Versatile secure and non-secure messaging

• US 8,028,166 B2
• Filed: 04/25/2006
• Issued: 09/27/2011
• Est. Priority Date: 04/25/2006
• Status: Expired due to Fees

• Current Assignee: Seagate Technology LLC (Seagate Technology Holdings Plc)
• Original Assignee: Seagate Technology LLC (Seagate Technology Holdings Plc)
• Inventors: Thibadeau, Robert H.
• Primary Examiner(s): Abrishamkar; Kaveh
• Application Number:
  US11/410,453
• Publication Number:
  US 20070250710A1
• Time in Patent Office: 1,981 Days
• Field of Search: None
• US Class Current: 713/168
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 9/0838 Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these network architectures or network communication protocols for key exchange in a packet data network H04L63/061
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3249 using RSA or related signature schemes, e.g. Rabin scheme
• CPC Class Codes: H04L 9/3265 using certificate chains, trees or paths; Hierarchical trust model
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A messaging system and method are associated with a first device. The messaging system includes a plurality of credentials and a plurality of authorities. Each authority associates at least one of a plurality of protocol operations with at least one of the plurality of credentials. The messaging system is adapted to receive an initiating message from a second device, which identifies at least one of the authorities, and responsively implements a security protocol for further messages between the first and second devices in accordance with the identified authority.

Claims

1. A first device comprising:

a plurality of credentials;

a plurality of authorities, each authority associating at least one of a plurality of protocol operations with at least one of the plurality of credentials; and

a messaging system adapted to receive from a second device a method call for executing a method on the first device, wherein the method call comprises a parameter having a value that identifies at least one of the plurality of authorities, wherein the value is selected from a set of values, each identifying a respective one of the plurality of authorities, and wherein the messaging system responsively implements a security protocol for further messages between the first and second devices in response to each method call in accordance with the authority identified by the method call.

2. The messaging system of claim 1 wherein the plurality of authorities comprises:

a signing authority, which defines a credential and a protocol operation by which the one of the first and second devices can authenticate itself to the other of the first and second devices.

3. The messaging system of claim 1 wherein the plurality of authorities comprises:

an exchange authority, which defines a credential and a protocol operation with which the further messages from one of the first and second devices to the other of the first and second devices are encrypted and decrypted.

4. The messaging system of claim 1 wherein at least one of the plurality of authorities are known to the first device prior to receiving the initiating message.

5. The messaging system of claim 1 wherein at least one of the plurality of authorities, referred to as a first authority, links to another of the plurality of authorities, referred to a second authority, such that both the first and second authorities must be satisfied in response to a method call that identifies the first authority.

6. The messaging system of claim 1 and further comprising:

an authority table in which the plurality of authorities are stored in respective rows of the table; and

at least one credential table in which at least one of the plurality of credentials is stored in a row of the credential table.

7. The messaging system of claim 1 and further comprising a credential table for each of the plurality of authentication operations, and wherein the credentials that are associated with a particular one of the plurality of authentication operations are stored in the credential table that corresponds to that authentication operation.

8. A messaging system comprising:

a peripheral comprising a first table of authorities, which is adapted to store a plurality of distinct authorities, each authority in the first table associating at least one of a plurality of authentication operations with at least one of a plurality of credentials;

a host comprising a second table of authorities, which is adapted to store a plurality of distinct authorities, each authority in the second table associating at least one of the plurality of authentication operations with at least part of the credential associated with that authority in the first table; and

a communication channel between the peripheral and the host, wherein messages passed through the communication channel invoke at least one corresponding authority in each table.

9. The messaging system of claim 8 wherein the first and second tables of authorities comprise:

a signing authority, which defines a credential and a protocol operation by which the one of the peripheral and the host can authenticate itself to the other of the peripheral and the host through the channel.

10. The messaging system of claim 8 wherein the first and second tables of authorities comprise:

an exchange authority, which defines a credential and a protocol operation with which the messages from one of the peripheral and the host to the other of the peripheral and the host are encrypted and decrypted.

11. The messaging system of claim 8 wherein in each table, at least one of the plurality of authorities links to another of the plurality of authorities in that table.

12. The messaging system of claim 8 wherein the peripheral device and the host device each comprise, for each of the authentication operations:

a corresponding credential table, wherein the credentials that are associated with a particular one of the authentication operations are stored in the corresponding credential table.

13. A method of initiating a messaging session, comprising:

maintaining a plurality of authorities known to a peripheral, wherein each authority associates at least one of a plurality of authentication operations with at least one of a plurality of credentials;

passing a start session message from a host to the peripheral, which identifies at least one of the authorities known to the peripheral;

retrieving the identified authority from the plurality of authorities known to the peripheral; and

implementing a security protocol on further messages between the host and the peripheral in accordance with the identified authority.

14. The method of claim 13 and further comprising:

maintaining a plurality of authorities known to the host, which correspond to the plurality of authorities known to the peripheral, wherein each authority associates at least one of the plurality of authentication operations with at least one of the plurality of credentials, and wherein each credential known to the host comprises at least a portion the corresponding credential known to the peripheral.

15. The method of claim 13 wherein:

retrieving the identified authority comprises exchanging one or more cryptographic keys between the peripheral and the host as a function of the identified authority; and

implementing the security protocol comprises encrypting the further messages using the cryptographic key and the authentication operation of the identified authority.

16. The method of claim 13 wherein:

implementing the security protocol comprises encrypting the further messages at one end of the communication channel using a public key portion of the credential and the associated authentication operation of the identified authority, and decrypting the further messages at another end of the communication channel using a private key portion of that credential.

17. The method of claim 13 wherein implementing the security protocol comprises implementing the security protocol without either the host or the peripheral negotiating security capabilities of the other.

18. The method of claim 13 wherein the plurality of authorities comprises:

a signing authority, which defines a credential and a protocol operation by which the one of the host and the peripheral can authenticate itself to the other.

19. The method of claim 13 wherein the plurality of authorities comprises:

an exchange authority, which defines a credential and a protocol operation with which the further messages from one of the host and the peripheral to the other are encrypted and decrypted.

20. The method of claim 13 wherein the host has knowledge of the authentication operation at least part of the associated credential of the identified authority prior to passing the start session message.

21. The method of claim 13 wherein where at least one of the plurality of authorities links to another of the plurality of authorities.

22. The method of claim 13 and further comprising:

maintaining an authority table in which the plurality of authorities are stored; and

maintaining at least one credential table in which at least one of the plurality of credentials is stored, and linking the authority table to the credential table.

23. The method of claim 22 and further comprising maintaining a credential table for each of the plurality of authentication operations, and wherein the credentials that are associated with a particular one of the plurality of authentication operations are stored in the credential table that corresponds to that authentication operation.