nodes as being a protected node or an unprotected node; and

transmitting, to a remote computing system, the tree structure, the unique identifiers for the protected nodes, and identity information of the entities for the unprotected nodes.

10. The computer storage medium of claim 9, wherein assigning a unique identifier to each node comprises:

generating a number by combining an identification number of the entity associated with the node and identification numbers of entities associated with nodes along a path from a root node of the tree structure to the node; and

encrypting the combined number.

11. The computer storage medium of claim 9, wherein assigning a unique identifier to each node comprises:

assigning a unique number to each node based on a path from a root node of the tree structure to the node.

12. The computer storage medium of claim 9, wherein assigning a unique identifier to each node comprises:

assigning a unique number to each node based on an order that a user of the remote computing system expands the nodes of the tree structure.

13. The computer storage medium of claim 9, further comprising:

maintaining a mapping of each unique identifier to information about the entity associated with the node associated with the unique identifier.

14. The computer storage medium of claim 9, wherein identifying each node of the plurality of nodes as being a protected node or an unprotected node comprises:

determining that a user of the remote computing system has permission to view identity information of the entity associated with the node; and

identifying the node as being an unprotected node.

15. The computer storage medium of claim 9, wherein identifying each node of the plurality of nodes as being a protected node or an unprotected node comprises:

determining that a user of the remote computing system does not have permission to view identity information of the entity associated with the node; and

identifying the node as being a protected node.

16. The computer storage medium of claim 9, wherein the at least one entity represented by more than one node of the plurality of nodes is associated with at least one protected node.

17. A system of one or more computers configured to perform operations comprising:

generating, with a local computing system, a tree structure representing a network comprising a plurality of entities, the tree structure comprising a plurality of nodes, each node of the plurality of nodes representing an entity of the plurality of entities, at least one entity of the plurality of entities is represented by more than one node of the plurality of nodes;

assigning a unique identifier to each node;

identifying each node of the plurality of nodes as being a protected node or an unprotected node; and

transmitting, to a remote computing system, the tree structure, the unique identifiers for the protected nodes, and identity information of the entities for the unprotected nodes.

18. The system of claim 17, wherein assigning a unique identifier to each node comprises:

generating a number by combining an identification number of the entity associated with the node and identification numbers of entities associated with nodes along a path from a root node of the tree structure to the node; and

encrypting the combined number.

19. The system of claim 17, wherein assigning a unique identifier to each node comprises:

assigning a unique number to each node based on a path from a root node of the tree structure to the node.

20. The system of claim 17, wherein assigning a unique identifier to each node comprises:

assigning a unique number to each node based on an order that a user of the remote computing system expands the nodes of the tree structure.

21. The system of claim 17, further comprising:

maintaining a mapping of each unique identifier to information about the entity associated with the node associated with the unique identifier.

22. The system of claim 17, wherein identifying each node of the plurality of nodes as being a protected node or an unprotected node comprises:

determining that a user of the remote computing system has permission to view identity information of the entity associated with the node; and

identifying the node as being an unprotected node.

23. The system of claim 17, wherein identifying each node of the plurality of nodes as being a protected node or an unprotected node comprises:

determining that a user of the remote computing system does not have permission to view identity information of the entity associated with the node; and

identifying the node as being a protected node.

24. The system of claim 17, wherein the at least one entity represented by more than one node of the plurality of nodes is associated with at least one protected node.