Access control

• US 7,660,994 B2
• Filed: 06/24/2004
• Issued: 02/09/2010
• Est. Priority Date: 10/24/1995
• Status: Expired due to Fees

• Current Assignee: Assa Abloy AB
• Original Assignee: Corestreet, Ltd. (Assa Abloy AB)
• Inventors: Libin, Phil, Micali, Silvio
• Primary Examiner(s): Shiferaw; Eleni A
• Application Number:
  US10/876,275
• Publication Number:
  US 20050010783A1
• Time in Patent Office: 2,056 Days
• Field of Search: 726/2, 726 4- 7, 726/10, 726/21, 726/1, 726/20, 726/9, 713/155, 713/170, 713/175, 713/182, 713/183, 713/184, 713/185, 713/158, 713/156, 713/157, 713/161, 713/177, 713/179, 713/160, 713/166, 713/172, 713/159, 713/173, 713/178, 713/186, 380/278
• US Class Current: 713/182
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06Q 10/00 Administration; Management
• CPC Class Codes: G06Q 90/00 Systems or methods specially adapted for administrative, commercial, financial, managerial or supervisory purposes, not involving significant data processing

Abstract

An administration entity controls access to an electronic device by generating credentials and a plurality of corresponding proofs, wherein no valid proofs are determinable given only the credentials and values for expired proofs. The electronic device receives the credentials and, if access is authorized at a particular time, the electronic device receives a proof corresponding to the particular time and confirms the proof using the credentials. A single administration entity may generate the credentials and generate the proofs and/or there may be a first administration entity that generates the credentials and other administration entities that generate proofs. The credentials may be a digital certificate that includes a final value that is a result of applying a one way function to a first one of the proofs.

Claims

1. A method for at least one administration entity to control access to an electronic device, comprising:

the at least one administration entity generating credentials and a plurality of proofs for the electronic device, wherein the proofs are not determinable as valid given only the credentials and values for expired proofs, the expired proofs being no longer valid;

the electronic device receiving the credentials;

if access is authorized at a particular time, the electronic device receiving a corresponding proof corresponding to the particular time; and

the electronic device confirming the corresponding proof using the credentials, wherein the corresponding proof is a result of applying a one way function to a subsequent one of the plurality of proofs received at the electronic device, wherein the credentials are a digital certificate that includes a final value that is a result of applying the one way function to a first one of the plurality of proofs, and wherein said access is access to data on the electronic device.

2. The method, according to claim 1, wherein the at least one administration entity generates the plurality of proofs after generating the credentials.

3. The method, according to claim 1, wherein a single administration entity generates the credentials and generates the plurality of proofs.

4. The method, according to claim 1, wherein there is a first administration entity that generates the credentials and other administration entities that generate the plurality of proofs.

5. The method, according to claim 4, wherein the first administration entity also generates the plurality of proofs.

6. The method, according to claim 4, wherein only the other administration entities generate the plurality of proofs.

7. The method, according to claim 1, wherein the digital certificate includes an identifier for the electronic device.

8. The method, according to claim 1, wherein the credentials include an identifier for the electronic device.

9. The method, according to claim 1, wherein the electronic device is a computer.

10. The method, according to claim 9, further comprising:

the computer booting up only if access is authorized.

11. The method, according to claim 1, wherein the electronic device is a disk drive.

12. The method, according to claim 1, further comprising:

providing the plurality of proofs using at least one proof distribution entity separate from the at least one administration entity.

13. The method, according to claim 12, wherein there is a single proof distribution entity.

14. The method, according to claim 12, wherein there are a plurality of proof distribution entities.

15. The method, according to claim 1, further comprising:

providing the plurality of proofs using a connection to the electronic device.

16. The method, according to claim 15, wherein the connection is the Internet.

17. The method, according to claim 1, wherein at least one of the proofs is stored locally on the electronic device.

18. The method, according to claim 17, further comprising:

if the corresponding proof corresponding to the particular time is not available locally on the electronic device, the electronic device requests the plurality of proofs via an external connection.

19. The method, according to claim 1, wherein each of the plurality of proofs is associated with a particular time interval.

20. The method, according to claim 19, wherein, after the particular time interval associated with a particular one of the plurality of proofs has passed, the electronic device receives a new proof.

21. The method, according to claim 20, wherein the particular time interval is one day.

22. A method for an electronic device to control access thereto, comprising:

receiving credentials and at least one of a plurality of proofs for the electronic device, wherein the at least one of the plurality of proofs is not determinable as valid given only the credentials and values for expired proofs, the expired proofs being no longer valid; and

testing, using at least one processor, the at least one of the plurality of proofs using the credentials, wherein, if access is authorized at a particular time, the at least one the plurality of proofs corresponds to the particular time, and wherein the at least one of the plurality of proofs is a result of applying a one way function to a subsequent one of the plurality of proofs, wherein the credentials are a digital certificate that includes a final value that is a result of applying the one way function to a first one of the plurality of proofs, and wherein said access is access to data on the electronic device.

23. The method, according to claim 22, wherein the digital certificate includes an identifier for the electronic device.

24. The method, according to claim 22, wherein the credentials include an identifier for the electronic device.

25. The method, according to claim 22, wherein the electronic device is a computer.

26. The method, according to claim 25, further comprising:

the computer booting up only if access is authorized.

27. The method, according to claim 22, wherein the electronic device is a disk drive.

28. The method, according to claim 22, further comprising:

obtaining the at least one of the plurality of proofs using a connection to the electronic device.

29. The method, according to claim 28, wherein the connection is the Internet.

30. The method, according to claim 22, wherein at least one of the plurality of proofs is stored locally on the electronic device.

31. The method, according to claim 30, further comprising:

if the at least one of the plurality of proofs corresponding to the particular time is not available locally, the electronic device requests the at least one of the plurality of proofs via an external connection.

32. The method, according to claim 22, wherein each of the plurality of proofs is associated with a particular time interval.

33. The method, according to claim 32, wherein, after the particular time interval associated with a particular one of the plurality of proofs has passed, the electronic device receives a new proof.

34. The method, according to claim 33, wherein the particular time interval is one day.

35. A method of controlling access to an electronic device, comprising:

providing credentials to the electronic device; and

if access is allowed at a particular time, providing a proof from a plurality of proofs to the electronic device corresponding to the particular time, wherein the proof is not determinable as valid given only the credentials and values for expired proofs, the expired proofs being no longer valid, and wherein the proof provided to the electronic device is a result of applying, using at least one processor, a one way function to a subsequent proof provided to the electronic device, wherein the credentials are a digital certificate that includes a final value that is a result of applying the one way function to a first one of the plurality of proofs, and wherein said access is access to data on the electronic device.

36. The method, according to claim 35, wherein the digital certificate includes an identifier for the electronic device.

37. The method, according to claim 35, wherein the credentials include an identifier for the electronic device.

38. The method, according to claim 35, wherein the electronic device is a computer.

39. The method, according to claim 38, further comprising:

the computer booting up only if access is authorized.

40. The method, according to claim 35, wherein the electronic device is a disk drive.

41. The method, according to claim 35, further comprising:

providing the proof using at least one proof distribution entity separate from at least one administration entity that generates the proof.

42. The method, according to claim 41, wherein there is a single proof distribution entity.

43. The method, according to claim 41, wherein there are a plurality of proof distribution entities.

44. The method, according to claim 35, further comprising:

providing the proof using a connection to the electronic device.

45. The method, according to claim 44, wherein the connection is the Internet.

46. The method, according to claim 35, wherein the proof is stored locally on the electronic device.

47. The method, according to claim 46, further comprising:

if the proof not available locally, the electronic device requests the proof via an external connection.

48. The method, according to claim 35, wherein the proof is associated with a particular time interval.

49. The method, according to claim 48, wherein, after the particular time interval associated with the proof has passed, the electronic device receives a new proof.

50. The method, according to claim 49, wherein the particular time interval is one day.