Access privilege transferring method

• US 7,392,535 B2
• Filed: 04/21/2006
• Issued: 06/24/2008
• Est. Priority Date: 09/29/1999
• Status: Expired due to Fees

• Current Assignee: Fuji Xerox Company Limited (Xerox Holdings Corp.)
• Original Assignee: Fuji Xerox Company Limited (Xerox Holdings Corp.)
• Inventors: Horikiri, Kazunori
• Primary Examiner(s): LAFORGIA, CHRISTIAN A
• Application Number:
  US11/407,985
• Publication Number:
  US 20060190995A1
• Time in Patent Office: 795 Days
• Field of Search: None
• US Class Current: 726/7
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

Disclosed herein is an access privilege transferring method for safely transmitting privilege information about each object between subjects (users) over an object space in which service objects are scattered. User information and secret information of clients are shared between the clients and servers. A client that transfers privilege information generates privilege information weakened in its own contents of privilege. Further, the client applies a one-way function or an encryption function to a bit string obtained by joining the generated privilege information and the secret information to each other, thereby generating protected privilege information with which a third party who does not know the secret information is not capable of tampering. Utilizing the protected privilege information makes it possible to safely transfer access privileges. Further, the server analyzes the protected privilege information by using the secret information to thereby make it possible to safely confirm whether a client that makes an object request is authorized.

Claims

1. An information managing method for safely managing secret information between clients, and between clients and servers, over an object space in which at least one server for providing objects and at least one client requiring the objects are connected to one another by a network, comprising:

transmitting secret information from at least a first of a plurality of clients to at least a second of the plurality of clients;

transmitting an encryption key from the at least the first of the plurality of clients to the at least the second of the plurality of clients;

encrypting, by the at least the second of the plurality of clients, the secret information by using the encryption key transmitted from the first of the plurality of clients; and

storing the encrypted secret information, by the at least the second of the plurality of clients, in a secondary memory device.

2. An information managing method for safely managing secret information between clients, and between clients and servers, over an object space in which at least one server for providing objects and at least one client requiring the objects are connected to one another by a network, comprising:

applying a predetermined calculating operation to secret information to generate an encryption key by at least a first of a plurality of clients;

encrypting secret information by using the generated encryption key, thereby generating protected secret information by the at least the first of the plurality of clients;

transmitting the protected secret information from the at least the first of the plurality of clients to at least a second of the plurality of clients;

storing, by the at least the second of the plurality of clients, the received protected secret information in a secondary memory device;

transmitting a decryption key for decrypting the information encrypted by the generated encryption key from the at least the first of the plurality of clients to the at least the second of the plurality of clients; and

decrypting, by the at least the second of the plurality of clients, the protected secret information by using the decryption key, thereby obtaining the secret information.

3. The information managing method according to claim 2, wherein the encryption key is identical to the decryption key.

4. An information managing method for safely managing secret information between clients, and between clients and servers, over an object space in which at least one server for providing objects and at least one client requiring the objects are connected to one another by a network, comprising:

transmitting secret information from at least a first of a plurality of clients to at least a second of a plurality of clients;

holding, by the at least the second of the plurality of clients, an encryption key for encrypting information and a decryption key for decrypting the encrypted information encrypted by the encryption key, at least one of the encryption key and the decryption key being generated by applying a predetermined calculating operation to the secret information by the at least the second of the plurality of clients;

transmitting the decryption key from the at least the second of the plurality of clients to the at least the first of the plurality of clients;

storing, by the at least the second of the plurality of clients, protected secret information obtained by encrypting the secret information with the encryption key in a secondary memory device; and

decrypting the protected secret information by using the decryption key, thereby obtaining the secret information by the at least the second of the plurality of clients.

5. An information managing method for safely managing secret information between clients, and between clients and servers, over an object space in which at least one server for providing objects and at least one client requiring the objects are connected to one another by a network, comprising:

transmitting secret information from at least a first of a plurality of clients to at least a second of the plurality of clients;

transmitting, by the at least the second of the plurality of clients, a challenge character string to the at least the first of the plurality of clients;

applying a predetermined calculating operation to the challenge character string and the secret information, thereby generating an encryption key by the at least the first of the plurality of clients;

transmitting the encryption key from the at least the first of the plurality of clients to the at least the second of the plurality of clients; and

storing, by the at least the second of the plurality of clients, protected secret information obtained by encrypting the secret information by using the encryption key in a secondary memory device.