Personal domain controller

• US 7,822,863 B2
• Filed: 05/12/2006
• Issued: 10/26/2010
• Est. Priority Date: 05/12/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Palo Alto Research Center, Inc. (Xerox Holdings Corp.)
• Inventors: Smith, Trevor F., Smetters, Diana K., Balfanz, Dirk, Durfee, Glenn E.
• Primary Examiner(s): Osman; Ramy M
• Assistant Examiner(s): MCLEOD, MARSHALL M
• Application Number:
  US11/383,144
• Publication Number:
  US 20070266164A1
• Time in Patent Office: 1,628 Days
• Field of Search: 709/217, 709/220, 709/223, 709/227, 709/229
• US Class Current: 709/229
• CPC Class Codes: H04L 12/2803 Home automation networks
• CPC Class Codes: H04L 12/2818 from a device located outside both the home and the home network access arrangements H04L12/2856; for remote control or remote monitoring of applications H04L67/025; arrangements for transmitting signals characterised by the use of a wireless eletrical link G08C17/00; telephonic communication systems adapted for combination with remote control systems H04M11/007
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

A method of accessing a data resource identifies the data resource, the data resource accessible through a first device and associated with a resource locator, the first device configured to provide access to the data resource responsive to possession of a whitelisted credential. The method includes receiving a second-device credential from a second device by a personal domain controller, the personal domain controller and the first device within a first trusted relationship and provides, by the personal domain controller, the second-device credential to the first device for whitelisting subject to the first trusted relationship. The method uses, by the second device, the second-device credential to access the data resource responsive to the resource locator.

Claims

1. A method of accessing a data resource comprising:

establishing a trusted relationship between a personal domain controller and a first device;

identifying the data resource using a personal domain controller, the data resource accessible through a first device and associated with a resource locator;

receiving a second-device credential from a second device at a personal domain controller over a local link;

sending, by the personal domain controller over the local link, a personal domain controller credential to the second device to establish a second trusted relationship;

providing the second-device credential to the first device from the personal domain controller, the second device credential to be added to a whitelist by the first device;

sending a first-device credential to the second device for whitelisting subject to the second trusted relationship;

verifying that the first-device credential is whitelisted by the second device;

providing a resource locator to the second device by the personal domain controller;

connecting by the second device, to the first device to access the data resource, the first device allowing the connection based upon the whitelist; and

receiving the data resource by the second device responsive to the verifying.

2. The method of claim 1, wherein the local link is selected from a group consisting of:

an infrared link, a visible light link, a BlueTooth link, a wireless link in accordance with IEEE 802.11 standards, a wired link, an audio communication link, and an ultra-high frequency radio link.

3. The method of claim 1, wherein the second device and the first device connect over a network.

4. The method of claim 3, further comprising establishing at least one selected from a group consisting of a virtual private network and a secure tunnel.

5. The method of claim 1, wherein identifying the data resource further comprises:

activating a user interface on the personal domain controller;

presenting a representation of the data resource on the user interface; and

receiving a user input to select the representation of the data resource.

6. The method of claim 1, wherein the second-device credential is selected from a group consisting of public keys, public-key certificates, cryptographic hashes of public keys, and cryptographic hashes of public-key certificates.

7. The method of claim 1, further comprising:

terminating connection between the first device and the second device; and

removing the second-device credential from the whitelist of the first device responsive to the termination.

8. The method of claim 1, further comprising:

storing an index into the data resource; and

cueing the data resource responsive to the index.

9. An article of computer-readable media containing instructions that when executed by a computer cause the computer to:

establish a trusted relationship between a personal domain controller and a first device;

identify a data resource, the data resource accessible through a first device and associated with a resource locator;

receive a second-device credential from a second device over a local link;

send a personal domain controller credential to the second device to establish a second trusted relationship;

provide the second-device credential to the first device, the first device to whitelist the second-device credential to allow the second device access through the first device;

sending a first-device credential to the second device for whitelisting subject to the second trusted relationship;

verifying that the first-device credential is whitelisted by the second device;

providing a resource locator to the second device to allow the second device to connect to the first device.

10. The article of claim 9, the instructions further to cause the computer to establish at least one selected from a group consisting of a virtual private network and a secure tunnel.

11. The article of claim 9, the instructions to cause the computer to identify the data resource further causing the computer to:

activate a user interface on the personal domain controller;

present a representation of the data resource on the user interface; and

receive a user input to select the representation of the data resource.

12. The article of claim 9, the instructions further to cause the computer to:

terminate communications between the first device and the second device; and

remove the second-device credential from the whitelist of the first device responsive to the termination.

13. The article of claim 9, the instructions further to cause the computer to:

store an index into the data resource; and

cue the data resource responsive to the index.

14. A personal domain device, comprising:

a first user interface to allow a user to communicate with a first device and to select a data resource available through the first device;

a first port to allow access to the data resource through the first device, the data resource associated with a resource locator, the port further to allow the first device and the personal domain device to establish a trusted relationship;

a second user interface to allow a user to communicate with a second device;

a second port to allow communication with the second device including reception of a second-device credential from the second device, transmission of a personal domain controller credential to allow establishing of a second trusted relationship, and transmission of a first device credential to the second device for whitelisting; and

a processor to;

verify that the first-device credential is whitelisted by the second device;

provide the second-device credential to the first device for whitelisting subject to the trusted relationship;

provide a resource locator to the second device to allow the second device to connect to the first device.

15. The device of claim 14, wherein the personal domain device further comprises one selected from the group consisting of:

a cellular phone, a personal digital assistant, and a portable electronic device.

16. The device of claim 14, wherein the first port further comprises one selected from the group consisting of:

a wireless network radio, a wired network connection, and an Ethernet port.

17. The device of claim 14, wherein the second port further comprises one selected from the group consisting of:

an infrared port, an audio port, a visible light port, a BlueTooth port, a radio in accordance with IEEE 802.11 standards, a wired port, an audio communication link, and an ultra-high frequency radio.