SYSTEMS AND METHODS FOR ORGANIZING DEVICES IN A POLICY HIERARCHY

• US 20160269373A1
• Filed: 03/10/2016
• Published: 09/15/2016
• Est. Priority Date: 03/12/2015
• Status: Active Grant

• Current Assignee: Fornetix LLC
• Original Assignee: Fornetix LLC
• Inventors: White, Charles, Edwards, Stephen
• Granted Patent: US 10,630,686 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/064 Hierarchical key distribution, e.g. by multi-tier trusted parties
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

In various embodiments, there is provide a method for organizing devices in a policy hierarchy. The method includes creating a first node. The method further includes assigning a first policy to the first node. The method further includes creating a second node, the second node referencing the first node as a parent node such that the second node inherits the first policy of the first node.

Claims

1. A method for organizing devices in a policy hierarchy, the method comprising:

creating a first node;

assigning a first policy to the first node; and

creating a second node, the second node referencing the first node as a parent node such that the second node inherits the first policy of the first node.

2. The method of claim 1, further comprising assigning a second policy to the second node such that the second node is assigned the first policy and the second policy.

3. The method of claim 2, further comprising creating a third node, the third node referencing the second node as a parent node such that the third node inherits the first policy and the second policy of the second node.

4. The method of claim 1, further comprising:

registering a first device to the first node such that the first device is bound by the first policy of the first node; and

registering a second device to the second node such that the second device is bound by the first and second policies of the second node.

5. The method of claim 4, wherein the registering the first device comprises referencing an identifier of the first node.

6. The method of claim 4, further comprising performing an applied key management operation including one of key management, key distribution, or key federation on the second device registered to the second node such that the applied key management operation is evaluated based on the first and second policies of the second node.

7. The method of claim 4, further comprising:

receiving an encryption key having a key attribute from the first device;

determining acceptability of the encryption key based on the key attribute and the first and second policies of the second device associated with the second device; and

in response to determining that the encryption key is acceptable, distributing the encryption key to the second device.

8. The method of claim 4, further comprising:

creating a third policy; and

assigning the third policy to the second node such that the second node is assigned the first policy, the second policy, and the third policy.

9. The method of claim 8, further comprising updating the second device to be bound by the first, second, and third policies of the second node.

10. The method of claim 1, wherein the assigning comprises referencing an identifier of the first node.

11. A system for organizing devices in a policy hierarchy, the system comprising:

a memory; and

a processor configured to;

create a first node;

assign a first policy to the first node; and

create a second node, the second node referencing the first node as a parent node such that the second node inherits the first policy of the first node.

12. The system of claim 11, wherein the processor is further configured to assign a second policy to the second node such that the second node is assigned the first policy and the second policy.

13. The system of claim 12, wherein the processor is further configured to create a third node, the third node referencing the second node as a parent node such that the third node inherits the first policy and the second policy of the second node.

14. The system of claim 11, wherein the processor is further configured to:

register a first device to the first node such that the first device is bound by the first policy of the first node; and

register a second device to the second node such that the second device is bound by the first and second policies of the second node.

15. The system of claim 14, wherein the registering the first device comprises referencing an identifier of the first node.

16. The system of claim 14, wherein the processor is further configured to perform an applied key management operation including one of key management, key distribution, or key federation on the second device registered to the second node such that the applied key management operation is evaluated based on the first and second policies of the second node.

17. The system of claim 14, wherein the processor is further configured to:

receive an encryption key having a key attribute from the first device;

determine acceptability of the encryption key based on the key attribute and the first and second policies of the second device associated with the second device; and

in response to determining that the encryption key is acceptable, distribute the encryption key to the second device.

18. The system of claim 14, wherein the processor is further configured to:

create a third policy; and

assign the third policy to the second node such that the second node is assigned the first policy, the second policy, and the third policy.

19. The system of claim 18, wherein the processor is further configured to update the second device to be bound by the first, second, and third policies of the second node.

20. The system of claim 11, wherein the assigning comprises referencing an identifier of the first node.