Access control in a distributed computer system

• US 5,220,603 A
• Filed: 02/25/1992
• Issued: 06/15/1993
• Est. Priority Date: 03/08/1991
• Status: Expired due to Term

• Current Assignee: International Computers Limited (Fujitsu Limited)
• Original Assignee: International Computers Limited (Fujitsu Limited)
• Inventors: Parker, Thomas A.
• Primary Examiner(s): CAIN, DAVID C
• Application Number:
  US07/841,386
• Time in Patent Office: 476 Days
• Field of Search: 380/21, 380/23, 380/25
• US Class Current: 713/156
• CPC Class Codes: G06F 12/1466 Key-lock mechanism
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A mechanism is described for controlling access to a target application (TA) in a distributed computer system. A user sponsor (US) acting on behalf of an end user is issued with a privilege attribute certificate (PAC) containing initiator qualifier attributes (IQA) identifying permitted users of the PAC. The US obtains a key from a key distribution server (KDS), the key having initiator qualifier attributes of the US cryptographically associated with it.

The US uses this key to communicate with the TA, and presents its PAC for verification. If the IQA in the PAC do not match the IQA associated with the key, this indicates that the PAC is being presented by the wrong initiator, and so access is not permitted.

If a receiving entity subsequently wishes to act as an initiator and to use the PAC by proxy, it acquires a key from the KDS, the key having the receiving entity'"'"'s attributes cryptographically associated with it. This provides a way of regulating proxy use of PACs.

Claims

1. A data processing system comprising:

(a) a plurality of initiator entries, each having a set of initiator qualifier attributes associated therewith,

(b) a plurality of target entities, connected to and accessible by said initiator entries,

(c) authentication means coupled to said target entities for issuing each target entity, on request, with a privilege attribute certificate (PAC) indicating access rights granted to that target entity,

(d) PAC validation means, coupled to said target entities, for validating PACs on behalf of said target entities,

(e) key distribution means, coupled to said initiator entities, for issuing to each initiator entity, on request, with

(i) a first key, for communicating with the PAC validation means, the first key being encrypted under a second key known to both the initiator entity and the key distribution means,

(ii) a package comprising said first key, and the initiator qualifier attributes of the initiator entity, encrypted together under a third key known only to the key distribution means and to the PAC validation means,

(f) connection means for interconnecting each initiator entity to the PAC validation means to permit the initiator entity to present said package to the PAC validation means, and

(g) a table associated with the PAC validation means, for recording an association between the first key and the initiator qualifier attributes in said package.