METHODS AND SYSTEMS FOR SECURE AND RELIABLE IDENTITY-BASED COMPUTING

• US 20150033305A1
• Filed: 09/13/2014
• Published: 01/29/2015
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: Advanced Elemental Technologies, Inc.
• Original Assignee: Advanced Elemental Technologies, Inc.
• Inventors: SHEAR, Victor Henry, WILLIAMS, Peter Robert, RHO, Jaisook, REDMOND, Timothy St. John
• Granted Patent: US 9,721,086 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

The embodiments herein provide a secure computing resource set identification, evaluation, and management arrangement, employing in various embodiments some or all of the following highly reliable identity related means to establish, register, publish and securely employ user computing arrangement resources in satisfaction of user set target contextual purposes. Systems and methods may include, as applicable, software and hardware implementations for Identity Firewalls; Awareness Managers; Contextual Purpose Firewall Frameworks for situationally germane resource usage related security, provisioning, isolation, constraining, and operational management; liveness biometric, and assiduous environmental, evaluation and authentication techniques; Repute systems and methods assertion and fact ecosphere; standardized and interoperable contextual purpose related expression systems and methods; purpose related computing arrangement resource and related information management systems and methods, including situational contextual identity management systems and methods; and/or the like.

Claims

1. A method for establishing a highly reliable, persistent, identity-based computing environment employing a computing arrangement comprising at least in part one or more computing systems, the method comprising:

establishing standardized and interoperable specifications for generating, using, and/or authenticating reliable resource identities;

generating at least one reliable resource identity for a specific resource in compliance with the specifications;

securely associating the at least one reliable resource identity with the specified resource; and

performing at least one computing action involving the specified resource, wherein the identity of the specified resource is assured to one or more parties involved in the computing action as reliable based at least in part on the at least one reliable resource identity.

2. The method of claim 1, further comprising:

maintaining at least a portion of the one or more reliable resource identities in a storage arrangement available to distributed independent parties.

3. The method of claim 1, wherein performing the at least one computing action comprises provisioning a resource set based at least in part on a user set contextual purpose specification, wherein the user set contextual purpose specification at least in part specifies a purpose set for a user set computing session.

4. The method of claim 1, wherein generating at least one reliable resource identity for a specific resource comprises performing a liveness validation and associating at least one reliable resource identity with a respective resource only if the specific resource passes the liveness validation.

5. The method of claim 1, wherein the computing environment further comprises one or more biometric and/or environmental sensors arrangement;

and

securely associating at least one reliable resource identity with the specified resource further comprises;

securely acquiring identity-related information from the one or more biometric and/or environmental sensors,

validating at least a portion of the identity-related information acquired from the one or more sensors, and

adding at least one validated portion of the identity-related information from the one or more sensors to the at least one reliable resource identity for the specified resource.

6. The method of claim 5, wherein securely acquiring identity-related information from the one or more biometric and/or environmental sensors comprises acquiring the identity-related information via an Identity Firewall arrangement.

7. The method of claim 5, wherein identity-related information acquired from one or more biometric and/or environmental sensor and emitter arrangement sets comprises a time stamp, and analyzing the correspondence to validate the reality integrity of at least a portion of the sensor and emitter corresponding identity information.

8. The method of claim 6, wherein identity-related information acquired from one or more biometric and/or environmental sensor and emitter arrangement sets comprises a time stamp, and analyzing the correspondence to validate the reality integrity of at least a portion of the sensor and emitter corresponding identity information.

9. A hardened identity security device for secure and highly reliable, persistent resource identification, the appliance comprising:

secure hardened packaging enclosure arrangement;

at least one secure communication arrangement for communicating with a remote administrative and/or cloud service identity arrangement;

at least one of sensor, and unpredictable emitter emission, instruction control arrangement;

a secure clock arrangement for at least time stamping sensor and emitter related information;

at least one memory arrangement storing at least a portion of sensor and/or emitter related information; and

at least one logic control arrangement.

10. The device of claim 9, further comprising at least one of a sensor arrangement and an emitter arrangement.

11. The device of claim 9, further comprising:

means for correlating emitter related information with related received sensor information.

12. The device of claim 10, further comprising:

means for correlating emitter related information with related received sensor information.

13. The device of claim 9, further comprising:

at least one timing anomaly analysis arrangement, wherein the timing anomaly analysis device processes sensor received related information.

14. The device of claim 9, wherein the unpredictable emitter control instruction arrangement employs pseudo-random emitter control arrangement.

15. A Contextual Purpose Firewall Framework (CPFF) arrangement comprising:

a secure packaging hardware arrangement;

a securely provided specification set for enabling a contextual purpose computing session resource set;

a secure processing arrangement within the secure packaging hardware arrangement for processing the securely provided specification set;

instruction information for initiating a secure contextual purpose computing session responsive to the securely provided specification set that at least one of;

isolates at least a portion of one or more of the enabled resources from non-contextual computing session one or more resources, and

constrains the resource set enabled for such computing session responsive to such securely provided specification set.