Method ans system for pro-active credential refreshing

• US 7,058,798 B1
• Filed: 04/11/2000
• Issued: 06/06/2006
• Est. Priority Date: 04/11/2000
• Status: Expired due to Term

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Perlman, Radia Joy, Hanna, Stephen R., Anderson, Anne H., Mullan, Sean J., Elley, Yassir K.
• Primary Examiner(s): Wright, Norman M.
• Application Number:
  US09/547,183
• Time in Patent Office: 2,247 Days
• Field of Search: 713/201, 713/200, 713/156, 726/6, 726/5, 726/26, 726/30, 726/27
• US Class Current: 713/156
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

The basic concept is that before a resource is accessed, the entity that has the burden of gathering the credentials, pro-actively refreshes the credentials and keeps them current. In one instance, a presenter of credentials, for example, a client, pro-actively refreshes the credentials such that at the time of presentation, the credentials meet the resource-specific constraints of a recipient of credentials, for example, a resource server. For each resource that it protects, a resource server typically establishes various constraints such as a recency requirement, which specifies how recently a credential has to have been issued to be accepted as an adequate credential. Other constraints may include maximum certificate chain length, trust level and so forth. In another instance, a recipient of credentials pro-actively gathers and refreshes credentials to prevent un-authorized access to the various resources it is protecting.

Claims

1. A method of pro-actively refreshing credentials by an entity that maintains credentials, the method comprising:

a) determining credentials that are required to access resources including resource-specific constraints that indicate when the credentials must be refreshed;

b) storing in a memory, a profile collection having at least one credential profile, each credential profile including a credential, resource-specific constraints for the credential and related information; and

c) for each credential profile in the profile collection;

i) in accordance with at least one criterion of a refresh policy and prior to a time of presentation of the credential, making a determination, from that credential profile'"'"'s resource-specific constraints, of whether that credential needs to be refreshed so that, at the time of presentation, that credential will meet the resource-specific constraints;

ii) replacing the stored credential with a new credential in the credential profile if the stored credential does need to be refreshed; and

iii) updating the related information of the new credential in the credential profile.

2. The method of claim 1, wherein the method further comprises creating the profile collection by, for each of at least one needed credential, determining whether the profile collection includes a credential profile for needed credentials, and, if not, then:

creating an empty credential profile;

gathering that needed credential;

storing that needed credential in the credential profile;

obtaining related information including resource constraints on that needed credential; and

storing the information in the credential profile.

3. The method of claim 2, wherein the resource constraints are obtained by manual entry of a user.

4. The method of claim 2, wherein the resource constraints are deduced through access attempts.

5. The method of claim 2, wherein the resource constraints are obtained from a directory.

6. The method of claim 2, wherein the constraints are obtained from a resource server.

7. The method of claim 2, wherein the stored credential includes a public key identity credential.

8. The method of claim 2, wherein the stored credential includes a group membership credential.

9. The method of claim 2, wherein the stored credential includes a group non-membership credential.

10. The method of claim 2, wherein the stored credential includes a non-revocation credential.

11. The method of claim 2, wherein the stored resource constraints include a recency requirement.

12. The method of claim 2, wherein the stored resource constraints include a trust level.

13. The method of claim 2, wherein the stored resource constraints include a maximum credential chain length.

14. The method of claim 1, wherein the related information includes a credential identifier.

15. The method of claim 1, wherein the related information includes when the credential was issued.

16. The method of claim 1, wherein the related information includes when the credential was last used for a resource access.

17. The method of claim 1, wherein the related information includes information on the resource on which the credential was last used.

18. The method of claim 1, wherein at least one said criterion is such that the method includes refreshing credentials that are older than a certain time period.

19. The method of claim 1, wherein at least one said criterion is such that the method includes refreshing credentials that were last used within a certain time period.

20. The method of claim 1, wherein at least one said criterion is such that the method includes refreshing credentials that are older than an associated recency requirement.

21. The method of claim 1, wherein at least one said criterion is such that the method includes refreshing credentials that are predicted to be used in a next session.

25. The processor readable medium of claim 2 wherein resource constraints are obtained by deducing them through access attempts.

26. The processor readable medium of claim 2 wherein resource constraints are obtained from a directory.

27. The processor readable medium of claim 2 wherein resource constraints are from a resource server.

28. The processor readable medium of claim 2 wherein the stored credential includes a public key identity credential.

29. The processor readable medium of claim 2 wherein the stored credential includes a group membership credential.

30. The processor readable medium of claim 2 wherein the stored credential includes a group non-membership credential.

31. The processor executable readable medium of claim 2 wherein the stored credential includes a non-revocation credential.

32. The processor readable medium of claim 2 wherein the stored resource constraints include a recency requirement.

33. The processor readable medium of claim 2 wherein the stored resource constraints include a trust level.

35. The processor executable-readable medium of claim 2 wherein the related information includes a credential identifier.

36. The processor readable medium of claim 21 wherein the related information includes information on when the credential issued.

37. The processor readable medium of claim 2 wherein the related information includes information on when the credential last used for a resource access.

38. The processor readable medium of claim 2 wherein the related information includes information on the resource on the resource on the credential was last used.

39. The processor readable medium of claim 2 wherein at least one said criterion is such that the method includes refreshing credentials that are older than a certain time period.

40. The processor readable medium of claim 2 wherein at least one said criterion is such that the method includes refreshing credentials that were last used within a certain time period.

41. The processor readable medium of claim 2 wherein at least one said criterion is such that the method includes refreshing credentials that are older than an associated recency requirement.

42. The processor executable readable medium of claim 2 wherein at least one said criterion is such that the method includes refreshing credentials that are predicted to be used in a next session.

22. A processor readable medium having instructions contained therein which when executed by a processor causes the processor to execute a method of pro-actively refreshing credentials by an entity that maintains credentials, the method comprising:

a) determining credentials that are required to access resources including resource-specific constraints that indicate when the credentials must be refreshed;

b) storing in a memory, a profile collection having at least one credential profile, each credential profile including a credential, resource-specific constraints for the credential and related information; and

c) for each credential profile in the profile collection;

i) in accordance with at least one criterion of a refresh policy and prior to a time of presentation of the credential, making a determination, from that credential profile'"'"'s resource-specific constraints, of whether that credential needs to be refreshed so that, at the time of presentation, that credential will meet the resource-specific constraints;

ii) replacing the stored credential with a new credential in the credential profile if the stored credential needs to be refreshed; and

iii) updating the related information of the new credential in the credential profile.

23. The processor readable medium of claim 22 wherein the method further comprises creating the profile collection for each of at least one needed credential determining whether the profile collection includes a credential profile for that needed credential, and, if not, then

creating an empty credential profile;

gathering that needed credential;

storing that needed credential in the credential profile;

obtaining related information including resource constraints on that needed credential; and

storing the information in the credential profile.

24. The processor readable medium of claim 23, wherein the resource constraints are obtained by manual entry of a user.

34. The processor readable medium of claim 23, wherein the stored resource constraints include a maximum credential chain length.

43. A system for pro-actively refreshing credentials by an entity that maintains credentials, the system comprising:

a mechanism that determines credentials that are required to access resources including resource-specific constraints that indicate when the credentials must be refreshed;

a memory to store a profile collection having at least one credential profile, each credential profile including a credential, resource-specific constraints for the credential and related information;

a circuit to read the credential profile;

a refresh policy stored in the memory to determine prior to a time of presentation of the credential, if the credential needs to refreshed using the resource-specific constraints so that, at the time of presentation, that credential will meet the resource-specific constraints, wherein the circuit replaces the stored credential with a new credential in the credential profile if the stored credential needs to be refreshed and the circuit updates the related information of the new credential in the credential profile.

44. The system of claim 43, wherein the circuit is configured to determine, for each of at least one needed credential, whether the profile collection includes a credential profile for that needed credential, and, if not, then create an empty credential profile in the memory, gather that needed credential;

store that needed credential in the credential profile;

obtain related information including resource constraints on that needed credential, and store the information in the credential profile.

45. The system as in claim 44, wherein the circuit is a processor.

46. The system of claim 44, wherein the resource constraints are obtained by manual entry of a user.

47. The system of claim 44, wherein the resource constraints are deduced through access attempts.

48. The system of claim 44, wherein the resource constraints are obtained from a directory.

49. The system of claim 44, wherein the resource constraints are obtained from a resource server.

50. The system of claim 44, wherein the stored credential includes a public key identity credential.

51. The system of claim 44, wherein the stored credential includes a group membership credential.

52. The system of claim 44, wherein the stored credential includes a group non-membership credential.

53. The system of claim 44, wherein the stored credential includes a non-revocation credential.

54. The system of claim 44, wherein the stored resource constraints include a recency requirement.

55. The system of claim 44, wherein the stored resource constraints include a trust level.

56. The system of claim 44, wherein the stored resource constraints include a maximum credential chain length.

57. The system of claim 43, wherein the related information includes a credential identifier.

58. The system of claim 43, wherein the related information includes when the credential was issued.

59. The system of claim 43, wherein the related information includes when the credential was last used for a resource access.

60. The system of claim 43, wherein the related information includes on which resource the credential was last used.

61. The system of claim 43, wherein the refresh policy refreshes credentials that are older than a certain time period.

62. The system of claim 43, wherein the refresh policy refreshes credentials that were last used within a certain time period.

63. The system of claim 43, wherein the refresh policy refreshes credentials that are older than an associated recency requirement.

64. The system of claim 43, wherein the refresh policy refreshes credentials that are predicted to be used in a next session.