Method and system for controlling access for mobile agents in home network environments

• US 8,656,475 B2
• Filed: 02/18/2008
• Issued: 02/18/2014
• Est. Priority Date: 10/31/2007
• Status: Active Grant

• Current Assignee: Sungkyunkwan University Foundation For Corporate Collaboration (SungKyunKwan University)
• Original Assignee: Sungkyunkwan University Foundation For Corporate Collaboration (SungKyunKwan University)
• Inventors: Eom, Young Ik, Ko, Kwang Sun, Jang, Hyun Su, Cho, Hyun Jin, Jung, Yong Woo, Choi, Hyun Woo, Gyeong, Gye Hyeon, Choi, Jung Hwan, Zhao, Zhen, Kim, Tae Hyoung, Kim, Youn Woo
• Primary Examiner(s): Patel, Ashok
• Assistant Examiner(s): GOLDBERG, ANDREW C
• Application Number:
  US12/032,817
• Publication Number:
  US 20090113538A1
• Time in Patent Office: 2,192 Days
• Field of Search: 713/165
• US Class Current: 726/10
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: H04L 12/2821 Avoiding conflicts related to the use of home appliances cryptographic protocols H04L9/00; protocols for network security H04L63/00
• CPC Class Codes: H04L 12/2836 Protocol conversion between an external network and a home network controlling appliance services of a home automation network from a device located outside the home and the home network H04L12/2818; protocol conversion H04L69/08; adaptation of digital video signals for transport over a specific home network H04N7/24
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Disclosed is a method and system for controlling access for a mobile agent in a home network environment. The method includes the steps of: issuing a role ticket to the mobile agent; verifying access authority to service requested by the mobile agent through the role ticket; and granting the mobile agent access authority to the service. Accordingly, a table for managing access authority of a user is distributed to devices, so that it is possible to provide the mobile agent access control method and system capable of minimizing network traffic in the home network environment.

Claims

1. A method for controlling access for a mobile agent, the method comprising the steps of:

transmitting the mobile agent and a role to a domain management server;

determining, by the domain management server, a service of a platform corresponding to the role;

issuing, by the domain management server, a role ticket to the mobile agent based on the service of the platform;

transmitting the mobile agent and the role ticket to the platform;

verifying, by the platform, access authority to the service requested by the mobile agent through the role ticket;

granting, by the platform, the mobile agent access authority to the service, and

performing authentication for the mobile agent accessing a domain,

wherein the role ticket authorizes the mobile agent to perform the service on the platform,

wherein the step of performing authentication for the mobile agent comprises the steps of;

receiving an authenticator transmitted from the mobile agent; and

verifying integrity of data obtained by decoding a digital signature of the authenticator,

wherein the authenticator comprises an ID of the mobile agent, an ID of a home platform, a message digest of an execution code corresponding to the mobile agent, a lifetime of the authenticator, the digital signature, and a certificate, and

wherein the ID of the mobile agent is granted by the home platform when the mobile agent is created, in which the home platform corresponds to a home platform from which the mobile agent has been created.

2. The method as claimed in claim 1, further comprising the steps of:

verifying integrity of the role ticket,

wherein the domain corresponds to a region which is managed by a domain management server based on one access control policy.

3. The method as claimed in claim 1, wherein the message digest includes a bit stream which is created by applying a one-way hash function to the execution code of the mobile agent.

4. The method as claimed in claim 1, wherein, in the step of issuing the role ticket, roles issued to the mobile agent are verified by making reference to a user mapping table and a role hierarchy table stored on the domain management server.

5. The method as claimed in claim 4, wherein the user mapping table includes data which defines roles that can be issued to the mobile agent based on a user'"'"'s identity.

6. The method as claimed in claim 4, wherein the role hierarchy table includes data which defines a succession relationship between the roles.

7. The method as claimed in claim 4, wherein the role ticket comprises an ID of the mobile agent, a name of the role, a lifetime of the role ticket, and a digital signature.

8. The method as claimed in claim 2, wherein the integrity verification is performed in such a manner as to verify data obtained by decoding a digital signature by means of a public key.

9. The method as claimed in claim 4, wherein, in the step of verifying access authority to service, access authority to service is verified by making reference to a service mapping table, in which the service mapping table includes data which defines a mapping relationship between the roles corresponding to the role ticket and access authority to the service.

10. The method as claimed in claim 9, wherein, in the step of granting access authority, an ID of the service and information about access authority to the service are transmitted to the mobile agent.

11. A system for controlling access for a mobile agent in a home network environment, the system comprises:

a domain management server which is a gateway of a domain, the domain management server performing authentication for a mobile agent which accesses the domain, and issuing a role ticket; and

a platform for performing an integrity verification on the role ticket, verifying access authority of the mobile agent, and granting access authority to service,

wherein;

the domain management server is configured to receive the mobile agent and a role, determine a service of the platform corresponding to the role, issue a role ticket to the mobile agent based on the service of the platform, and transmit the mobile agent and role ticket to the platform,

the platform is configured to verify access authority to the service requested by the mobile agent through the role ticket, and grant mobile agent access authority to the service, and

wherein the domain corresponds to a region which is managed by the domain management server based on one access control policy,

wherein the domain management server receives an authenticator transmitted from the mobile agent, and verifies integrity of data obtained by decoding a digital signature of the authenticator, in which the authenticator comprises an ID of the mobile agent, an ID of a home platform, a message digest of an execution code corresponding to the mobile agent, a lifetime of the authenticator, the digital signature, and a certificate, and

wherein the ID of the mobile agent is granted by the home platform when the mobile agent is created.

12. The system as claimed in claim 11, wherein the message digest includes a bit stream which is created by applying a one-way hash function to the execution code of the mobile agent.

13. The system as claimed in claim 12, wherein, the domain management server checks roles that can be issued to the mobile agent by making reference to a user mapping table and a role hierarchy table, and issues the role ticket corresponding to the roles.

14. The system as claimed in claim 13, wherein the user mapping table includes data which defines roles that can be issued to the mobile agent based on a user'"'"'s identity.

15. The system as claimed in claim 13, wherein the role hierarchy table includes data which defines a succession relationship between the roles.

16. The system as claimed in claim 15, wherein the role ticket comprises the ID of the mobile agent, a name of the role, a lifetime of the role ticket, and a digital signature.

17. The system as claimed in claim 11, wherein the integrity verification is performed in such a manner as to verify data obtained by decoding a digital signature included in the role ticket by means of a public key.

18. The system as claimed in claim 13, wherein, the platform verifies access authority to the service by making reference to a service mapping table, in which the service mapping table includes data which defines a mapping relationship between the roles corresponding to the role ticket and access authority to the service.

19. The system as claimed in claim 18, wherein the platform transmits an ID of the service and information about access authority to the service to the mobile agent in order to grant the access authority.

20. A non-transitory computer readable recording medium in which a program including instructions to be executed to perform an access control method for a mobile agent in an access control system of a home network environment is materially implemented, and is stored in such a manner as to be readable by the access control system, wherein the program comprises the steps of:

transmitting the mobile agent and a role to a domain management server;

determining, by the domain management server, a service of a platform corresponding to the role;

issuing, by the domain management server, a role ticket to the mobile agent based on the service of the platform;

transmitting the mobile agent and role ticket to the platform;

verifying, by the platform, access authority to the service requested by the mobile agent through the role ticket;

granting, by the platform, the mobile agent access authority to the service, and

performing authentication for the mobile agent accessing a domain,

wherein the role ticket authorizes the mobile agent to perform the service on the platform,

wherein the step of performing authentication for the mobile agent comprises the steps of;

receiving an authenticator transmitted from the mobile agent; and

verifying integrity of data obtained by decoding a digital signature of the authenticator,

wherein the authenticator comprises an ID of the mobile agent, an ID of a home platform, a message digest of an execution code corresponding to the mobile agent, a lifetime of the authenticator, the digital signature, and a certificate, and

wherein the ID of the mobile agent is granted by the home platform when the mobile agent is created, in which the home platform corresponds to a home platform from which the mobile agent has been created.