Trust management systems and methods
First Claim
1. In a computer-implemented authorization management system, a method for controlling a user'"'"'s access to a computing resource that is managed by said computer-implemented authorization management system, the method including:
- receiving an electronic request for the computing resource;
retrieving a group of computer-readable authorization certificates from at least one computer-readable authorization certificate storage location accessible to said computer-implemented authorization management system, each certificate containing at least one computer-readable authorization by at least one principal;
identifying a set of principals associated with the group of computer-readable authorization certificates;
creating a lattice of authorization values associated with each principal of said set of principals in a memory device in communication with the computer-implemented authorization system, wherein the lattice of authorization values is a monotone function of one or more authorization values of the set of principals;
evaluating a certificate as a monotone function, at least in part, of the one or more authorization values associated with one or more of the principals;
updating the one or more authorization values of one or more of the principals if the result of said evaluating step indicates that an authorization value of a principal should be changed, the step of updating the authorization value being a monotone function; and
repeating said evaluating and updating steps until a steady state of said lattice of authorizations values is reached.
3 Assignments
0 Petitions
Accused Products
Abstract
The present invention provides systems and methods for making efficient trust management decisions. A trust management engine is provided that processes requests for system resources, authorizations or certificates, and the identity of one or more root authorities that are ultimately responsible for granting or denying the requests. To determine whether a request should be granted, the trust management engine identifies a set principals from whom authorization may flow, and interprets each of the certificates as a function of the state of one or more of the principals. The processing logic iteratively evaluates the functions represented by the certificates, updates the states of the principals, and repeats this process until a reliable determination can be made as to whether the request should be granted or denied. The certificates may be evaluated until the state of the root authority indicates that the request should be granted, or until further evaluation of the certificates is ineffective in changing the state of the principals.
-
Citations
16 Claims
-
1. In a computer-implemented authorization management system, a method for controlling a user'"'"'s access to a computing resource that is managed by said computer-implemented authorization management system, the method including:
-
receiving an electronic request for the computing resource; retrieving a group of computer-readable authorization certificates from at least one computer-readable authorization certificate storage location accessible to said computer-implemented authorization management system, each certificate containing at least one computer-readable authorization by at least one principal; identifying a set of principals associated with the group of computer-readable authorization certificates; creating a lattice of authorization values associated with each principal of said set of principals in a memory device in communication with the computer-implemented authorization system, wherein the lattice of authorization values is a monotone function of one or more authorization values of the set of principals; evaluating a certificate as a monotone function, at least in part, of the one or more authorization values associated with one or more of the principals; updating the one or more authorization values of one or more of the principals if the result of said evaluating step indicates that an authorization value of a principal should be changed, the step of updating the authorization value being a monotone function; and repeating said evaluating and updating steps until a steady state of said lattice of authorizations values is reached. - View Dependent Claims (2, 3, 4, 5, 6)
-
-
7. A computer program product for making authorization management determinations for controlling a user'"'"'s access to a computing resource that is managed by said computer-implemented authorization management system, the computer program product including the stepsof:
-
receiving an electronic request to perform a predefined action; retrieving a group of computer-readable authorizations for the predefined action from at least one computer-readable authorization certificate storage location accessible to said computer-implemented authorization management system, one or more of the computer-readable authorizations in the group being a monotone function of the authorization state of one or more principals; identifying a set of principals associated with the group of computer-readable authorizations and for initializing a lattice of authorization values associated with each principal of said set of principals in a memory device in communication with the computer-implemented authorization system; evaluating one or more authorizations in the group of computer-readable authorizations using an authorization value associated with each principal; updating the authorization value of one or more principals in the set of principals, the updating of the authorization value being a monotone function; causing repeated execution of said computer code for evaluating one or more authorizations in the group of computer-readable authorizations and for updating the authorization value of one or more principals in the set of principals until a steady state of said lattice of authorization values is reached; and storing the computer codes. - View Dependent Claims (8)
-
-
9. A computer-implemented system for controlling access to electronic content or processing resources managed by a computer-implemented authorization management system, the system comprising:
-
means for receiving an electronic request from a requesting principal to access a piece of electronic content or a processing resource; means for collecting a set of one or more computer-readable authorization certificates relating to the request, the requesting principal, or the piece of electronic content or processing resource from at least one computer-readable authorization certificate storage location accessible to said computer-implemented authorization management system; means for identifying a root principal from whom authorization is needed in order to grant the electronic request; means for creating a lattice of monotone authorization values in a memory device associated with a memory device in communication with said system and performing at least a portion of a least fixpoint computation over said authorization values to determine whether the root principal has authorized the requesting principal to access the piece of electronic content or processing resource; and means for granting the requesting principal access to the piece of electronic content or processing resource when the least fixpoint computation indicates that the root principal has authorized said access.
-
-
10. A computer-implemented system for controlling access to electronic resources, the system comprising:
a first computer system for processing electronic requests for access to electronic resources, the first computer system comprising; a computer network interface configured to receive digital certificates from other computer systems and for electronically receiving and processing requests to access electronic resources; a memory device in communication with said first computer system for storing electronic resources and one or more computer-readable authorization certificates relating to authorization for controlling access thereto; and a trust management engine for processing digital certificates and requests for electronic resources, and for making access control decisions by creating a lattice of monotone authorization values in a memory device associated with a memory device in communication with said system and performing least fixpoint computations using said authorization values. - View Dependent Claims (11, 12, 13, 14, 15, 16)
Specification