Using a network-service credential for access control

• US 20060156390A1
• Filed: 01/07/2005
• Published: 07/13/2006
• Est. Priority Date: 01/07/2005
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Baugher, Mark John
• Granted Patent: US 7,533,258 B2
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213

Abstract

Methods and devices for controlling access to a service over a network are described. A credential is provided to a device. The credential indicates the device is enrolled in the network. The credential is stored in non-volatile memory on the device. The credential binds the device to the network and prevents the device from accessing another network. The device presents the credential to a provider, and the provider uses the credential to authenticate and authorize the device. Upon authorization, the device is provided access to the service.

Claims

1. A method for controlling access to a service over a network, said method comprising:

receiving a credential at a device, wherein said credential indicates said device is enrolled in said network;

storing said credential in non-volatile memory on said device, wherein said credential binds said device to said network and prevents said device from accessing another network; and

said device presenting said credential to a provider of said service, wherein said provider uses said credential to authenticate and authorize said device, wherein upon authorization said device is provided access to said service.

2. The method of claim 1 wherein said credential is issued by said provider.

3. The method of claim 1 wherein said credential is a Digital Transmission License Authority (DTLA) credential.

4. The method of claim 1 wherein said credential comprises a cryptographic identity of said device and of said provider.

5. The method of claim 1 wherein said network comprises a plurality of devices coupled to a local server, said local server couplable via the Internet to a remote server for said provider, wherein said local server enrolls with said remote server and wherein said devices enroll with said local server.

6. The method of claim 1 wherein said device is a multi-homed device having a plurality of public addresses, wherein said device is assigned a credential for each of said addresses.

7. A computer-usable medium having computer-readable program code embodied therein for causing a device to execute a method for controlling access to a service over a network, said method comprising:

receiving a credential at a device, wherein said credential indicates said device is enrolled in said network;

storing said credential in non-volatile memory on said device, wherein said credential binds said device to said network and prevents said device from accessing another network; and

said device presenting said credential to a provider of said service, wherein said provider uses said credential to authenticate and authorize said device, wherein upon authorization said device is provided access to said service.

8. The computer-usable medium claim 7 wherein said credential is issued by said provider.

9. The computer-usable medium claim 7 wherein said credential is a Digital Transmission License Authority (DTLA) credential.

10. The computer-usable medium claim 7 wherein said credential comprises a cryptographic identity of said device and of said provider.

11. The computer-usable medium claim 7 wherein said network comprises a plurality of devices coupled to a local server, said local server couplable via the Internet to a remote server for said provider, wherein said local server enrolls with said remote server and wherein said devices enroll with said local server.

12. The computer-usable medium claim 7 wherein said device is a multi-homed device having a plurality of public addresses, wherein said device is assigned a credential for each of said addresses.

13. A system for controlling access to a service over a network, said system comprising:

means for receiving a credential at a device, wherein said credential indicates said device is enrolled in said network;

means for storing said credential in non-volatile memory on said device, wherein said credential binds said device to said network and prevents said device from accessing another network; and

means for said device presenting said credential to a provider of said service, wherein said provider uses said credential to authenticate and authorize said device, wherein upon authorization said device is provided access to said service.

14. A device comprising:

a bus;

a processor coupled to said bus; and

a memory unit coupled to said bus, said memory unit containing instructions that when executed implement a computer-implemented method for controlling access to a service over a network, said method comprising;

receiving a credential at said device, wherein said credential indicates said device is enrolled in said network;

storing said credential in non-volatile memory on said device, wherein said credential binds said device to said network and prevents said device from accessing another network; and

presenting said credential to a provider of said service, wherein said provider uses said credential to authenticate and authorize said device, wherein upon authorization said device is provided access to said service.

15. The device of claim 14 wherein said credential is issued by said provider.

16. The device of claim 14 wherein said credential is a Digital Transmission License Authority (DTLA) credential.

17. The device of claim 14 wherein said credential comprises a cryptographic identity of said device and of said provider.

18. The device of claim 14 wherein said network comprises a plurality of devices coupled to a local server, said local server couplable via the Internet to a remote server for said provider, wherein said local server enrolls with said remote server and wherein said devices enroll with said local server.

19. The device of claim 14 wherein said device is also associated with an Internet Protocol (IP) address, wherein said IP address is used in combination with said credential to determine whether access to said service is permitted.

20. The device of claim 14 wherein said device is a multi-homed device having a plurality of public addresses, wherein said device is assigned a credential for each of said addresses.