System and method for accessing information resources using cryptographic authorization permits

• US 8,443,191 B2
• Filed: 04/09/2007
• Issued: 05/14/2013
• Est. Priority Date: 04/09/2007
• Status: Active Grant

• Current Assignee: Objective Interface Systems, Inc.
• Original Assignee: Objective Interface Systems, Inc.
• Inventors: Marshall, Jeffrey Grant, Chilton, Jeffrey William, Beckwith, Reynolds Wiliam
• Primary Examiner(s): Barron, Jr., Gilberto
• Assistant Examiner(s): ALMEIDA, DEVIN E
• Application Number:
  US11/783,359
• Publication Number:
  US 20080250253A1
• Time in Patent Office: 2,227 Days
• Field of Search: 713/164, 713/167, 726/17
• US Class Current: 713/167
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3215 using a plurality of channels network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A system and method for securing information associates a party with a node that communicates messages over one or more channels based on a channel access privilege. One or more authorities sign a cryptographic authorization permit (CAP) to authorize the channel access privilege, which can be a write privilege or a read privilege. In one embodiment, the authorization for the channel access privilege is based on a public key issued by an authority and the CAP comprises a cryptographic certificate digitally signed by the authority.

Claims

1. A node for an information system, comprising:

a plurality of partitions on the node, wherein at least one partition has one or more subjects and at least one other partition has one or more resources, wherein access to a resource requires processing a cryptographic authorization permit (CAP) that is signed by two or more authorities, said two or more authorities each sign a CAP to authorize a subject in the at least one partition to access a resource in the at least one other partition, wherein the signature of each one of the two or more authorities signing the CAP is validated to grant access to the resource.

2. The node of claim 1, wherein the authorization is based on a cryptographic signature made with a private key corresponding to a public key associated with at least one of the one or more authorities.

3. The node of claim 1, wherein the two or more authorities are independent of each other.

4. The node of claim 1, wherein the CAP is based on an X.509 Certificate.

5. The node of claim 1, wherein the validity of the CAP is determined in part by the verification of an asymmetric cryptographic signature.

6. The node of claim 5, where the asymmetric cryptographic signature is based on at least one of RSA, DSA, or ECDSA signatures.

7. In an information system, a node associated with one or more channels comprising:

a partitioning communication system (PCS) that separates the one or more channels from each other;

a plurality of partitions, wherein at least one partition on the node communicates messages over the one or more channels based on a channel access privilege, wherein access to a channel requires processing a cryptographic authorization permit (CAP) that is signed by two or more authorities, said two or more authorities each sign a CAP to authorize the channel access privilege, wherein the signature of each one of the two or more authorities signing the CAP is validated to grant access to the channel.

8. The information system of claim 7, wherein the plurality of partitions comprise a PCS-specific partition and at least one application partition, wherein one or more CAPS are stored in the PCS specific partition and the messages are communicated with the at least one application partition via the PCS-specific partition.

9. The information system of claim 7, wherein the authorization for the access privilege is based on a cryptographic signature made with a private key corresponding to a public key associated with at least one of the two or more authorities.

10. The information system of claim 7, wherein the two or more authorities are independent of each other.

11. The information system of claim 7, wherein at least one partition has at least of a subject and a resources, and wherein the node is identified by corresponding node public and private keys issued by at least one of the two or more authorities, and wherein the public and private keys are used as identifiers for at least one of a subject and a resource in a partition.

12. The information system of claim 7, wherein the messages are communicated over the one or more channels based on a shared secret key.

13. The information system of claim 7 wherein the CAP is based on an X.509 Certificate.

14. The information system of claim 7, wherein the validity of the CAP is determined in part by the verification of an asymmetric cryptographic signature.

15. The information system of claim 7, where the cryptographic signature contained in the CAP is based on at least one of RSA, DSA, or ECDSA signatures.

16. A secure information system, comprising:

a first node that is partitioned to a plurality of first partitions and a second node that is partitioned to a plurality of second partitions;

one or more channels for communicating messages between the first node and second node;

a partitioning communication system (PCS) that separates the one or more channels from each other, wherein at least one of the plurality of first partitions on the first node communicates messages over the one or more channels based on a first channel access privilege and at least one of the plurality of second partitions on the second node communicates messages over the one or more channels based on a second channel access privilege, wherein access to a channel requires processing a cryptographic authorization permit (CAP) that is signed by two or more authorities, said two or more authorities each sign a CAP to authorize the first and second channel access privileges, wherein the signature of each one of the two or more authorities signing the CAP is validated to grant access to the channel.

17. The secure information system of claim 16, wherein the authorities are independent of each other.

18. The information system of claim 16 wherein the CAP is based on an X.509 Certificate.

19. The information system of claim 16, wherein the validity of the CAP is determined in part by the verification of an asymmetric cryptographic signature.

20. The information system of claim 16, where the cryptographic signature contained in the CAP is based on at least one of RSA, DSA, or ECDSA signatures.

21. A node for an information system, comprising:

a plurality of partitions having resources comprising hardware that are separated from each other, wherein at least one partition has one or more subjects, wherein access to a resource requires processing a cryptographic authorization permit (CAP) that is signed by two or more authorities, said two or more authorities each sign a CAP to authorize a subject in the at least one partition to access a resource in the at least one other partition, wherein the signature of each one of the two or more authorities signing the CAP is validated to grant access to the resource.

22. A method for securing information comprising:

receiving a request to access a resource in a first partition from a subject in a second partition, wherein the first and second partitions comprise resources separated by logical components;

receiving a cryptographic authorization permit (CAP) authorizing the subject to access the resource, wherein the CAP is signed by two or more authority and identifies the subject and cryptographic signature;

validating the CAP based on the two or more signature of the authority; and

granting access to the resource based on the validation of the CAP.

23. A node for an information system, comprising:

a plurality of partitions on the node, wherein at least one partition has one or more subjects and at least one other partition has one or more resources, wherein access to a resource requires processing a cryptographic authorization permit (CAP), wherein a plurality of authorities each sign the CAP to authorize a subject in the at least one partition to access a resource in the at least one other partition, wherein the signature of each one of the plurality of authorities signing the CAP is validated to grant access to the resource.

24. A node for an information system, comprising:

a plurality of partitions on the node, wherein at least one partition has one or more subjects and at least one other partition has one or more resources, wherein access to a resource requires processing a cryptographic authorization permit (CAP) that is signed by one or more authorities, said one or more authorities each sign a CAP to authorize a subject in the at least one partition to access a resource in the at least one other partition, wherein the signature of each one of the one or more authorities signing the CAP is validated to grant access to the resource,

wherein the plurality of partitions comprise a PCS-specific partition and at least one application partition, wherein one or more CAPs are stored in the PCS specific partition and the CAP is validated via the PCS-specific partition.