Environment-Aware Security Tokens

• US 20180026956A1
• Filed: 03/06/2017
• Published: 01/25/2018
• Est. Priority Date: 08/11/2014
• Status: Active Grant

• Current Assignee: Document Dynamics, LLC
• Original Assignee: Document Dynamics, LLC
• Inventors: Caffary, JR., Robert G.
• Granted Patent: US 10,122,696 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy

Abstract

The technology described in this document can be embodied in a computer implemented method that includes receiving, at a processing device, information about one or more assets associated with a network of devices. The method also includes generating, for at least one of the assets, a security token that is based at least on a portion of the received information about the corresponding asset. The security token can be configured to identify a home network defined for the asset, and to restrict access to the corresponding asset upon detecting an occurrence of an unauthorized activity involving the asset. The method further includes storing, in a storage device, information about the security token and information linking the security token to the corresponding asset, and initiating integration of the security token with the corresponding asset.

Claims

1-60. -60. (canceled)

61. A computer implemented method comprising:

receiving, at a server comprising one or more processing devices, information about multiple assets associated with a network of devices;

generating, by the server, for an asset of the multiple assets, a security token that is based at least on a portion of the received information about the asset, wherein the security token is configured to identify a home network defined for the asset;

storing, in a storage device, information about the security token and information linking the security token to the asset;

initiating, by the server, integration of the security token with the asset by providing the security token to the corresponding asset; and

restricting access by the server to the asset upon detecting an occurrence of an unauthorized activity involving the corresponding asset, wherein the server is communicably coupled to the home network, and is configured to detect the occurrence of the unauthorized activity based on information from the security token.

62. The method of claim 61, wherein detecting the occurrence of the unauthorized activity comprises determining a dissociation of the asset from the home network defined for the asset.

63. The method of claim 62, wherein determining the dissociation of the asset from the home network comprises at least one of:

(a) determining that the asset is not connected to the home network, (b) determining that the asset is not stored on a device associated with the home network, or (c) detecting an access attempt from a user-profile not associated with the home network.

64. The method of claim 62, wherein the asset is an electronic file, and the security token is configured to restrict access to the electronic file by deleting content of the electronic file upon determining the dissociation from the home network.

65. The method of claim 61, wherein the home network is defined based on one or more security policies associated with the asset.

66. The method of claim 61, wherein the assets associated with the network comprises one or more of:

a device connected to the network, a file stored on a storage device connected to the network, and a user-profile associated with the network.

67. The method of claim 61, wherein the security token comprises an object generated in accordance with Component Object Model (COM).

68. The method of claim 61, wherein the asset is an electronic document, and the security token is integrated into the document as a portion of a page description language of the document.

69. The method of claim 61, wherein restricting access to the asset comprises:

receiving, from the asset, information related to an access point attempting to access the asset;

determining, based on the stored information about the security token, whether the access point is outside the home network; and

providing permission information indicating a level of access permitted for the access point based on the determination.

70. A system comprising:

memory; and

a server comprising one or more processing devices, the server configured to;

receive information about multiple assets associated with a network of devices,

generate, an asset of the multiple assets, a security token that is based at least on a portion of the received information about the asset, wherein the security token is configured to identify a home network defined for the asset,

store, in a storage device communicably coupled to the server, information about the security token and information linking the security token to the asset,

initiate integration of the security token with the asset, and

restrict access to the asset upon detecting an occurrence of an unauthorized activity involving the asset, wherein the server is communicably coupled to the home network, and is configured to detect the occurrence of the unauthorized activity based on information from the security token.

71. The system of claim 70, wherein detecting the occurrence of the unauthorized activity comprises determining a dissociation of the asset from the home network defined for the asset.

72. The system of claim 71, wherein determining the dissociation of the asset from the home network comprises at least one of:

(a) determining that the asset is not connected to the home network, (b) determining that the asset is not stored on a device associated with the home network, or (c) detecting an access attempt from a user-profile not associated with the home network.

73. The system of claim 71, wherein the asset is an electronic file, and the security token is configured to restrict access to the electronic file by deleting content of the electronic file upon determining the dissociation from the home network.

74. The system of claim 70, wherein the home network for the asset is defined based on one or more security policies associated with the asset.

75. The system of claim 70, wherein the assets associated with the network comprises one or more of:

a device connected to the network, a file stored on a storage device connected to the network, and a user-profile associated with the network.

76. The system of claim 70, wherein the asset is an electronic file, and initiating an integration of the security token with the asset comprises at least one of:

(a) initiating an encapsulation of the security token with the electronic file to generate an executable file, (b) initiating a code injection to a header portion of the electronic file, or (c) initiating an encryption of the electronic file based on the security token.

77. The system of claim 70, wherein the security token comprises an object generated in accordance with Component Object Model (COM).

78. The system of claim 70, wherein the asset is an electronic document, and the security token is integrated into the document as a portion of a page description language of the document.

79. The system of claim 70, wherein to restrict access to the asset, the one or more processing devices are configured to:

receive, from the asset, information related to an access point attempting to access the asset;

determine, based on the stored information about the security token, whether the access point is outside the home network; and

provide permission information indicating a level of access permitted for the access point based on the determination.

80. One or more machine-readable storage devices storing instructions that are executable by one or more processing devices to perform operations comprising:

receiving information about multiple assets associated with a network of devices;

generating, an asset of the multiple assets, a security token that is based at least on a portion of the received information about the asset, wherein the security token is configured to identify a home network defined for the asset;

storing, in a storage device communicably coupled to the one or more processing devices, information about the first and second security tokens and information linking the first and second security tokens to the corresponding assets;

initiating integration of the first and second security tokens with the corresponding assets; and

restricting access to the first or second asset upon detecting an occurrence of an unauthorized activity involving the corresponding asset, wherein the one or more processing devices are communicably coupled to the home network, and is configured to detect the occurrence of the unauthorized activity based on information from the security token.