Managing network identities

• US 8,875,307 B2
• Filed: 05/03/2012
• Issued: 10/28/2014
• Est. Priority Date: 05/03/2012
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP AG (SAP SE)
• Inventors: Puri, Sunil
• Primary Examiner(s): SHAW, BRIAN F
• Application Number:
  US13/463,772
• Publication Number:
  US 20130298258A1
• Time in Patent Office: 908 Days
• Field of Search: 709/223, 709/238, 709/224, 370/254, 715/853, 715/735, 715/736, 715/738, 726/28
• US Class Current: 726/28
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: H04L 12/44 Star or tree networks
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

Techniques for managing network identities include generating, with a local computing system, a tree structure representing a network comprising a plurality of entities, the tree structure comprising a plurality of nodes, each node of the plurality of nodes representing an entity of the plurality of entities, at least one entity of the plurality of entities is represented by more than one node of the plurality of nodes; assigning a unique identifier to each node; identifying each node of the plurality of nodes as being a protected node or an unprotected node; and transmitting, to a remote computing system, the tree structure, the unique identifiers for the protected nodes, and identity information of the entities for the unprotected nodes.

Claims

1. A method for managing network identities, the method comprising:

generating, with a local computing system, a tree structure representing a network comprising a plurality of entities, the tree structure comprising a plurality of nodes, each node of the plurality of nodes representing an entity of the plurality of entities, at least one entity of the plurality of entities is represented by more than one node of the plurality of nodes;

assigning a unique identifier to the each node, wherein assigning a unique identifier to the each node comprises;

generating a number by combining an identification number of the entity associated with the each node and identification numbers of entities associated with nodes along a full path from a root node of the tree structure to the each node according to the position of every node along the full path; and

encrypting the combined number to obtain the unique identifier;

identifying the each node of the plurality of nodes as being a protected node or an unprotected node, wherein a mapping of each unique identifier to information about the entity associated with the each node associated with the unique identifier is maintained in memory; and

transmitting, to a remote computing system, the tree structure, the unique identifiers for the protected nodes, and identity information of the entities for the unprotected nodes.

2. The method of claim 1, wherein assigning a unique identifier to the each node further comprises:

assigning a unique number to the each node based on an order that a user of the remote computing system expands the nodes of the tree structure.

3. The method of claim 1, wherein identifying the each node of the plurality of nodes as being a protected node or an unprotected node comprises:

determining that a user of the remote computing system has permission to view identity information of the entity associated with the each node; and

identifying the each node as being an unprotected node.

4. The method of claim 1, wherein identifying the each node of the plurality of nodes as being a protected node or an unprotected node comprises:

determining that a user of the remote computing system does not have permission to view identity information of the entity associated with the each node; and

identifying the each node as being a protected node.

5. The method of claim 1, wherein the at least one entity represented by more than one node of the plurality of nodes is associated with at least one protected node.

6. A computer storage medium encoded with a computer program, the program comprising instructions that when executed by one or more computers cause the one or more computers to perform operations comprising:

generating, with a local computing system, a tree structure representing a network comprising a plurality of entities, the tree structure comprising a plurality of nodes, each node of the plurality of nodes representing an entity of the plurality of entities, at least one entity of the plurality of entities is represented by more than one node of the plurality of nodes;

assigning a unique identifier to the each node, wherein assigning a unique identifier to the each node comprises;

generating a number by combining an identification number of the entity associated with the each node and identification numbers of entities associated with nodes along a full path from a root node of the tree structure to the each node according to the position of every node along the full path; and

encrypting the combined number to obtain the unique identifier;

identifying the each node of the plurality of nodes as being a protected node or an unprotected node, wherein a mapping of each unique identifier to information about the entity associated with the each node associated with the unique identifier is maintained in memory; and

transmitting, to a remote computing system, the tree structure, the unique identifiers for the protected nodes, and identity information of the entities for the unprotected nodes.

7. The computer storage medium of claim 6, wherein assigning a unique identifier to the each node further comprises:

assigning a unique number to the each node based on an order that a user of the remote computing system expands the nodes of the tree structure.

8. The computer storage medium of claim 6, wherein identifying the each node of the plurality of nodes as being a protected node or an unprotected node comprises:

determining that a user of the remote computing system has permission to view identity information of the entity associated with the each node; and

identifying the each node as being an unprotected node.

9. The computer storage medium of claim 6, wherein identifying the each node of the plurality of nodes as being a protected node or an unprotected node comprises:

determining that a user of the remote computing system does not have permission to view identity information of the entity associated with the each node; and

identifying the each node as being a protected node.

10. The computer storage medium of claim 6, wherein the at least one entity represented by more than one node of the plurality of nodes is associated with at least one protected node.

11. A system of one or more computers configured to perform operations comprising:

generating, with a local computing system, a tree structure representing a network comprising a plurality of entities, the tree structure comprising a plurality of nodes, each node of the plurality of nodes representing an entity of the plurality of entities, at least one entity of the plurality of entities is represented by more than one node of the plurality of nodes;

assigning a unique identifier to the each node, wherein assigning a unique identifier to the each node comprises;

generating a number by combining an identification number of the entity associated with the each node and identification numbers of entities associated with nodes along a full path from a root node of the tree structure to the each node according to the position of every node along the full path; and

encrypting the combined number to obtain the unique identifier;

identifying the each node of the plurality of nodes as being a protected node or an unprotected node, wherein a mapping of each unique identifier to information about the entity associated with the each node associated with the unique identifier is maintained in memory; and

transmitting, to a remote computing system, the tree structure, the unique identifiers for the protected nodes, and identity information of the entities for the unprotected nodes.

12. The system of claim 11, wherein assigning a unique identifier to the each node further comprises:

assigning a unique number to the each node based on an order that a user of the remote computing system expands the nodes of the tree structure.

13. The system of claim 11, wherein identifying the each node of the plurality of nodes as being a protected node or an unprotected node comprises:

determining that a user of the remote computing system has permission to view identity information of the entity associated with the each node; and

identifying the each node as being an unprotected node.

14. The system of claim 11, wherein identifying the each node of the plurality of nodes as being a protected node or an unprotected node comprises:

determining that a user of the remote computing system does not have permission to view identity information of the entity associated with the each node; and

identifying the each node as being a protected node.

15. The system of claim 11, wherein the at least one entity represented by more than one node of the plurality of nodes is associated with at least one protected node.