Securing Organizational Computing Assets over a Network Using Virtual Domains

• US 20140223515A1
• Filed: 03/11/2013
• Published: 08/07/2014
• Est. Priority Date: 02/01/2013
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Vidder, Inc. (Verizon Communications Inc.)
• Inventors: Islam, Junaid, Bilger, Brent, Schroeder, Ted
• Granted Patent: US 9,027,086 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: H04L 2101/69 using geographic information, e.g. room number
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/562 Brokering proxy services

Abstract

A method for connecting to a trust broker system is disclosed. The electronic device stores encrypted identifying information for a plurality of client systems authorized to interact with the server system, wherein the encrypted identifying information is changed per client system per session. The electronic device creates a plurality of virtual domains; each virtual domain representing a set of services and information distinct from the other virtual domains. The electronic device stores permissions associated with each respective client system in the plurality of client system. The electronic device receives a request from a first client system, including encrypted identifying information associated with the first client system, for information associated with a first virtual domain and then retrieves stored permissions of the first client system based on the encrypted identifying information. The electronic device determines whether the first client system is permitted to access the requested first virtual domain.

Claims

1. A method for securing communication over a network, comprising:

at a server system having one or more processors and memory storing one or more programs for execution by the one or more processors;

storing encrypted identifying information for a plurality of client systems authorized to interact with the server system, wherein the encrypted identifying information is changed per client system per session;

creating a plurality of virtual domains;

each virtual domain representing a set of services and information distinct from the other virtual domains;

storing permissions associated with each respective client system in the plurality of client system;

wherein the stored permissions indicate the virtual domains accessible to the respective client systems;

receiving a request from a first client system, including encrypted identifying information associated with the first client system, for information associated with a first virtual domain;

retrieving stored permissions of the first client system based on the encrypted identifying information; and

determining, based on the stored permissions associated with the first client system, whether the first client system is permitted to access the requested first virtual domain.

2. The method of claim 1, further including:

in accordance with a determination that the first client system is not permitted to access the requested first virtual domain;

rejecting the first client system'"'"'s request for information associated with the first virtual domain; and

notifying the first client system of the rejection.

3. The method of claim 1, further including:

in accordance with a determination that the first client system is permitted to access the requested first virtual domain;

transmitting the requested information to the first client system.

4. The method of claim 1, wherein communications between the server system and the client system are encrypted.

5. The method of claim 1, wherein the permissions are associated with a user of the first client system.

6. The method of claim 5, wherein the permissions associated with the user are based on the user'"'"'s role.

7. The method of claim 1, wherein determining, based on the stored permissions associated with the first client system, whether the first client system is permitted to access the requested first virtual domain, further includes:

determining a current geographic location of the client system; and

if the client system is outside of a predetermined geographical area, rejecting the client system'"'"'s request for information.

8. An electronic device for securing communication over a network, comprising:

one or more processors;

memory storing one or more programs to be executed by the one or more processors;

the one or more programs comprising instructions for;

storing encrypted identifying information for a plurality of client systems authorized to interact with the server system, wherein the encrypted identifying information is changed per client system per session;

creating a plurality of virtual domains;

each virtual domain representing a set of services and information distinct from the other virtual domains;

storing permissions associated with each respective client system in the plurality of client system;

wherein the stored permissions indicate the virtual domains accessible to the respective client systems;

receiving a request from a first client system, including encrypted identifying information associated with the first client system, for information associated with a first virtual domain;

retrieving stored permissions of the first client system based on the encrypted identifying information; and

determining, based on the stored permissions associated with the first client system, whether the first client system is permitted to access the requested first virtual domain.

9. The device of claim 8, further including instructions for:

in accordance with a determination that the first client system is not permitted to access the requested first virtual domain;

rejecting the first client system'"'"'s request for information associated with the first virtual domain; and

notifying the first client system of the rejection.

10. The device of claim 8, further including instructions for:

in accordance with a determination that the first client system is permitted to access the requested first virtual domain;

transmitting the requested information to the first client system.

11. The device of claim 8, wherein communications between the server system and the client system are encrypted.

12. The device of claim 8, wherein the permissions are associated with a user of the first client system.

13. The device of claim 12, wherein the permissions associated with the user are based on the user'"'"'s role.

14. The device of claim 8, wherein instructions for determining, based on the stored permissions associated with the first client system, whether the first client system is permitted to access the requested first virtual domain, further include instructions for:

determining a current geographic location of the client system; and

if the client system is outside of a predetermined geographical area, rejecting the client system'"'"'s request for information.

15. A non-transitory computer readable storage medium storing one or more programs configured for execution by an electronic device with a camera, the one or more programs comprising instructions for:

at a server system having one or more processors and memory storing one or more programs for execution by the one or more processors;

storing encrypted identifying information for a plurality of client systems authorized to interact with the server system, wherein the encrypted identifying information is changed per client system per session;

creating a plurality of virtual domains;

each virtual domain representing a set of services and information distinct from the other virtual domains;

storing permissions associated with each respective client system in the plurality of client system;

wherein the stored permissions indicate the virtual domains accessible to the respective client systems;

receiving a request from a first client system, including encrypted identifying information associated with the first client system, for information associated with a first virtual domain;

retrieving stored permissions of the first client system based on the encrypted identifying information; and

determining, based on the stored permissions associated with the first client system, whether the first client system is permitted to access the requested first virtual domain.

16. The non-transitory computer readable storage medium of claim 15, further including instructions for:

in accordance with a determination that the first client system is not permitted to access the requested first virtual domain;

rejecting the first client system'"'"'s request for information associated with the first virtual domain; and

notifying the first client system of the rejection.

17. The non-transitory computer readable storage medium of claim 15, further including instructions for:

in accordance with a determination that the first client system is permitted to access the requested first virtual domain;

transmitting the requested information to the first client system.

18. The non-transitory computer readable storage medium of claim 15, wherein communications between the server system and the client system are encrypted.

19. The non-transitory computer readable storage medium of claim 15, wherein the permissions are associated with a user of the first client system.

20. The non-transitory computer readable storage medium of claim 15, wherein the instructions for determining, based on the stored permissions associated with the first client system, whether the first client system is permitted to access the requested first virtual domain, further include instructions for:

determining a current geographic location of the client system; and

if the client system is outside of a predetermined geographical area, rejecting the client system'"'"'s request for information.