Trust spectrum for certificate distribution in distributed peer-to-peer networks

• US 20030070070A1
• Filed: 06/07/2002
• Published: 04/10/2003
• Est. Priority Date: 07/31/2001
• Status: Active Grant

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Yeager, William J., Chen, Rita Y.
• Granted Patent: US 7,383,433 B2
• Time in Patent Office: Days
• US Class Current: 713/157
• CPC Class Codes: G06F 9/544 Buffers; Shared memory; Pipes
• CPC Class Codes: G06Q 30/02 Marketing; Price estimation or determination; Fundraising
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/50 Address allocation
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks
• CPC Class Codes: H04L 67/1042 using topology management mechanisms
• CPC Class Codes: H04L 67/1044 Group management mechanisms management of multicast group membership H04L12/185; reconfiguring of node membership in a computing system to eliminate errors G06F11/1425
• CPC Class Codes: H04L 67/1046 Joining mechanisms
• CPC Class Codes: H04L 67/1048 Departure or maintenance mechanisms
• CPC Class Codes: H04L 67/1057 involving pre-assessment of levels of reputation of peers
• CPC Class Codes: H04L 67/1068 Discovery involving direct consultation or announcement among potential requesting and potential source peers
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

Embodiments of a decentralized, distributed trust mechanism that may be used in peer-to-peer platforms, to implement trust relationships based on data relevance between peers on a network and to implement trust relationships between peers and content and data (codat). In one embodiment, the trust mechanism may provide a trust spectrum of multiple levels wherein unique peer identities may be established to enable authentication and the assignment of the peers'"'"' associated access policies within a peer group. In one embodiment, the trust spectrum may have Certificate Authority signed certificates as a maximum level of security, and self-signed certificates as a minimum level of security. Since a certificate is one form of codat, in one embodiment the trust mechanism may be applied to a peer group member'"'"'s collection of signed certificates for a given peer group.

Claims

1. A peer computing system comprising:

a plurality of peer nodes;

at least a subset of the plurality of peer nodes configured to participate in areas of interest to find and exchange codats relevant to the areas of interest, wherein a codat is computer-representable content or data;

wherein the at least a subset of the plurality peer nodes is further configured to participate in a distributed trust mechanism to establish and maintain trust relationships among the peer nodes in particular areas of interest from trust evaluations of codat exchange among the peer nodes in the particular areas of interest; and

wherein the distributed trust mechanism is configured to provide secure access to codats at a plurality of levels of trust, wherein one or more of the levels of trust use certificates to provide secure access to the codats, wherein a certificate is a security credential corresponding to a particular peer node.

2. The peer computing system as recited in claim 1, wherein two or more of the plurality of peer nodes are configured to participate as members in a peer group at one level of the plurality of levels of trust in accordance with the distributed trust mechanism.

3. The peer computing system as recited in claim 2, wherein the levels of trust include one or more of:

self-signed certificates wherein a certificate is signed by a peer node corresponding to the certificate;

cosigned certificates wherein a certificates is signed by the peer node corresponding to the certificate and at least one other peer node;

pseudo-Certificate Authority signed certificates wherein a certificate is signed by a peer group member configured to act as a Certificate Authority;

satellite Certificate Authority signed certificates wherein a certificate is signed by a peer group member assigned as a satellite Certificate Authority by a central Certificate Authority; and

Certificate Authority signed certificates wherein a certificate is signed by a network Certificate Authority.

4. The peer computing system as recited in claim 2, wherein each member in the peer group is configured to store trust in certificates received from other members of the peer group.

5. The peer computing system as recited in claim 1, wherein each of the at least a subset of the plurality of peer nodes is configured to determine trust in certificates received from other peer nodes in accordance with the distributed trust mechanism.

6. The peer computing system as recited in claim 5, wherein, to determine trust in certificates received from other peer nodes in accordance with the distributed trust mechanism, each of the plurality of peer nodes is further configured to:

determine trust in a network path comprising one or more of the plurality of peer nodes between the peer node and a peer node corresponding to a particular certificate; and

determine the trust in the particular certificate from the trust in the network path.

7. The peer computing system as recited in claim 6, wherein the trust in the network path is a function of the peer node'"'"'s trust in each of the one or more other peer nodes on the network path and the peer node'"'"'s trust in the provider peer node.

8. The peer computing system as recited in claim 1, wherein the plurality of peer nodes is configured to implement a peer-to-peer environment on the network according to a peer-to-peer platform comprising one or more peer-to-peer platform protocols for enabling the plurality of peer nodes to discover each other, to communicate with each other, and to find and exchange the codats in the peer-to-peer environment.

9. A peer computing system comprising:

a plurality of peer nodes;

at least a subset of the plurality of peer nodes configured to participate in areas of interest to find and exchange codats relevant to the areas of interest, wherein a codat is computer-representable content or data;

wherein the at least a subset of the plurality peer nodes is further configured to participate in a distributed trust mechanism to establish and maintain trust relationships among the peer nodes in particular areas of interest from trust evaluations of codat exchange among the peer nodes in the particular areas of interest;

wherein the distributed trust mechanism is configured to provide secure access to codats using certificates, wherein a certificate is a security credential corresponding to a particular peer node; and

wherein the at least a subset of the plurality of peer nodes is further configured to determine trust in certificates received from other peer nodes in accordance with the distributed trust mechanism.

10. The peer computing system as recited in claim 9, wherein, to determine trust in certificates received from other peer nodes in accordance with the distributed trust mechanism, each of the plurality of peer nodes is further configured to:

determine trust in a network path comprising one or more of the plurality of peer nodes between the peer node and a peer node corresponding to a particular certificate; and

determine the trust in the particular certificate from the trust in the network path.

11. The peer computing system as recited in claim 10, wherein the trust in the network path is a function of the peer node'"'"'s trust in each of the one or more other peer nodes on the network path and the peer node'"'"'s trust in the provider peer node.

12. The peer computing system as recited in claim 9, wherein the plurality of peer nodes is configured to implement a peer-to-peer environment on the network according to a peer-to-peer platform comprising one or more peer-to-peer platform protocols for enabling the plurality of peer nodes to discover each other, to communicate with each other, and to find and exchange the codats in the peer-to-peer environment.

13. A peer node comprising:

a processor;

a memory comprising program instructions, wherein the program instructions are executable by the processor to;

participate in an area of interest with other peer nodes on a network to find and exchange codats relevant to the area of interest, wherein a codat is computer-representable content or data; and

implement a distributed trust mechanism to establish and maintain trust relationships with the other peer nodes in the area of interest from trust evaluations of codat exchange with the peer nodes in the area of interest.

wherein the distributed trust mechanism is configured to provide secure access to codats using certificates, wherein a certificate is a security credential corresponding to a particular peer node; and

wherein the peer node is further configured to determine trust in certificates received from the other peer nodes in accordance with the distributed trust mechanism.

14. The peer node as recited in claim 13,

wherein the distributed trust mechanism is configured to provide secure access to codats at a plurality of levels of trust, wherein one or more of the levels of trust use certificates to provide secure access to the codats, wherein a certificate is a security credential corresponding to a particular peer node;

and

wherein the peer node is further configured to participate with one or more of the other peer nodes as members in a peer group at one level of the plurality of levels of trust in accordance with the distributed trust mechanism.

15. The peer node as recited in claim 14, wherein the levels of trust include one or more of:

self-signed certificates wherein a certificate is signed by a peer node associated with the certificate;

cosigned certificates wherein a certificates is signed by the peer node associated with the certificate and at least one other peer node;

pseudo-Certificate Authority signed certificates wherein a certificate is signed by a peer group member configured to act as a Certificate Authority;

satellite Certificate Authority signed certificates wherein a certificate is signed by a peer group member assigned as a satellite Certificate Authority by a central Certificate Authority; and

Certificate Authority signed certificates wherein a certificate is signed by a network Certificate Authority.

16. The peer node as recited in claim 14, wherein the peer node is further configured to store trust in certificates received from other members of the peer group.

17. The peer node as recited in claim 13, wherein the peer node is further configured to determine trust in certificates received from the other peer nodes in accordance with the distributed trust mechanism.

18. The peer node as recited in claim 17, wherein, to determine trust in certificates received from the other peer nodes in accordance with the distributed trust mechanism, the peer node is further configured to:

determine trust in a network path comprising one or more of the plurality of peer nodes between the peer node and a peer node corresponding to a particular certificate; and

determine the trust in the particular certificate from the trust in the network path.

19. The peer node as recited in claim 18, wherein the trust in the network path is a function of the peer node'"'"'s trust in each of the one or more other peer nodes on the network path and the peer node'"'"'s trust in the provider peer node.

20. The peer node as recited in claim 13, wherein the program instructions are further executable within the peer node to participate with the other peer nodes in a peer-to-peer environment on the network according to a peer-to-peer platform comprising one or more peer-to-peer platform protocols for enabling peer nodes to discover each other, to communicate with each other, and to find and exchange the codats in the peer-to-peer environment.

21. A method comprising:

a peer node participating in an area of interest with other peer nodes on a network to find and exchange codats relevant to the area of interest, wherein a codat is computer-representable content or data;

the peer node establishing and maintaining trust relationships with the other peer nodes in the area of interest from trust evaluations of codat exchange with the peer nodes in the area of interest in accordance with a distributed trust mechanism;

wherein the distributed trust mechanism is configured to provide secure access to codats using certificates, wherein a certificate is a security credential corresponding to a particular peer node; and

the peer node determining trust in certificates received from the other peer nodes in accordance with the distributed trust mechanism.

22. The method as recited in claim 21, wherein the distributed trust mechanism is configured to provide secure access to codats at a plurality of levels of trust, wherein one or more of the levels of trust use certificates to provide secure access to the codats, wherein a certificate is a security credential corresponding to a particular peer node, the method further comprising:

the peer node participating with one or more of the other peer nodes as members in a peer group at one level of the plurality of levels of trust in accordance with the distributed trust mechanism.

23. The method as recited in claim 22, wherein the levels of trust include one or more of:

self-signed certificates wherein a certificate is signed by a peer node associated with the certificate;

cosigned certificates wherein a certificates is signed by the peer node associated with the certificate and at least one other peer node;

pseudo-Certificate Authority signed certificates wherein a certificate is signed by a peer group member configured to act as a Certificate Authority;

satellite Certificate Authority signed certificates wherein a certificate is signed by a peer group member assigned as a satellite Certificate Authority by a central Certificate Authority; and

Certificate Authority signed certificates wherein a certificate is signed by a network Certificate Authority.

24. The method as recited in claim 22, further comprising the peer node storing trust in certificates received from other members of the peer group.

25. The method as recited in claim 21, further comprising the peer node determining trust in certificates received from the other peer nodes in accordance with the distributed trust mechanism.

26. The method as recited in claim 25, wherein, in said determining trust in certificates received from the other peer nodes in accordance with the distributed trust mechanism, the method further comprises:

the peer node determining trust in a network path comprising one or more of the plurality of peer nodes between the peer node and a peer node corresponding to a particular certificate; and

the peer node determining the trust in the particular certificate from the trust in the network path.

27. The method as recited in claim 26, wherein the trust in the network path is a function of the peer node'"'"'s trust in each of the one or more other peer nodes on the network path and the peer node'"'"'s trust in the provider peer node.

28. The method as recited in claim 21, wherein the peer nodes are configured to implement a peer-to-peer environment on the network according to a peer-to-peer platform comprising one or more peer-to-peer platform protocols for enabling the peer nodes to discover each other, communicate with each other, and to find and exchange the codats in the peer-to-peer environment.

29. An article of manufacture comprising software instructions executable to implement:

a peer node participating in an area of interest with other peer nodes on a network to find and exchange codats relevant to the area of interest, wherein a codat is computer-representable content or data;

the peer node establishing and maintaining trust relationships with the other peer nodes in the area of interest from trust evaluations of codat exchange with the peer nodes in the area of interest in accordance with the distributed trust mechanism;

wherein the distributed trust mechanism is configured to provide secure access to codats using certificates, wherein a certificate is a security credential corresponding to a particular peer node; and

the peer node determining trust in certificates received from the other peer nodes in accordance with the distributed trust mechanism.

30. The article of manufacture as recited in claim 29, wherein the distributed trust mechanism is configured to provide secure access to codats at a plurality of levels of trust, wherein one or more of the levels of trust use certificates to provide secure access to the codats, wherein a certificate is a security credential corresponding to a particular peer node, and wherein the software instructions are further executable to implement:

the peer node participating with one or more of the other peer nodes as members in a peer group at one level of the plurality of levels of trust in accordance with the distributed trust mechanism.

31. The article of manufacture as recited in claim 30, wherein the levels of trust include one or more of:

self-signed certificates wherein a certificate is signed by a peer node associated with the certificate;

cosigned certificates wherein a certificates is signed by the peer node associated with the certificate and at least one other peer node;

pseudo-Certificate Authority signed certificates wherein a certificate is signed by a peer group member configured to act as a Certificate Authority;

satellite Certificate Authority signed certificates wherein a certificate is signed by a peer group member assigned as a satellite Certificate Authority by a central Certificate Authority; and

Certificate Authority signed certificates wherein a certificate is signed by a network Certificate Authority.

32. The article of manufacture as recited in claim 30, wherein the software instructions are further executable to implement the peer node storing trust in certificates received from other members of the peer group.

33. The article of manufacture as recited in claim 29, wherein the software instructions are further executable to implement the peer node determining trust in certificates received from the other peer nodes in accordance with the distributed trust mechanism.

34. The article of manufacture as recited in claim 33, wherein, in said determining trust in certificates received from the other peer nodes in accordance with the distributed trust mechanism, the software instructions are further executable to implement:

the peer node determining trust in a network path comprising one or more of the plurality of peer nodes between the peer node and a peer node corresponding to a particular certificate; and

the peer node determining the trust in the particular certificate from the trust in the network path.

35. The article of manufacture as recited in claim 34, wherein the trust in the network path is a function of the peer node'"'"'s trust in each of the one or more other peer nodes on the network path and the peer node'"'"'s trust in the provider peer node.

36. The article of manufacture as recited in claim 29, wherein the peer nodes are configured to implement a peer-to-peer environment on the network according to a peer-to-peer platform comprising one or more peer-to-peer platform protocols for enabling the peer nodes to discover each other, communicate with each other, and to find and exchange the codats in the peer-to-peer environment.