Uniform modular framework for a host computer system

• US 20120036551A1
• Filed: 02/25/2011
• Published: 02/09/2012
• Est. Priority Date: 04/29/2003
• Status: Active Grant

• Current Assignee: Assa Abloy AB
• Original Assignee: Assa Abloy AB
• Inventors: Le Saint, Eric, Boyer, John
• Granted Patent: US 8,732,478 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/123 by using dedicated hardware, e.g. dongles, smart cards, cryptographic processors, global positioning systems [GPS] devices
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A security framework for a host computer system which allows a host to control access to a compliant security token by ensuring enforcement of established security policies administered by a middleware application. Processing between the host computer system and the security token is performed using one or more modular security application agents. The modular security application agents are counterpart applications to security applications installed in the security token and may be retrieved and installed upon to ensure compatibility between counterpart token and host security applications. The security policies are a composite of host security policies and token security policies which are logically combined by the middleware application at the beginning of a session.

Claims

1-54. -54. (canceled)

55. A security system, comprising:

a security token having retrievable token security policies; and

a host computer system having retrievable host security policies and a token access control application that generates a combined set of security policies using at least one of the host security policies and the token security policies, wherein the host computer enforces the set of security policies when the compliant security token is used to perform a security function.

56. A security system, according to claim 55, wherein at least a portion of the host security policies are retrieved from the host computer system.

57. A security system, according to claim 55, wherein at least a portion of the token security policies are retrieved from the security token.

58. A security system, according to claim 55, further comprising:

at least one security application agent and a token access control application provided with the security token, wherein the at least one security application agent performs a security function for the token security applications in accordance with the combined security policies.

59. A security system, according to claim 58, wherein in response to receiving an object from an other application, the at least one security application agent returns the object to the other application after the at least one security application agent and the token security application have performed the security function.

60. A security system, according to claim 59, wherein the at least one security application agent returns the object to the token access control application after performing the security function with the one or more token security applications.

61. A security system, according to claim 59, wherein the object includes at least one of:

a digital certificate, data to undergo a cryptographic function, and data to be stored in the security token.

62. A security system, according to claim 58, wherein the security function includes authentication using a credential.

63. A security system, according to claim 62, wherein the credential includes at least one of:

a personal identification number, a password and a biometric sample.

64. A security system, according to claim 62, wherein the security function further includes establishing a secure messaging session.

65. A security system, according to claim 58, wherein said one or more token security applications includes an authentication application.

66. A security system, according to claim 65, wherein said one or more token security applications further includes a secure messaging application.

67. A security system, according to claim 66, wherein the host computer system stores the combined security policies.

68. A security system, according to claim 66, wherein the host security policies include at least one host access control rule.

69. A security system, according to claim 68, wherein the token security policies include at least one token access control rule.

70. A security system, according to claim 69, wherein the combined security policies are generated from a most restrictive logical combination of the at least one host access control rule and the at least one token access control rule by the token access control application.

71. A security system, according to claim 70, wherein the host security policies further includes token selection rules.

72. A security system, according to claim 55, wherein the token access control application further includes a registry.

73. A security system, according to claim 72, wherein the registry includes a plurality of security parameters associated with at least one registered token security application, at least one registered security agent application, at least one enablement flag and at least one operational state.

74. A method of implementing a security system, comprising:

providing a security token having retrievable token security policies; and

a host computer system enforcing the set of security policies when the compliant security token is used to perform a security function, wherein the host computer has retrievable host security policies and a token access control application that generates a combined set of security policies using at least one of the host security policies and the token security policies.