Distributed device revocation

• US 8,424,064 B2
• Filed: 10/31/2007
• Issued: 04/16/2013
• Est. Priority Date: 11/02/2006
• Status: Active Grant

• Current Assignee: Koninklijke Philips Electronics N.V. (Koninklijke Philips N.V.)
• Original Assignee: Koninklijke Philips Electronics N.V. (Koninklijke Philips N.V.)
• Inventors: Gardcia, Oscar, Baldus, Heribert
• Primary Examiner(s): Gee, Jason K.
• Assistant Examiner(s): Ho, Thomas
• Application Number:
  US12/447,007
• Publication Number:
  US 20100031318A1
• Time in Patent Office: 1,994 Days
• Field of Search: 726/4, 713/158, 705/71
• US Class Current: 726/4
• CPC Class Codes: A61B 5/00 Measuring for diagnostic purposes radiation diagnosis A61B6/00; diagnosis by ultrasonic, sonic or infrasonic waves A61B8/00; Identification of persons
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04W 12/082 using revocation of authorisation

Abstract

In a distributed revocation method, it is individually decided at each of a plurality of autonomous device nodes of a distributed network whether a suspect autonomous device node or suspect distributed key of the distributed network should be removed from the distributed network. A voting session is conducted at which the individual decisions of the plurality of autonomous device nodes are combined to decide whether the suspect autonomous device node or suspect distributed key should be removed from the distributed network. The suspect autonomous device node or suspect distributed key is removed from the distributed network responsive to the voting session deciding in favor of removal.

Claims

1. A distributed revocation method comprising:

conducting a vote amongst at least three autonomous device nodes of a distributed network regarding whether a suspect autonomous device node of the distributed network should be removed from the distributed network;

responsive to said vote satisfying a revocation criterion, ceasing communication between the suspect autonomous device node and the other autonomous device nodes of the distributed network by (i) constructing a revocation message by combining partial revocation information for revoking the suspect autonomous device node that is distributed amongst at least some of the autonomous device nodes of the distributed network other than the suspect autonomous device node, and (ii) transmitting the revocation message amongst the autonomous device nodes over the distributed network; and

authenticating the revocation message by comparing a first portion of the revocation message processed by a one-way function with a second portion of the revocation message.

2. The distributed revocation method as set forth in claim 1, further including:

forwarding the revocation message to other autonomous device nodes in other distributed networks.

3. The distributed revocation method as set forth in claim 1, further including:

authenticating the revocation message received at an autonomous device node by comparing a first portion of the revocation message processed by a hash function with a second portion of the revocation message.

4. The distributed revocation method as set forth in claim 1, further including:

incorporating a new autonomous device node into the distributed network responsive to transferal of partial revocation information for the new autonomous device node from the new autonomous device node to a plurality of autonomous device nodes already in the distributed network.

5. The distributed revocation method as set forth in claim 1, wherein the voting is weighted based on a trust factor indicative of trustworthiness of the suspect autonomous device node in the distributed network.

6. The distributed revocation method as set forth in claim 1, wherein the voting recurs over temporally limited revocation sessions, and votes in previous revocation sessions do not count in subsequent revocation sessions.

7. The distributed revocation method as set forth in claim 1, further including:

performing a plurality of medical functions using at least some of the autonomous device nodes of the distributed network.

8. A distributed network comprising:

a plurality of autonomous device nodes each configured to securely communicate with other autonomous device nodes to define the distributed network and to cooperate with other autonomous device nodes with which it is in secure communication to perform the distributed revocation method of claim 1.

9. A non-transitory digital medium carrying software which controls a processor to perform the method of claim 1.

10. An autonomous device node configured to securely communicate with other autonomous device nodes in a distributed network and to cooperate with other autonomous device nodes with which it is in secure communication to perform a distributed revocation method including (i) conducting a vote amongst at least three autonomous device nodes of a distributed network regarding whether a suspect autonomous device node of the distributed network should be removed from the distributed network, and (ii) ceasing communication with the suspect autonomous device node responsive to said vote satisfying a revocation criterion;

and

data storage for storing partial revocation information for other autonomous device nodes, the autonomous device node being further configured to cooperate with other autonomous device nodes to combine partial revocation information for the suspect autonomous device node stored in the data storage with partial revocation information for the suspect autonomous device node stored at other autonomous device nodes to construct a revocation message that is transmitted amongst the autonomous device nodes on the distributed network to effectuate ceasing of communication with the suspect autonomous device responsive to said vote satisfying the revocation criterion, wherein the revocation message received at each autonomous device node is authenticated by comparing a first portion of the revocation message processed by a one-way function with a second portion of the revocation message.

11. The autonomous device node as set forth in claim 10, further including:

data storage for storing complete revocation information, the autonomous device node being further configured to perform a distributed network joining method that includes communicating partial revocation information derived from the complete revocation information to a plurality of other autonomous device nodes, the partial revocation information communicated to each other autonomous device node being (i) insufficient by itself to reconstruct the complete revocation information but (ii) combinable with the partial revocation information communicated to the other autonomous device nodes to reconstruct the complete revocation information.

12. The autonomous device node as set forth in claim 10, wherein the vote is weighted based on a trust factor indicative of trustworthiness of the suspect autonomous device node in the distributed network.

13. A distributed revocation method comprising:

conducting a temporally limited revocation session at which individual decisions of a plurality of autonomous device nodes are combined to decide whether a suspect autonomous device node should be removed from the distributed network;

constructing a revocation message from revocation information previously distributed across at least some of the autonomous device nodes of the distributed network;

transmitting the revocation message amongst the autonomous device nodes over the distributed network other than the suspect autonomous device node; and

authenticating the revocation message the autonomous device nodes by comparing a first portion of the revocation message processed by a one-way function with a second portion of the revocation message; and

removing the suspect autonomous device node from the distributed network responsive to the authenticated revocation message.

14. The distributed revocation method as set forth in claim 13, further comprising:

repeating the conducting of the revocation session for subsequent revocation sessions that overlap temporally.

15. The distributed revocation method as set forth in claim 13, further comprising:

repeating the conducting of the revocation session for subsequent revocation sessions.

16. The distributed revocation method as set forth in claim 15, further including:

discarding the individual decisions made during a revocation session when said revocation session expires.

17. The distributed revocation method as set forth in claim 13, wherein the removing of the suspect autonomous device node from the distributed network further includes:

authenticating the revocation message at each autonomous device node other than the suspect autonomous device node that receives the revocation message; and

ceasing communication between the suspect autonomous device node and the revocation message-receiving autonomous device node responsive to successful authentication of the received revocation message.

18. The distributed revocation method as set forth in claim 13, further including:

incorporating a new autonomous device node into the distributed network responsive to distribution of revocation information for the new autonomous device node across at least some of the autonomous device nodes already in the distributed network.

19. The distributed revocation method as set forth in claim 13, wherein the conducting of the revocation session includes:

biasing the decision based on a trust factor indicative of a trustworthiness of the suspect autonomous device node.

20. An autonomous device node configured to securely communicate with other autonomous device nodes in a distributed network and to cooperate with other autonomous device nodes with which it is in secure communication to perform the distributed revocation method as set forth in claim 13.

21. In a distributed medical monitoring network, a plurality of nodes, each node programmed to:

communicate and conduct a vote with other nodes of the network whether to revoke network communication with a node detected engaging in one or more suspicious activities;

construct a revocation message by combining partial revocation information for revoking the suspect node that is distributed amongst the other nodes of the network other than the suspect node, and

transmit the revocation message amongst the plurality of nodes of the network, the revocation message including a first portion and a second portion,

authenticate the revocation message by comparing a first portion of the revocation message processed by a one-way function with a second portion of the revocation message,

cease communication with the suspect node responsive to said vote satisfying a revocation criteria.

22. The plurality of nodes as set forth in claim 21, further comprising:

a database storing the effect of each of a plurality of factors on a node trustworthiness, the communicating and voting being biased by trustworthiness of the node detected engaging in the one or more suspicious activities computed based on the factors stored in the database.

23. A distributed network comprising a plurality of nodes, each node configured to:

(i) randomly generate and transmit to other nodes partial revocation votes combinable to construct a revocation message against the node such that the partial revocation vote distributed to one other node cannot be replicated or forged by another node;

the revocation message including a first portion and a second portion; and

(ii) store partial revocation votes received from other nodes;

(iii) communicate and conduct a vote with other nodes of the network whether to revoke network communication with a node detected engaging in one or more suspicious activities;

(iv) authenticate the revocation message by processing one of a first and second portions of the revocation message processed by a one way function;

(v) cease communication with the suspect node responsive to said vote satisfying a revocation criteria.

24. The distributed network as set forth in claim 23, wherein the nodes comprise members of a peer-to-peer file sharing network.

25. The distributed network as set forth in claim 24, wherein each node further includes:

a list of copyrighted files, each node configured to disclose its partial revocation vote against another node responsive to detection of trafficking by the other node in a file included in the list of copyrighted files.

26. The distributed network as set forth in claim 23, wherein the nodes comprise members of a distributed medical monitoring network, and each node is configured to disclose its partial revocation vote against another node responsive to detection of suspicious activity by the other node.