Using an identity-based communication layer for computing device communication

• US 20090006840A1
• Filed: 02/25/2003
• Published: 01/01/2009
• Est. Priority Date: 07/29/2002
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Douglas, David C., Traub, Kenneth R., Birger, Chet, Rosenthal, Steven
• Granted Patent: US 7,962,655 B2
• Time in Patent Office: Days
• US Class Current: 713/151
• CPC Class Codes: H04L 61/50 Address allocation
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]

Abstract

A computer architecture for enterprise device applications provides a real-time, bi-directional communication layer for device communication. An identity-based communications layer provides for secure, end-to-end telemetry and control communications by enabling mutual authentication and encryption between the devices and the enterprise. The identity-based communications layer is situated between a network layer and an application layer and transmits a message between two devices identified by a global address. The global address specifies a protocol, a network, and an address meaningful for the combination of the protocol and the network.

Claims

1. A method for communicating between two endpoints connected to a network, the method comprising having a first endpoint use a global address of a second endpoint to communicate with the second endpoint, wherein:

the global address specifies a protocol, a network identifier, and an address meaningful for the combination of the protocol and a network identified by the network identifier,

an application sends messages directed to the second endpoint through an identity-based communication layer that is situated between a network layer and an application layer, the messages being independent of the protocol, and

the identity-based communication layer transmits the messages to the second endpoint using the protocol, the network, and the address specified by the global address.

2. The method of claim 1 further comprising determining the global address of the second endpoint by using a unique identity identifier associated with the second endpoint.

3. The method of claim 2 wherein the global address may be different each time a session is initiated with the second endpoint.

4. The method of claim 2 wherein:

the unique identity identifier specifies a realm and a unique identifier that identifies the second endpoint within the realm, and

the combination of the realm and the unique identifier uniquely identifies the identity.

5. The method of claim 2 wherein the unique identity identifier comprises an identity identifier for a composite identity, the composite identity being associated with two or more other identity identifiers.

6. The method of claim 5 wherein the composite identity is associated with an authentication credential.

7. The method of claim 5 further comprising creating the composite identity only when each of the two or more other identity identifiers associated with the composite identity have been authenticated.

8. The method of claim 5 wherein at least one of the two or more other identity identifiers associated with the composite identity comprises an identity identifier for another composite identity.

9. The method of claim 2 wherein determining the global address is accomplished through the use of a presence and availability service that provides the global address in response to a received identity identifier.

10. The method of claim 9 further comprising having the second endpoint announce the global address of the second endpoint through the use of the presence and availability service.

11. The method of claim 10 further comprising:

determining whether the second endpoint is permitted to announce the global address; and

only when the second endpoint is permitted to announce the global address, having the second endpoint announce the global address through the use of the presence and availability service.

12. The method of claim 11 wherein determining whether the second endpoint is permitted to announce the global address is based on the identity identifier of the second endpoint.

13. The method of claim 11 wherein determining whether the second endpoint is permitted to announce the global address is performed by a policy service.

14. The method of claim 10 wherein the global address the presence and availability service provides in response to an identity identifier is the global address most recently announced by the endpoint associated with that identity identifier.

15. The method of claim 2 wherein determining the global address of the second endpoint occurs during an authentication procedure involving the first endpoint, the second endpoint and a third entity.

16. The method of claim 15 further comprising:

determining whether a communication session between the second endpoint and a first endpoint is permitted; and

completing the authentication procedure only when the communication session is permitted.

17. The method of claim 16 wherein determining whether the communication session is permitted is based on the identity identifier of at least one of the second endpoint and the first endpoint.

18. The method of claim 16 wherein determining whether the communication session is permitted is performed by a policy service.

19. The method of claim 1 further comprising encrypting messages exchanged in the communication session between the first endpoint and the second endpoint.

20. The method of claim 19 farther comprising having a policy service determine whether to encrypt messages exchanged in the communication session between the first endpoint and the second endpoint.

21. The method of claim 19 wherein determining whether to encrypt messages occurs when the first endpoint initiates a communication session with the second endpoint.

22. The method of claim 19 wherein determining whether to encrypt messages is based on the identity identifier of at least one of the first endpoint and the second endpoint.

23. The method of claim 19 wherein determining whether to encrypt messages occurs during an authentication procedure involving the first endpoint, the second endpoint, and a third entity.

24. The method of claim 1 further comprising applying an integrity check to a message exchanged in the communication session between the first endpoint and the second endpoint.

25. The method of claim 24 wherein the integrity check employs a message authentication code.

26. The method of claim 24 further comprising having a policy service determine whether to apply integrity checks to messages exchanged in the communication session between the first endpoint and the second endpoint.

27. The method of claim 24 wherein determining whether to apply data integrity checks occurs when the first endpoint initiates a communication session with the second endpoint.

28. The method of claim 27 wherein determining whether to apply data integrity checks is based on the identity identifier of at least one of the first endpoint and the second endpoint.

29. The method of claim 27 wherein determining whether to apply data integrity checks occurs during an authentication procedure involving the first endpoint, the second endpoint, and a third entity.

30. The method of claim 1 wherein:

the first endpoint is connected to a first network,

the second endpoint is connected to a second network, and

a relay is used to connect the first network and the second network.

31. The method of claim 1 wherein the protocol comprises a message-framing protocol using the transmission control protocol.

32. The method of claim 31 wherein the address meaningful for the combination of the protocol and the network identified by the network identifier comprises an Internet Protocol address and a transmission control protocol port number.

33. The method of claim 31 wherein the address meaningful for the combination of the protocol and the network identified by the network identifier comprises an Internet Protocol domain name and a transmission control protocol port number.

34. The method of claim 1 wherein the protocol is the Hypertext Transfer Protocol.

35. The method of claim 34 wherein the address meaningful for the combination of the protocol and the network identified by the network identifier comprises a uniform resource locator.

36. The method of claim 2 wherein the identity identifier of the second endpoint is associated with more than one global address, the method further comprising selecting a global address for the second endpoint from the more than one global address associated with the identity identifier of the second endpoint to use for communicating between the first endpoint and the second endpoint.

37. A method for communicating between two endpoints connected to a network, the method comprising:

having an application of a first endpoint provide to a global-address-based communication layer (1) a message destined for a second endpoint, and (2) a global address of the second endpoint, wherein the global address specifies a protocol, a network identifier, and an address meaningful for the combination of the protocol and a network identified by the network identifier;

having the global-address-based communication layer select an appropriate networking layer;

having the global-address-based communication layer provide to the selected networking layer (1) the message destined for the second endpoint and (2) the address meaningful for the combination of the protocol and network identified by the network identifier; and

having the selected networking layer send the message to the second endpoint.

38. The method of claim 37 wherein the selected networking layer transmits the message using the protocol specified by the global address of the second endpoint.

39. The method of claim 37 further comprising:

having the application provide to an identity-based communication layer (1) a message destined for the second endpoint and (2) an identity identifier associated with the second endpoint;

having the identity-based communication layer use a presence and availability service to determine the global address of the second endpoint using the identity identifier associated with the second endpoint; and

having the identity-based communication layer provide to the global-address-based communications layer (1) the message destined for the second endpoint and (2) the global address of the second endpoint.

40. The method of claim 39 wherein using the presence and availability service to determine the global address of the second endpoint comprises:

sending to the presence and availability service the identity identifier associated with the second endpoint; and

receiving from the presence and availability service the global address associated with the second endpoint.

41. The method of claim 37 further comprising:

having a networking layer of the second endpoint receive the message and providing the message to a global-address-based communication layer of the second endpoint; and

having the global-address-based communication layer of the second endpoint provide the message to an application layer of the second endpoint.

42. The method of claim 41 further wherein providing the message to the application layer of the second endpoint comprises:

having the global-address-based communication layer of the second endpoint provide the message to an identity-based communication layer of the second endpoint; and

having the identity-based communication layer of the second endpoint provide the message to the application layer of the second endpoint.

43. A computer-readable medium having embodied thereon a computer program configured to communicate between two endpoints connected to a network, the medium comprising one or more code segments configured to:

have a first endpoint use a global address of a second endpoint to communicate with the second endpoint,

have the global address specify a protocol, a network identifier, and an address meaningful for the combination of the protocol and a network identified by the network identifier,

have an application send messages directed to the second endpoint through an identity-based communication layer that is situated between a network layer and an application layer, the messages being independent of the protocol, and have the identity-based communication layer transmit the messages to the second endpoint using the protocol, the network, and the address specified by the global address.

44. The medium of claim 43 wherein the one or more code segments are further configured to determine the global address of the second endpoint by using a unique identity identifier associated with the second endpoint.

45. The medium of claim 44 wherein the global address may be different each time a session is initiated with the second endpoint.

46. The medium of claim 44 wherein the identity identifier comprises an identity identifier for a composite identity, the composite identity being associated with two or more other identity identifiers.

47. The medium of claim 43 wherein:

the first endpoint is connected to a first network,

the second endpoint is connected to a second network, and

a relay is used to connect the first network and the second network.

48. The medium of claim 44 wherein:

the identity identifier of the second endpoint is associated with more than one global address, and

the one or more code segments are further configured to select a global address for the second endpoint from the more than one global address associated with the identity identifier of the second endpoint to use for communicating between the first endpoint and the second endpoint.

49. A computer-readable medium having embodied thereon a computer program configured to communicate between two endpoints connected to a network, the medium comprising one or more code segments configured to:

have an application of a first endpoint provide to a global-address-based communication layer (1) a message destined for a second endpoint, and (2) a global address of the second endpoint, wherein the global address specifies a protocol, a network identifier, and an address meaningful for the combination of the protocol and a network identified by the network identifier;

have the global-address-based communication layer select an appropriate networking layer;

have the global-address-based communication layer provide to the selected networking layer (1) the message destined for the second endpoint and (2) the address meaningful for the combination of the protocol and network identified by the network identifier; and

have the selected networking layer send the message to the second endpoint.

50. The medium of claim 49 wherein the selected networking layer transmits the message using the protocol specified by the global address of the second endpoint.

51. The medium of claim 49 wherein the one or more code segments are further configured to:

have the application provide to an identity-based communication layer (1) a message destined for the second endpoint and (2) an identity identifier associated with the second endpoint;

have the identity-based communication layer use a presence and availability service to determine the global address of the second endpoint using the identity identifier associated with the second endpoint; and

have the identity-based communication layer provide to the global-address-based communications layer (1) the message destined for the second endpoint and (2) the global address of the second endpoint.

52. A system for communicating between two endpoints connected to a network, the system comprising a processor connected to a storage device and one or more input/output devices, wherein the processor is configured to:

have a first endpoint use a global address of a second endpoint to communicate with the second endpoint,

have the global address specify a protocol, a network identifier, and an address meaningful for the combination of the protocol and a network identified by the network identifier,

have an application send messages directed to the second endpoint through an identity-based communication layer that is situated between a network layer and an application layer, the messages being independent of the protocol, and have the identity-based communication layer transmit the messages to the second endpoint using the protocol, the network, and the address specified by the global address.

53. The system of claim 52 wherein the processor is further configured to determine the global address of the second endpoint by using a unique identity identifier associated with the second endpoint.

54. The system of claim 53 wherein the global address may be different each time a session is initiated with the second endpoint.

55. The system of claim 53 wherein the identity identifier comprises an identity identifier for a composite identity, the composite identity being associated with two or more other identity identifiers.

56. The system of claim 52 wherein:

the first endpoint is connected to a first network,

the second endpoint is connected to a second network, and

a relay is used to connect the first network and the second network.

57. The system of claim 52 wherein:

the identity identifier of the second endpoint is associated with more than one global address, and

the processor is further configured to select a global address for the second endpoint from the more than one global address associated with the identity identifier of the second endpoint to use for communicating between the first endpoint and the second endpoint.

58. A system for communicating between two endpoints connected to a network, the system comprising a processor connected to a storage device and one or more input/output devices, wherein the processor is configured to:

have an application of a first endpoint provide to a global-address-based communication layer (1) a message destined for a second endpoint, and (2) a global address of the second endpoint, wherein the global address specifies a protocol, a network identifier, and an address meaningful for the combination of the protocol and a network identified by the network identifier

have the global-address-based communication layer select an appropriate networking layer;

have the global-address-based communication layer provide to the selected networking layer (1) the message destined for the second endpoint and (2) the address meaningful for the combination of the protocol and network identified by the network identifier; and

have the selected networking layer send the message to the second endpoint.

59. The system of claim 58 wherein the selected networking layer transmits the message using the protocol specified by the global address of the second endpoint.

60. The system of claim 58 wherein the processor is further configured to:

have the application provide to an identity-based communication layer (1) a message destined for the second endpoint and (2) an identity identifier associated with the second endpoint;

have the identity-based communication layer use a presence and availability service to determine the global address of the second endpoint using the identity identifier associated with the second endpoint; and

have the identity-based communication layer provide to the global-address-based communications layer (1) the message destined for the second endpoint and (2) the global address of the second endpoint.