Consigning authentication method

• US 8,726,335 B2
• Filed: 06/28/2010
• Issued: 05/13/2014
• Est. Priority Date: 06/28/2010
• Status: Active Grant

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Kotani, Seigo, Matsuguchi, Masaaski
• Primary Examiner(s): LEMMA, SAMSON B
• Application Number:
  US12/824,275
• Publication Number:
  US 20110321119A1
• Time in Patent Office: 1,415 Days
• Field of Search: 726/1, 726/25, 709/217
• US Class Current: 726/1
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals

Abstract

A method for sharing content between clients at a common trust level in a trust hierarchy associated with a network implementing policy-based management includes making a first request for delivery of content, receiving the requested electronic content, receiving a second request for delivery of the electronic content, communicating the second request, receiving a decision, and delivering the electronic content if the second request is granted. The first request is made to a policy enforcement point in the network for delivery of content to a first client, and includes a trust level of the first client. The second request is for delivery of the content to a second client at the trust level of the first client and includes integrity information about the second client, and is communicated to the policy enforcement point. If the second request is granted, the content is delivered from the first client to the second client.

Claims

1. A method for sharing content between clients at trust levels in a trust hierarchy associated with a network implementing policy-based management, the method comprising:

receiving a first request from a first client for delivery of content to the first client at a trust level in the trust hierarchy the trust hierarchy comprising at least two levels of trust allowing access to network resources, each progressively higher level in the trust hierarchy allowing additional access to the network resources, the network resources including at least the electronic content;

approving the delivery of content to the first client at a policy enforcement point in the network based at least in part on the trust level of the first client in the trust hierarchy;

delivering the content to the first client;

receiving a second request for permission from the first client allowing the first client to deliver the content to a second client at a trust level in the trust hierarchy, the second request including integrity information about the second client delivered to the first client from the second client, the trust level of the second client at least as trusted as the trust level of the first client, the integrity information comprising at least one of biometric information associated with the second client and the identification of software installed on the second client;

determining whether to allow the first client to deliver the content to the second client based at least in part on the integrity information about the second client and the trust level of the second client; and

communicating to the first client the determination of whether the first client may deliver the content to the second client.

2. The method according to claim 1, further comprising the second client sending a third request to the first client for delivery of the content from the first client.

3. The method according to claim 1, further comprising the first client negotiating with the policy enforcement point for permission to deliver the content to the second client.

4. The method according to claim 1, further comprising delivering the content from the first client to the second client.

5. The method according to claim 1, further comprising the second client requesting the content from the first client.

6. The method according to claim 1, further comprising:

the second client obtaining integrity information regarding the first client; and

the second client requesting the content from the first client.

7. The method according to claim 1, further comprising:

the second client obtaining integrity information regarding the first client;

the second client verifying the integrity information regarding the first client; and

the second client requesting the content from the first client only after verifying the integrity information regarding the first client.

8. The method according to claim 1, further comprising the first client obtaining the integrity information about the second client.

9. The method according to claim 1, further comprising:

the first client obtaining the integrity information about the second client; and

the first client verifying the integrity information about the second client;

wherein the first client sends the second request for permission only after verifying the integrity information about the second client.

10. The method according to claim 1, further comprising determining at least one limitation on the use of the content by the second client.

11. The method according to claim 1, wherein the first client is associated with a first entity and the second client is associated with a second entity.

12. The method according to claim 1, further comprising:

receiving a third request for permission from the second client allowing the second client to deliver the electronic content to a third client at the first trust level in the trust hierarchy, the third request including integrity information about the third client;

determining whether to allow the second client to deliver the electronic content to the third client based at least in part on the integrity information about the third client; and

communicating to the second client the determination of whether the second client may deliver the content to the third client.

13. A method for sharing content between clients at trust levels in a trust hierarchy associated with a network implementing policy-based management, the method comprising:

making a first request to a policy enforcement point in the network for delivery of content to a first client, the first request including a trust level of the first client;

receiving the requested content from the policy enforcement point;

receiving a second request from a second client for delivery of the content to the second client at a trust level in the trust hierarchy, the second request including integrity information about the second client and the trust level of the second client, the integrity information comprising at least one of biometric information associated with the second client and the identification of software installed on the second client the trust hierarchy comprising at least two levels of trust allowing access to network resources, each progressively higher level in the trust hierarchy allowing additional access to the network resources, the network resources including at least the content, the trust level of the second client being at least as trusted as the trust level of the first client;

communicating the second request to the policy enforcement point;

receiving a decision from the policy enforcement point regarding the second request; and

if the second request is granted, delivering the content to the second client.

14. The method according to claim 13, further comprising the second client sending the second request to the first client.

15. The method according to claim 13, wherein the first client is associated with a first entity and the second client is associated with a second entity.

16. The method according to claim 13, further comprising negotiating with the policy enforcement point for permission to deliver the content to the second client.

17. The method according to claim 13, further comprising:

the second client obtaining integrity information regarding the first client; and

the second client requesting the content from the first client.

18. The method according to claim 13, further comprising:

the second client obtaining integrity information regarding the first client;

the second client verifying the integrity information regarding the first client; and

the second client requesting the content from the first client only after verifying the integrity information regarding the first client.

19. The method according to claim 13, further comprising:

the first client verifying the integrity information about the second client;

wherein the first client communicates the second request only after verifying the integrity information about the second client.

20. The method according to claim 13, wherein the decision from the policy enforcement point includes at least one limitation on the use of the content by the second client.

21. A network system for sharing electronic content among clients at a common trust level in a trust hierarchy, the network system implementing policy-based management, the network system comprising:

a plurality of clients, each client having a respective trust level in the trust hierarchy the trust hierarchy comprising at least two levels of trust allowing access to network resources, each progressively higher level in the trust hierarchy allowing additional access to the network resources, the network resources including at least the electronic content;

a storage unit configured to deliver electronic content to the plurality of clients;

a policy enforcement point in electronic communication with the storage unit and a first one of the plurality of clients, the policy enforcement point configured to receive a first request from the first one of the plurality of clients for the delivery of electronic content from the storage unit; and

a policy decision point in electronic communication with the policy enforcement point, the policy decision point configured to assess the first one of the plurality of clients including assessing at least the trust level of the first one of the plurality of clients and to grant permission to the policy enforcement point to deliver the content from the storage unit to the first one of the plurality of clients;

the policy enforcement point further configured to receive from the first one of the plurality of clients a second request for permission to deliver the electronic content to a second one of the plurality of clients, the second request including at least integrity information associated with the second one of the plurality of clients, the trust level of the second one of the plurality of clients at least as trusted as the trust level of the first one of the plurality of clients, the integrity information comprising at least one of biometric information associated with the second one of the plurality of clients and the identification of software installed on the second one of the plurality of clients; and

the policy decision point further configured to make a policy-based decision whether to allow the first one of the plurality of clients to deliver the electronic content to the second one of the plurality of clients based at least in part on the integrity information associated with the second one of the plurality of clients and the trust level of the second one of the plurality of clients.