Access control to secured application features using client trust levels

• US 9,531,695 B2
• Filed: 06/12/2009
• Issued: 12/27/2016
• Est. Priority Date: 06/12/2009
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Koppolu, Lokesh Srinivas, Raghav, Amritansh, Krantz, Anton W.
• Primary Examiner(s): Zele, Krista
• Assistant Examiner(s): FABBRI, ANTHONY E
• Application Number:
  US12/483,239
• Publication Number:
  US 20100319063A1
• Time in Patent Office: 2,755 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 65/1073 Registration or de-registration
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]

Abstract

Architecture that facilitates the conveyance of a trust level when the caller makes a call, the trust level in dependence on the state of the caller system. The callee (call recipient) receives notification of the trust level and can use this information in the communication such as to request verification from the caller and/or initiate other modes of communication. A caller can authenticate the caller identity in different ways to a communication server. Based on that, the server can assign an appropriate server-verified trust level to the caller. Further, an unsecured phone controller can indicate a lower client-side defined trust level. The server verified and client-side trust levels are then sent to the callee, where the callee determines whether to allow caller access to one or more secured features based on the feature values and the trust level imposed by the callee to access those features.

Claims

1. A computer-implemented communications security system, comprising:

a caller client device that computes caller client device trust level information of the caller client device;

a registration server that receives registration sign-in credentials from the caller client device and the caller client device trust level information, and determines registration trust level information based on the registration sign-in credentials and the caller client device trust level information; and

a callee client device that receives from the caller client device, the registration trust level information and the caller client device trust level information, the callee client device managing communicative interaction with the caller client based on the registration trust level information,

wherein the callee client device requests access to features of secured applications based on the registration trust level information and the computed caller client device trust level information received from the caller client device, and

wherein the caller client device creates a verify message designating an access security state of the caller client device, and recomputes the caller client device trust level information based on a change to the access security state of the caller client device and sends the recomputed caller client device trust level information to the callee client device.

2. The system of claim 1, wherein the caller client device sends the registration trust level information in combination with a call initiated by the caller client device to the callee client device.

3. The system of claim 2, wherein the registration server is IP-based, and the caller client device sends the registration trust level information as session initiation protocol (SIP) messages in combination with an IP call via the IP based registration server to the callee client device.

4. The system of claim 1, wherein the caller client device sends the recomputed caller client device trust level information to the callee client device.

5. The system of claim 1, wherein the caller client device creates the verify message that designates verification results verifying the caller client device trust level information of the caller client device to the callee client device.

6. The system of claim 1, wherein the registration trust level information is signed by a registration server computer as part of the registration to the registration server computer.

7. The system of claim 1, wherein the caller client device receives suggestions as to actions to take that result in a different level of the registration trust level information.

8. A computer-implemented communications security system, comprising:

a caller client device that computes caller client device trust level information of the caller client device;

a registration server that receives registration sign-in credentials from the caller client device and the caller client device trust level information, and computes registration trust level information based on the registration sign-in credentials and caller client device trust level information, and

a callee client device that receives from the caller client device, the registration trust level information and the caller client device trust level information;

wherein the callee client requests access to features of secured applications based on the registration trust level information and the computed caller client device trust level information, and

wherein the caller client recomputes the caller client device trust level information based on a change to the access security state, and sends the recomputed caller client device trust level information to the callee.

9. The system of claim 8, wherein the caller client device trust level information is sent with the registration sign-in credentials to the call registration server for registration, the registration trust level information computed based on the registration sign-in credentials and the caller client device trust level information.

10. The system of claim 8, wherein the caller client sends the registration trust level information and caller client device trust level information as SIP messages in combination with an IP call initiated by the caller client to the callee client.

11. The system of claim 8, wherein the caller client sends the recomputed caller client device trust level information to the callee client.

12. A computer-implemented communications security method, comprising:

creating the caller client trust level information at the caller client;

sending sign-in credentials and the caller client trust level information from the caller client to a call communications infrastructure comprising a registration server for registration;

registering the caller client with the registration server using the sign-in credentials;

creating the registration trust level information based on both the sign in credentials and the caller client trust level information;

receiving registration trust level information at the caller client based on the registration;

transmitting the registration trust level information and the caller client trust level information to a callee client;

controlling interaction from the callee client to the caller client based on the registration trust level information;

validating an access security state of the caller client by the caller client and recomputing caller client trust level information of the caller client based on a change to an access security state of the caller client;

sending the recomputed caller client trust level information to the callee client; and

exposing application features to the caller client via the callee client based on the recomputed caller client trust level information of the caller client.

13. The method of claim 12, wherein the call communications infrastructure is IP-based, and the caller client sends the registration trust level information and the caller client trust level information in SIP messages to the callee client.

14. The method of claim 12, further comprising:

controlling interaction from the callee client to the caller client based on the caller client trust level information and the registration trust level information.

15. The method of claim 14, further comprising exposing application features to the caller client via the callee client based on the caller client trust level information and the registration trust level information.