Certifying and grouping distributed objects

• US 7,664,949 B2
• Filed: 07/29/2005
• Issued: 02/16/2010
• Est. Priority Date: 07/29/2005
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Rose, Charles F. III, Pandya, Ravindra N, Paramasivam, Muthukrishnan, England, Paul, Kurien, Thekkthalackal Varugis
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): RAHIM, MONJUR
• Application Number:
  US11/194,100
• Publication Number:
  US 20070028096A1
• Time in Patent Office: 1,663 Days
• Field of Search: 713/156, 380/277, 705/1, 726/2
• US Class Current: 713/156
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

Disclosed herein is a technique for certifying distributable objects. The technique involves creating a certification for each distributable object to indicate properties of the object. Using certifications such as this, it is possible to accept objects having certain properties only from specified entities.

Claims

1. A method of certifying a distributable object, comprising:

creating a certification for each distributable object using a computer, the certification containing;

a description of one or more properties of the distributable object including at least one property of the distributable object other than those properties which are indicative of a source of the distributable object;

a verifiable identification of an attesting entity who attests to said description; and

a verifiable identification of the distributable object;

making the certification available to potential users of the distributable object;

referencing an authorization from a delegating entity in the certification using the computer, wherein the authorization authorizes the attesting entity to attest to one or more types of properties of the distributable object; and

conditioning use of the distributable object based on the property of the distributable object other than those properties which are indicative of the source of the distributable object and based on the identities of the entity who attests to those properties using the computer.

2. A method as recited in claim 1, wherein the authorization authorizes the attesting entity to attest to a limited number of properties of the distributable objects.

3. A method as recited in claim 1, wherein creating the certification comprises creating a cryptographic certificate from the attesting entity, the verifiable identification of the distributable object comprising a hash of the distributable object.

4. A method as recited in claim 1, the authorized types of properties of the distributable objects being specified by said authorization.

5. A method of certifying distributable objects, comprising:

authorizing different entities to attest to different properties of the distributable objects using a computer;

authorizing, using the computer, said different entities to authorize delegated entities to attest to sub-sets of the different properties of the distributable objects to which said different entities are authorized to attest;

said properties of the distributable objects, including at least one property of the distributable object other than those properties which are indicative of a source of the distributable object, being attested to in certifications corresponding to the distributable objects; and

conditioning use of the distributable objects based on the property of the distributable object other than those properties which are indicative of the source of the distributable objects and based on the identities of the entities who attest to the property of the distributable object other than the source of the distributable object using the computer.

6. A method as recited in claim 5, wherein a certification of a particular distributable object comprises:

a description of one or more properties of the particular distributable object;

a verifiable identification of the attesting entity who attests to said description; and

a verifiable identification of the distributable object.

7. A method as recited in claim 5, further comprising:

creating object groups using the computer, wherein a distributable object is a member of a group if its certification satisfies specified constraints; and

conditioning use of distributable objects depending on whether the distributable objects are members of one or more of the object groups using the computer.

8. A method as recited in claim 7, wherein an individual constraint comprises a particular property of the distributable objects and an authorizing entity.

9. A method of qualifying distributable objects before using them, comprising:

obtaining the distributable objects accompanied by certifications corresponding to the distributable objects using a computer, each certification comprising;

a description of one or more properties of the distributable object corresponding to the certification including at least one property of the distributable object other than those properties which are indicative of a source of the distributable object wherein the property of the distributable object other than those properties which are indicative of a source of the distributable object indicate at least one of whether the distributable object is executable, whether the distributable object is a font, whether the distributable object is an image;

or whether the distributable object is an URL (Uniform resource Locator);

a verifiable identification of the attesting entity who attests to said description; and

a verifiable identification of the distributable object;

using any particular object if its certification indicates it meets one of a plurality of constraints, at least one constraint comprising one or more properties of the distributable objects and one or more entities that are authorized to attest to said one or more properties of the distributable objects and at least one constraint comprising the property of the particular distributable object other than those properties which are indicative of a source of the particular distributable object using the computer.

10. A method as recited in claim 9, further comprising maintaining a list of said constraints using the computer.

11. A method as recited in claim 9, further comprising recognizing an attesting entity as being authorized to attest to a particular property of the distributable objects if it has authorization from a delegating entity that is authorized to attest to said particular property of the distributable objects using the computer.

12. A method as recited in claim 9, wherein the certification comprises a cryptographic certificate, the verifiable identification of the distributable object comprising a hash of the distributable object.

13. A method as recited in claim 9, further comprising:

maintaining object group definitions using the computer, wherein each object group definition comprises one or more of the constraints;

associating one or more permissions with each group definition using the computer;

granting permissions to a distributable object only if its certification satisfies the constraints of a group definition that is associated with those permissions using the computer.

14. A method as recited in claim 9, further comprising:

maintaining object group definitions as Boolean combinations of the constraints using the computer;

associating one or more permissions with each group definition using the computer;

granting permissions to a distributable object only if its certification satisfies the constraints of a group definition that is associated with those permissions using the computer.

15. A method as recited in claim 9, further comprising:

maintaining object group definitions using the computer, wherein each object group definition comprises one or more of the constraints;

associating one or more permissions with each group definition using the computer;

granting permissions to a distributable object only if its certification satisfies the constraints of a group definition that is associated with those permissions using the computer; and

creating a group identifier corresponding to each group definition using the computer, the group identifier being based on a hash of the group definition.

16. A method as recited in claim 9, further comprising:

maintaining object group definitions using the computer, wherein each object group definition comprises one or more of the constraints;

associating one or more permissions with each group definition using the computer;

assigning an unambiguous group identifier to each group definition using the computer; and

granting permissions to a distributable object only if its certification satisfies the constraints of a group definition that is associated with those permissions using the computer.

17. A method as recited in claim 9, further comprising:

maintaining object group definitions using the computer, wherein each object group definition comprises one or more of the constraints;

associating one or more permissions with each group definition using the computer;

assigning an unambiguous group identifier to each group definition using the computer;

granting permissions to a distributable object only if its certification satisfies the constraints of a group definition that is associated with those permissions using the computer; and

using the group identifiers to control access using the computer.

18. A method as recited in claim 9, further comprising:

maintaining object group definitions using the computer, wherein each object group definition comprises one or more of the constraints;

associating one or more permissions with each group definition using the computer;

granting permissions to a distributable object only if its certification satisfies the constraints of a group definition that is associated with those permissions using the computer; and

creating a group identifier corresponding to each group definition using the computer, the group identifier being based on a hash of the group definition;

wherein at least some of the object group definitions are combinations of other object group definitions.