(12)United
States Patent


 Giguiere
et al.


  


  


(54)DISTANCE-MODIFIED
SECURITY AND CONTENT SHARING 


 


(71)Applicants:Gannon
K. Giguiere, Newport Beach,


  CA
(US); Alan L. Johnson, Newport


  Beach,
CA (US); Timothy J. Lyons,


  Tustin,
CA (US)


   


(72)Inventors:Gannon
K. Giguiere, Newport Beach,


  CA
(US); Alan L. Johnson, Newport


  Beach,
CA (US); Timothy J. Lyons,


  Tustin,
CA (US)


   


(73)Assignee:Eventure
Interactive, Inc., Costa Mesa,


  CA
(US)


   


(*)Notice:  Subject
to any disclaimer, the term of this patent is extended or adjusted under 35 U.S.C. 154(b) by 0 days.


   


(21)Appl. No.:14/068,957


   


(22)Filed:  Oct.
31, 2013


   


(51)Int. Cl.


 H04L
9/00(2006.01)


 H04L
9/32(2006.01)


   


(52)U.S. Cl. 


 USPC726/1;
726/2; 726/3; 726/4; 


   


(58)Field
of Classification Search


 CPCH04L
63/20; H04L 63/10; H04L 63/101; 


  G06F
21/10; G06F 2221/2141 


 USPC726/1-4,
26-30; 713/165-167,193; 


  709/223-225,
229 


    


 See
application file for complete search history.


 


(56)References
Cited 


 


U.S.
PATENT DOCUMENTS


 


 7,359,930
 B2*4/2008 Jackson et al.709/200


 7,613,426
 B211/2009 Kuehnel 


 7,907,934
 B23/2011 Naghian 


 7,974,574
 B27/2011 Shen 


 


	(10)	Patent
    No.:	US
    8,769,610 B1
	(45)	Date of Patent:	Jul.
    1, 2014


 


	 	8,135,835	 	B2	3/2012	 	Wilbrink	 
	 	8,149,697	 	B2	4/2014	 	Parkkinen	 
	 	8,156,337	 	B2*	4/2012	 	Balfanz et al.	713/169
	 	8,181,257	 	B2*	5/2012	 	Chalasani et al.	726/26
	 	8,411,562	 	B2*	4/2013	 	Chia et al.	370/230
	 	8,478,300	 	B2	7/2013	 	Kuehnel	 
	 	8,520,979	 	B2	8/2013	 	Conwell	 
	 	2007/0250482	 	A1	10/2007	 	Yao	 
	 	2012/0084364	 	A1	4/2012	 	Sivavakeesar	 


 


(Continued)


 


FOREIGN
PATENT DOCUMENTS


 


WO2004107681A112/2004


WO2005018142A12/2005


WO2012006446A11/2012


 


OTHER
PUBLICATIONS


 


Bhargava,
Bharat K, et al; A Trust-based Approach for Secure Data Dissemination in a Mobile Peer-to-Peer Network, of AVs; International
Journal of Next-Generation Computing, vol. 3, No. 1, Mar. 2012.


 


(Continued)


 


Primary Examiner
— Hosuk Song


 


(74) Attorney,
Agent, or Firm — Fish & Tsang LLP


 


	(57)	ABSTRACT	 


 


In
one aspect of the invention, a system for sharing resources in an ad-hoc peer-to-peer network is presented. The ad-hoc peer-to-peer
network includes a host device that is associated with a resource. A Security application of the host device allows the user of
the host device to share the resource with other devices in the network. The security application also allows the user to establish
access policies for certain known devices within the network. An access policy established for a known device specifies what respect
to accessing the resource. The access policy has the characteristics of inheritance. Thus, when a device requests to access the
resource, the security application of the host device determines an access policy of the device based on access policies of one
or more of the known devices.


 


15
Claims, 3 Drawing Sheets











    	 



    	 



    

 








US
8,769,610 B1


Page
2


 


References
Cited


 


U.S.
PATENT DOCUMENTS


 


2013/0054643 A12/2013Yao


2013/0160076 A16/2013Morita


2013/0219285 A18/2013Iwasaki


 


OTHER
PUBLICATIONS


 


Helal,
Sumi, et al; Konark—A Service Discovery and Delivery Protocol for Ad-Hoc Networks; Computer and Information Science and
Engineering Department, University of Florida, Gainesvile, Florida, 2010.


 


Desai,
Nitin, et al; Infrastructure for Peer-to-Peer Applications in Ad-Hoc Networks; konark_p2p.pdf; Computer and Information Science
and Engineering Department; University of Florida; May 17, 2006; retrieved from wayback machine on Mar. 20, 2014; web.archive.org/web/20060401000000*./http://www.icta.ufl.edu/projects/publications/konark_p2p.pdf.


 


Castro,
Marcel C., et al; Peer-to-Peer Overlay in Mobile Ad-hoc Networks; Handbook_,P2P_09.pdf; Work supported by the European Commission
in the framework of the FP7 Network of Excellence in Wireless COMmunications NEWCOM++ (contract No. 216715); Jan. 12, 2011; retrieved
from wayback machine on Mar. 21, 2014, http://web.archive.org/web./*/http://social2.googlecode.com/files/Handbook_P2P_09.pdf.


 


Sbai,
Mohamed, et al., Revisiting P2P content sharing in wireless ad hoc networks; iwsos.pdf; EPI Planete, Inria, France, Nov. 7, 2011;
retrieved from wayback machine on Mar. 21, 2011; http://web.archive.org/web/*/http://planete.inria.fr/bithoc/Dependencies/iwsos.pdf.


 


Gligor,
Virgil D.; Security of Emergent Properties in Ad-Hoc Networks; cambridge04.pdf; University of Maryland, Electrical and Computer
Engineering Department, College Park, Maryland; May 3, 2006, retrieved from wayback machine on Mar. 21, 2014; http://web.archive.org/web/20060401000000*/http://www.ece.umd.edu/~gligor/cambridge04.pdf.


 


* cited
by examiner






    	 



    	 



    

 








U.S. PatentJul.
1, 2014Sheet 1 of 3US 8,769,610 B1


 






    	 



    	 



    

 








U.S. PatentJul.
1, 2014Sheet 2 of 3US 8,769,610 B1






    	 



    	 



    

 








U.S. PatentJul.
1, 2014Sheet 3 of 3US 8,769,610 B1






    	 



    	 



    

 








US
8,769,610 B1


 


DISTANCE-MODIFIED
SECURITY AND CONTENT SHARING


 


FIELD
OF THE INVENTION


 


The
field of the invention is network access security, particularly, access security in an ad-hoc peer-to-peer network.


 


BACKGROUND


 


The
following description includes information that may be useful in understanding the present invention. It is not an admission that
any of the information provided herein is prior art or relevant to the presently claimed invention, or that any publication specifically
or implicitly referenced is prior art.


 


Advances
in portable devices that are capable of directly communicating with each other via short range wireless technology (e.g., direct
WiFi, Bluetooth®, infrared, etc.) allow devices to form ad-hoc peer-to-peer networks anytime and anywhere (see “Infrastructure
for Peer-to-Peer Applications in Ad-hoc Networks” by Desai et al. and U.S. Pat. No. 8,520,979 issued to Conwell entitled
“Methods and Systems for Content Processing”, filed Nov. 14, 2008). These networks are formed when two or more portable
devices are communicatively coupled to each other via short range wireless connections without depending on any pre-existing network
infrastructure such as a server, an access point, etc. Once connected to the network, a device can potentially access content
(e.g., documents, photos, videos, etc.) or resources of and/or connected to other devices (e.g., printer, camera, data storage,
etc.) on the network. Conversely, the device can also share its content or resources to the other devices connected to the network.


 


However,
these seemingly convenient peer-to-peer network architectures also raise new security issues that were not present in conventional
network architectures. For example, since a peer-to-peer network allows devices to join the network and access resources in the
network by merely connecting to any one of the devices that is part of the network, it is a challenge to devise a meaningful security
policy for all of the resources within the network.


 


Efforts
have been made in the area of providing better security to ad-hoc peer-2-peer networks. For example, the publication “A
Trust-based Approach for Secure Data Dissemination in a Mobile Peer-to-Peer Network of aerial vehicles (AVs)” by Bhargava
et al. discloses providing different access to different AVs within the network based on a trustworthiness score assigned to each
AV. The trustworthiness score for each AV is determined by a set of factors such as history of interactions with that AV, location,
distance, authentication level, etc.


 


U.S.
Pat. No. 7,907,934 issued to Naghian entitled “Method and System for Providing Security in Proximity and Ad-hoc Networks”,
filed Sep. 9, 2004, also discloses a method for providing security in a mobile ad-hoc network based on the location of the device
requesting for access.


 


U.S.
Pat. No. 8,149,697 issued to Parkkinen et al. entitled “System, Method, and Computer Program Product for Discovering Services
in a Network Device”, filed Jun. 26, 2008, discloses providing security in an ad-hoc peer-to-peer network based on degree
of separation between the owner of the resource and the device that wishes to access the resource;


 


Other
efforts that have been made in this area includes:


 


U.S.
Pat. No. 7,613,426 issued to Kuehnel et al. entitled “Proximity Service Discovery in Wireless Networks”, filed Dec.
20, 2005;


 


U.S.
Pat. No. 7,974,574 to Shen et al. entitled “Base Station Initiated Proximity Service Discovery and Connection Establishment”,
filed Jul. 25, 1007;


 


U.S.
Pat. No. 8,135,835 issued to Wilbrink et al. entitled “Hardware and Processing Request Brokerage”, filed May 12, 2005;


 


U.S.
Patent Publication 2007/0250482 to Yao et al. entitled “Method and Apparatus for Document Matching”, filed Apr. 25,
2006;


 


U.S.
Patent Publication 2012/0084364 to Sivavakeesar entitled “Scalable Secure Wireless Interaction Enabling Methods, System
and Framework”, filed Oct. 5, 2010;


 


U.S.
Patent Publication 2013/0160076 to Morita entitled “Access Authority Generation Device”, filed Feb. 26, 2013; and


 


U.S.
Patent Publication 2013/0219285 to Iwasaki entitled “Mirrored Interface Navigation of Multiple User Interfaces”, filed
Feb. 21, 2012.


 


All
publications identified herein are incorporated by reference to the same extent as if each individual publication or patent application
were specifically and individually indicated to be incorporated by reference. Where a definition or use of a term in an incorporated
reference is inconsistent or contrary to the definition of that term provided herein, the definition of that term provided herein
applies and the definition of that term in the reference does not apply.


 


In
some embodiments, the numbers expressing quantities of ingredients, properties such as concentration, reaction conditions, and
so forth, used to describe and claim certain embodiments of the invention are to be understood as being modified in some instances
by the term “about.” Accordingly, in some embodiments, the numerical parameters set forth in the written description
and attached claims are approximations that can vary depending upon the desired properties sought to be obtained by a particular
embodiment. In some embodiments, the numerical parameters should be construed in light of the number of reported significant digits
and by applying ordinary rounding techniques. Notwithstanding that the numerical ranges and parameters setting forth the broad
scope of some embodiments of the invention are approximations, the numerical values set forth in the specific examples are reported
as precisely as practicable. The numerical values presented in some embodiments of the invention may contain certain errors necessarily
resulting from the standard deviation found in their respective testing measurements.


 


Unless
the context dictates the contrary, all ranges set forth herein should be interpreted as being inclusive of their end-points and
open-ended ranges should be interpreted to include only commercially practical values. Similarly, all lists of values should be
considered as inclusive of intermediate values unless the context indicates the contrary.


 


As
used in the description herein and throughout the claims that follow, the meaning of “a,” “an,” and “the”
includes plural reference unless the context clearly dictates otherwise. Also, as used in the description herein, the meaning
of “in” includes “in” and “on” unless the context clearly dictates otherwise.


 


The
recitation of ranges of values herein is merely intended to serve as a shorthand method of referring individually to each separate
value falling within the range. Unless otherwise indicated herein, each individual value with a range is incorporated into the
specification as if it were individually recited herein. All methods described herein can be performed in any suitable order unless
otherwise indicated herein or otherwise clearly contradicted by context. The use of any and all examples, or exemplary language
(e.g. “such as”) provided with respect to certain embodiments herein is intended merely to better illuminate the invention
and does not pose a limitation on the scope of the invention otherwise claimed. No language in the specification should be construed
as indicating any non-claimed element essential to the practice of the invention.






    	 



    	 



    

 








Groupings
of alternative elements or embodiments of the invention disclosed herein are not to be construed as limitations. Each group member
can be referred to and claimed individually or in any combination with other members of the group or other elements found herein.
One or more members of a group can be included in, or deleted from, a group for reasons of convenience and/or patentability. When
any such inclusion or deletion occurs, the specification is herein deemed to contain the group as modified thus fulfilling the
written description of all Markush groups used in the appended claims.


 


The
publications listed above address only some but not all security issues in an ad-hoc peer-to-peer network. Thus, there is still
a need for providing a more secured architecture for an ad-hoc peer-to-peer network.


 


SUMMARY
OF THE INVENTION


 


Various
objects, features, aspects and advantages of the inventive subject matter will become more apparent from the following detailed
description of preferred embodiments, along with the accompanying drawing figures in which like numerals represent like components.


 


The
inventive subject matter provides systems and methods for securely managing and sharing resources within an ad-hoc peer-to-peer
network. As used herein, the term “ad- hoc peer-to-peer network” means a decentralized wireless network that allows
devices within range to discover and communicate with each other without involving a central access server (e.g., a central access
point) or a pre-existing networking infrastructure. As such, an ad-hoc peer-to-peer network can be created spontaneously. Devices
can join and leave the network as they wish seamlessly without affecting the connectivity between other devices within the network.


 


In
one aspect of the invention, a method of managing resources in such an ad-hoc peer-to-peer network is presented. The method includes
a step of establishing an ad-hoc peer-to-peer network for several devices. The devices within the ad-hoc peer-to-peer network
include mobile devices (e.g., smart phones, tablets, laptops, etc.) and/or stationary devices (e.g., smart routers). The devices
include a first device that is associated with a first resource. The first device is directly connected to a second device in
the ad-hoc peer-to-peer network. The first resource can include hardware (e.g., camera, printer, hard drive, camcorder, a vehicle,
an equipment, etc.), software (e.g., an application, a game, etc.), media content (e.g., audio data, video data, image data, etc.)
and/or documents (e.g., text documents, spreadsheets, etc.).


 


The
method also includes a step of granting the second device access to the first resource according to an access policy. The access
policy specifies a set of rights for accessing the first resource. The set of rights can include at least one of the following:
copy, write, read, contribute, and delete.


 


The
method includes a step of receiving a request for access to the first resource from a third device. The third device is indirectly
connected to the first device in the ad-hoc peer-to-peer network via the second device. In some embodiments, the access policy
granted to the second device has the characteristics of inheritance, such that other devices connected to the first device via
the second device can inherit the access policy from the second device. As such, the method also includes a step of determining
an access policy for the third device for accessing the first resource based on the access policy granted to the second device.
In some embodiments, the access policy determined for the third device can be identical to the access policy granted to the second
device. In other embodiments, the access policy determined for the third device specifies a subset of the set of rights specified
by the access policy granted to the second device.


 


The
subset of the set of rights can limit the rights quantitatively and/or qualitatively. For example, if the access policy for the
second device allows the second device to access a document, the access policy for the third device may allow the third device
to access only a portion of a document or a degraded (e.g., lower resolution, redacted, excluding metadata, etc.) version of the
document, or both. In another example, if the access policy for the second device allows the second device to access a set of
features of the resource (e.g., copy, print, scan features of a printer), the access policy determined for the third device might
include only a subset of the set of features.


 


In
addition to the second device, the third device in some embodiments is indirectly connected to the first device via a fourth device.
In some of these embodiments in which an access policy has also been granted to the fourth device, the access policy for the third
device is determined based on both access policies of the second and the fourth devices.


 


When
the access policies of the second and the fourth devices share a common set of rights, the access policy determined for the third
device can specify either that common set of rights, or a subset of that common set of rights. In an extreme example in which
the access policies of the second and the fourth devices do not share any common rights, the access policy determined for the
third device specifies no rights to access the first resource.


 


BRIEF
DESCRIPTION OF THE DRAWINGS


 


FIG.
1 illustrates an example ad-hoc peer-to-peer network.


 


FIG.
2 illustrates different software layers within a mobile device.


 


FIG.
3 illustrates an example security application of some embodiments.


 


DETAILED
DESCRIPTION


 


It
should be noted that any language directed to a computer should be read to include any suitable combination of computing devices,
including servers, interfaces, systems, databases, agents, peers, engines, modules, controllers, or other types of computing devices
operating individually or collectively. One should appreciate the computing devices comprise a processor configured to execute
software instructions stored on a tangible, non-transitory computer readable storage medium (e.g., hard drive, solid state drive,
RAM, flash, ROM, etc.). The software instructions preferably configure the computing device to provide the roles, responsibilities,
or other functionality as discussed below with respect to the disclosed apparatus. In especially preferred embodiments, the various
servers, systems, databases, or interfaces exchange data using standardized protocols or algorithms, possibly based on HTTP, HTTPS,
AES, public-private key exchanges, web service APIs, known financial transaction protocols, or other electronic information exchanging
methods. Data exchanges preferably are conducted over a packet-switched network, the Internet, LAN, WAN, VPN, or other type of
packet switched network.






    	 



    	 



    

 








The
following discussion provides many example embodiments of the inventive subject matter. Although each embodiment represents a
single combination of inventive elements, the inventive subject matter is considered to include all possible combinations of the
disclosed elements. Thus if one embodiment comprises elements A, B, and C, and a second embodiment comprises elements B and D,
then the inventive subject matter is also considered to include other remaining combinations of A, B, C, or D, even if not explicitly
disclosed.


 


As
used herein, and unless the context dictates otherwise, the term “coupled to” is intended to include both direct coupling
(in which two elements that are coupled to each other contact each other) and indirect coupling (in which at least one additional
element is located between the two elements). Therefore, the terms “coupled to” and “coupled with” are
used synonymously.


 


The
inventive subject matter provides systems and methods for securely managing and sharing resources within an ad-hoc peer-to-peer
network. As used herein, the term “ad-hoc peer-to-peer network” means a decentralized wireless network that allows
devices within range to discover and communicate with each other without involving a central access server (e.g., a central access
point) or a pre-existing networking infrastructure. As such, an ad-hoc peer-to-peer network can be created spontaneously. Devices
can join and leave the network as they wish seamlessly without affecting the connectivity between other devices within the network.


 


Range
for ad-hoc peer-to-peer networks is typically 500 feet or less, but where such networks use cellular technology or wired communication
links, the range could be any practical distance.


 


At
least one of the devices within the ad-hoc peer-to-peer network can be associated with a resource, by including a resource within
the device or is communicatively coupled with a resource. The resource can include a hardware (or sub-device) such as a printer,
a camera, a speaker, etc. The resource can also include data (e.g.. media content such as audio data and video data, text documents,
etc.). Once a device has joined the ad-hoc peer-to-peer network, the device can be configured to share the associated resource(s)
with others in the network.


 


FIG.
1 illustrates an example ad-hoc peer-to-peer network 100. The ad-hoc peer-to-peer network 100 includes several
mobile devices 105-135. These mobile devices 105-135 can include any device that is capable of establishing a direct
wireless communication with another portable device. Examples of these mobile devices include mobile phones, smart phones, tablets,
laptops, portable game consoles, etc. Although the devices that are part of the ad-hoc peer-to-peer network 100 as illustrated
include only mobile devices, it is contemplated that other stationary devices such as smart routers can be included as part of
the ad-hoc peer-to-peer network 100 as well. In fact, any of the mobile devices 105-135 shown in the ad-hoc peer-to-peer
network 100 can be replaced by a stationary device. Unlike a conventional router, a smart router is a device that can perform
functionalities other than mere forwarding and routing data, it could have processing power and memory. For example, when one
uses a smart phone as a hub (e.g., a WIFI hot spot) to send and receive cellular or WIFI signals, the smart phone in that sense
is acting as a smart router. One could also have dedicated smart routers.


 


An
ad-hoc peer-to-peer network can be formed according to any viable network topology (e.g., star topology, mesh topology, tree topology,
etc.). In some embodiments, each mobile device within the network is directly connected all of the other mobile devices in the
network such that the network follows a fully connected mesh network topology. As used herein, a direct connection between two
devices exists when a communication link is established between the two devices (without using any routing or other intervening
device). In other embodiments, at least one of the mobile devices in the network is directly connected to some, but not all. of
the other devices in the network (i.e., a partially connected mesh network). Thus, in a partially connected mesh network, a mobile
device can join and become part of an ad-hoc peer-to-peer network when it establishes a direct connection with one or more mobile
devices that are part of the ad-hoc peer-to-peer network. A mobile device within the network can have a direct connection with
as many as all other mobile devices within the network or as few as one other mobile device within the network.


 


The
ad-hoc peer-to-peer network 100 in FIG. 1 is an example of a partially connected mesh network. As shown, mobile
device 105 is directly connected to mobile devices 115 and 120, while mobile device 120 is directly
connected to mobile devices 105, 110, 125, and 130. Mobile device 110 is directly connected
to both mobile devices 120 and 125, and mobile device 125 is directly connected to both mobile devices 110
and 120. Mobile device 115 is directly connected to both mobile devices 105 and 130 while mobile
device 130 is directly connected to mobile devices 115, 120, and 135. Mobile device 135 is
only connected directly to mobile device 130.


 


Among
the mobile devices within the ad-hoc peer-to-peer network 100, mobile device 135 has the least number of direct
connections within the network 100 (i.e., one direct connection with mobile device 130) and mobile device 120
has the largest number of direct connections within the network 100 (i.e., four direct connections with mobile devices
105. 110. 125, and 130).


 


Some
of the mobile devices within the network can also be associated with sharable resources. For example, mobile device 115 can
include a built-in camera (or alternatively communicatively coupled with a camera), mobile device 125 can be communicatively
coupled with a printer, and mobile device 135 includes a data storage 155. Data storage 155 can also include
sharable data such as audio data, video data, text documents, etc.


 


Users
170. 180, and 190 of these mobile devices 115, 125, and 135 can decide to share their
resources (e.g., camera, printer, data storage, etc.) with other devices within the ad- hoc peer-to-peer network 100. However,
unlike the conventional networking infrastructure, the characteristics of an ad- hoc peer-to-peer network create challenges in
securely sharing these resources with others within the network. Some of the challenges stem from the fact that it is very difficult
or even impossible to find out which mobile device can potentially access the resource. As mentioned above, different mobile devices
can join and leave the network spontaneously. In addition, mobile devices can potentially access the resources of a host device
(i.e., a mobile device that hosts at least one resource) even if the mobile devices are not directly connected to the host device
(the mobile devices can be connected to the host device via a number of hops mobile devices via which data from the mobile device
has to pass before reaching the host device within the network).


 


In
one aspect of the invention, a system for sharing resources in an ad-hoc peer-to-peer network is presented. In some embodiments,
the system provides a security application for each of the mobile devices connected to the ad-hoc peer-to-peer network. The security
application of a host device allows the user to indicate which resource to share with other devices in the ad-hoc peer-to-peer
network and to establish access policies for the known devices within the network with respect to the shared resource. The access
policies established for the known devices can specify what features (e.g.. photos/videos capturing feature, printing feature,
data storage feature, data editing feature, etc.) and/or what data of the resource to which that the known devices has access.






    	 



    	 



    

 








Known
devices can include devices that are directly connected to the host device in the ad-hoc peer-to-peer network and other devices
that the user of the host device is aware to be part of the ad-hoc peer-to-peer network. For example, user 170 of host
device 115 (that is hosting a camera resource 145) can decide to share the camera 145 as a shared resource
with other devices within the network 100. Note that in this example any of the various mobile devices 105, 110,
115, 120, 125, 130 and 135 could act as the host device, and the host device can change over
time, as for example if the current host device 115 leaves the ad-hoc peer-to-peer network 100.


 


The
host device in the example of FIG. 1, (mobile device 115), can detect that at least devices 105 and 130
are directly connected to it. and allows the user 170 to establish access policies for devices 105 and 130.
Additionally, in this example the user 170 can establish different access policies for these two devices 105 and
130. The access policy that the user 170 establish for each of the devices 105 130 specifies a set
of rights for accessing the camera 145 by the device. The set of rights that can be included in the access policy for the
camera 145 can include capturing a photo with the camera, viewing photos captured by the camera, and even contributing
photos. In this example, the user 170 can specify that device 105 can only view photos captured by camera 145.
but that device 130 can both view photos and capture photos with camera 145. For other types of resource, the access
policy can also include other rights such as copy, write, read, contribute, and delete. In some embodiments, the user can establish
an access policy that specifies no access whatsoever to the resource. In some embodiments, the access policies that are established
for the known devices have the characteristics of inheritance, which will be explained in more detailed below.


 


Once
the user of a host device indicates to the security application that a resource associated with the host device is to be shared
with other device within the ad-hoc peer-to-peer network, the security application running on the host device is configured to
broadcast a notification of this newly shared resource with the rest of the mobile devices within the network. In this example,
the security application of mobile device 115 is configured to broadcast a notice of the newly shared camera 145
to devices 105, 110, 120, 125, 130, and 135. The security application running on the
other devices can then present the resource a shared resource to the users (e.g., users 160, 165, 180, 185,
and 190) of the other devices and allow those users to access the shared resource.


 


When
a user of a requesting device makes a request to access the shared resource via the security application running on the requesting
device, the security application prepares a request, and sends the request to the host device 115. Upon receiving the request
at the host device 115, the security application running on the host device 115 will determine an access policy
for the requesting device and will grant access to the requesting device based on the determined access policy. First, the security
application of the host device 115 determines whether the requesting device is one of the known devices for which an access
policy has been established by the user. If the requesting device is one of the known devices, the security application uses the
access policy that has already been established for the requesting device.


 


On
the other hand, if the requesting device is not one of the known devices, the security application looks at the path and all the
intermediary devices that the request has passed through from the requesting device before reaching the host device. For example,
referring back to FIG. 1, if requesting device 125 sends a request to access the camera 145 of host device
115, one of the possible paths for the request to travel to the host device 115 is to go through intermediary devices
120 and 105. For clarity, the term “upstream” will be used to describe the direction within the path
from the requesting device to the host device and the term “downstream” will be used to describe the direction within
the path from the host device to the requesting device. In the above example, the upstream direction of the path will include
devices 120 and 105. Conversely, the downstream direction of the path will include devices 105 and 120.
Additionally, the term “downstream devices” of a device within a path means all devices in the path that come after
the device in the downstream direction, the term “upstream devices” of a device within a path means all devices in
the path that come after the device in the upstream direction


 


As
mentioned above, the access policies established for known devices have the characteristics of inheritance. That is, the access
policy of a device can be inherited from access policies of other upstream devices along the path of the request. In the above
example, the access policy for mobile device 125 can be inherited from either device 105 or device 120 or
both. Since device 105 is a known device for which an access policy has been established, the security application of host
device 115 in this example will allow device 125 to inherit its access policy from device 105. Thus, the
security application of host device 115 will grant device 125 access to view photos.


 


Alternatively,
instead of inheriting the entire access policy from an upstream device, the security application can be configured to allow inheritance
of only a portion of the access policy of the upstream device. Thus, when the upstream device is granted access to a set of rights
according to its access policy, the requesting device downstream of the upstream device will get only a subset of those rights,
thereby receiving a more limited access policy than the upstream device. The inherited access policy can be more limiting in a
variety of ways, including but not limited to limiting in the types of access rights granted to the requesting device, the quantity
of data allowed to be viewed by the requesting device (e.g., a subset of documents or only a portion of each document), the quality
of the data allowed to be viewed by the requesting device, access to only a subset of features provided by the resource, etc.


 


For
example, the security application of host device 115 can be configured by the user to grant devices 120 and 125
viewing access to only a portion of the photos taken by camera 145, or viewing access to a degraded set of photos (e.g.,
lower resolution, etc.) taken by camera 145. In yet other embodiments, the security application of the host device 115
can additionally be configured by the user to provide access to any devices that are downstream of the known device 105
in a cascading fashion, such that devices that are more separated to the known device 105 (e.g., device 125)
has more limited access than devices that arc closer to the known device 105 (e.g., device 120). Thus, one of the
technical effects of this security system is that it allows user of the host device to set access levels for other devices in
the ad-hoc peer-to-peer network 100 without being aware of which devices within the network have potential access to the
associated resources.






    	 



    	 



    

 








In
some embodiments, the access policy of a requesting device can be inherited by two or more upstream devices. If the user 170
of the host device 115 has previously established access policies for both devices 105 and 120. the requesting
device 125 can inherit its access policy from the policies of both devices 105 and 120. When the two established
access policies (for devices 105 and 120) specify different sets of rights, the security application can use different
techniques to inherit different rights from these two policies. In some embodiments, the security application is configured to
inherit only the common rights from the two policies, which most likely will result in a policy that is more limited than either
of the two policies. In the most extreme case in which the access policies of devices 105 and 120 do not share any
common rights, the device 125 will inherit no rights for its access policy. In other embodiments, the security application
is configured to inherit all rights from both policies, which most likely will result in a policy that is broader than either
of the two policies.


 


In
some embodiments, instead of only looking at the path through which the request has passed to get from the requesting device and
the host device, the security application can also look at other possible paths between the requesting device and host device,
and thereby determine the access level for the requesting device based on all possible paths. An alternative path for the request
might involve a known device with a broader (or more limited) access level than the known device in the original path. For example,
instead of traveling through devices 120 and 105, the request from requesting device 125 to host device 115
can travel through devices 120 and 130 to reach host device 115.


 


The
security application can be configured to use whatever path(s) would satisfy an appropriate rules set. For example, in some embodiments
the security application could be configured in a manner that would result in the broadest access. In other embodiments the security
application could be configured in a manner that would result in a narrower, or even the narrowest access.


 


FIG.
2 illustrates the security application with respect to the different software layers within a mobile device. As shown,
an exemplary mobile device 200 includes a networking layer 215 that is responsible for managing transmitting and
receiving data via a networking hardware (e.g., an Ethernet card, a WIFI card, etc.). an operating system layer 210 that
is responsible for managing resources of the device, and a security platform layer 205 sitting on top of the operating
system layer 210. The security platform layer 205 of some embodiments is responsible for managing the security of
the mobile device 200 and all resources associated with the mobile device 200. In some embodiments, a security application
220 can be implemented within the security platform layer 205.


 


Further
in FIG. 2, the security application of the mobile device 200 is configured to manage access to the resources that
are associated with the mobile device. Specifically, the security application is configured to grant access to the associated
resource based on the origin of the request (i.e., the requesting mobile device) and how the requesting mobile device is connected
to the host device. The specific functionalities and features of the security application will be explained in more detailed below
by reference to FIG. 3.


 


FIG.
3 illustrates an example security application 220 that is implemented within the mobile device 200. The security
application 220 includes a security manager 305, a user administration interface 310 configured to interface
with a user 345 of the mobile device 200, and a network interface 315 configured to interface with mobile
devices directly connected to the mobile device 200 (e.g., mobile devices 325, 330, and 335 in this
example). The security application 220 can also be communicatively coupled with an access control list database 320
that is configured to store security data for the security application 220.


 


The
security application can be configured to manage any sharable resource that is associated with the mobile device 200. In
this example, the mobile device 200 has a built-in camera 340. The user 345 can add the camera 340
as one of the resources managed by the security application 220 via the user administration interface 310. Once
a resource is specified to be managed by the security application 220, that resource can be shared with other mobile devices
within the ad-hoc peer-to-peer network and any request to access the resource by other devices will be first directed to the security
application 220.


 


The
security application 220 allows the user 345 to configure different access levels for different known mobile devices
to access the resource. Known mobile devices can be mobile devices that are directly connected to the mobile device 200
within the ad-hoc peer-to-peer network (e.g., mobile devices 325, 330, and 335 in this example). Known mobile
devices can also be any devices that the user of mobile device 200 is aware that are part of the ad-hoc peer-to-peer network.
Thus, in some embodiments, the security manager 305 is configured to provide a user interface for the user 345 of
the mobile device 200 via the user administration interface 310 for configuring the different access levels. Through
this user interface, the user 345 can assign different access levels for different resources associated with the mobile
device 200 to different mobile devices.


 


For
example, the user 345 can give mobile devices 325 and 330 access to view all photos captured by camera 340.
The user 345 can also give mobile device 335 access to take pictures using camera 340 and view all pictures
taken by camera 340. The access information associated with each resource can be stored in the access control list database
320.


 


In
some embodiments, a security application identical to the security application 220 is installed in each of the other mobile
devices within the ad-hoc peer-to-peer network. When a resource associated with a mobile device is being shared within the ad-hoc
peer-to-peer network (i.e., when the user of the mobile device indicates that the resource is sharable within the network via
the security application), the security manager 305 is configured to send a notification to all other mobile devices within
the network about this newly sharable resource. In some embodiments, the notification includes the type of resources, capabilities
of the resources (e.g., take photos, view photos, read, write, etc.), and identity of the host mobile device (e.g., a MAC address.
IP address, name, etc.) within the network.


 


Thus,
users of the other mobile devices can view what resources are available within the ad-hoc peer-to-peer network, and request access
to any one of the resource via the security applications running on their mobile devices. For example, when a user of another
device within the ad-hoc peer-to-peer network requests to access the camera 340, the security manager of that other device
prepares a request that includes at least the following information: identify of the requesting mobile device (e.g., a MAC address,
IP address, name, etc.), the resource for which the user 345 is requesting access, and identity of the host device (e.g.,
mobile device 200 in this example) that hosts the requested resource. The security manager of that device then sends the
request to another mobile device within the network via the network interface based on the identity of the host device. If the
requesting mobile device is directly connected to the host device, the security manager is configured to send the request directly
to the host device. Otherwise, the security manager is configured to send the request to another mobile device within the network
according to a routing table.






    	 



    	 



    

 








When
the requesting device is not directly connected to the host device, the request will pass through one or more other mobile devices
within the network before reaching the host device. When a request passes through an intermediary mobile device, the security
application of the intermediary mobile device will perform several functions. First, the security manager will determine that
the request is not for one of the resources associated with the intermediary mobile device. The security manager then inserts
the identity of the intermediary mobile device into the request as part of the path of the request. Finally, based on the identity
of the host device, the security manager acts as a router to route the request either to the host device if the host device is
directly connected to the intermediary device, or to another intermediary device within the network according to the routing table.


 


Upon
receiving the request to access resource at the host device 200, the security manager 305 reviews the information
within the request and determines if the request (access) can be granted based on the identity of the requesting device and/or
the identity of the intermediary devices that the request has passed through before reaching the host device.


 


As
mentioned above, the user 345 can provide access information of known devices to the security application 220 via
the user interface 310. Thus, the security manager 305 can search through the access control list database 320
to determine if the requesting device matches any one of the known devices listed in the access control list database 320.
If the requesting device matches one of the known devices listed in the database 320. the security manager 305 will
apply the access policy indicated in the database 320 for that requesting device.


 


On
the other hand, if the requesting device is not any one of the known devices listed in the access control list database 320,
the security manager 305 is configured to obtain an access policy for the requesting device based on the identity of the
intermediary devices through which the request has passed before reaching the host device.


 


In
some embodiments, the access policy for a mobile device can be inherited from the access policy of an upstream mobile device.
Thus, in some of these embodiments, the security manager 305 is configured to retrieve the access policy of a known device
listed in the access control list database 320 that matches the identity of one of the intermediary devices. For example,
that known device can be the device that forwards the request to the host device (the device that is directly connected to the
host device).


 


As
mentioned above, the ad-hoc peer-to-peer network can include mobile devices as well as stationary devices (e.g., smart routers).
Thus, the intermediary devices that the request has to pass through before reaching the host device can include mobile devices
and/or stationary devices. It is contemplated that the same concept of access policy inheritance can be applied to stationary
devices as well.


 


Once
the access policy of the known device is retrieved, the security manager 305 can determine an access policy for the requesting
device. In some embodiments, based on the inheritance characteristics of the access level, the security manager 305 can
be configured to grant the same access policy for all other downstream devices from the known device. In other embodiments, the
security manager 305 can be configured to determine a more limited access policy to all of the downstream devices from
the known device. For example, if the known device has both read and write access to the host device’s resource, the security
manager 305 can determine that all downstream devices from that known device only has read access.


 


In
addition, instead of granting the same access policy to all of the downstream devices from the known device, the security manager
305 can also determine different access levels to the downstream devices in a cascading fashion. That is, a downstream
device that is further away (a higher degree of separation) from the host device will have a more limited access policy than a
downstream device that is closer with (a lower degree of separation from) the host device. That way, less access rights will be
given to mobile devices that are more remote (in terms of degree of separation) from the host device.


 


It
should be apparent to those skilled in the art that many more modifications besides those already described are possible without
departing from the inventive concepts herein. The inventive subject matter, therefore, is not to be restricted except in the spirit
of the appended claims. Moreover, in interpreting both the specification and the claims, all terms should be interpreted in the
broadest possible manner consistent with the context. In particular, the terms “comprises” and “comprising”
should be interpreted as referring to elements, components, or steps in a non-exclusive manner, indicating that the referenced
elements, components, or steps may be present, or utilized, or combined with other elements, components. or steps that are not
expressly referenced. Where the specification claims refers to at least one of something selected from the group consisting of
A, B, C ... and N. the text should be interpreted as requiring only one element from the group, not A plus N, or B plus N, etc.


 


What
is claimed is:


 


1.    A
method of managing resources in an ad hoc peer-to- peer network, comprising:


establishing
an ad-hoc peer-to-peer network for a plurality of devices comprising a first device that is associated with a first resource,
wherein the first device is directly connected to a second device in the peer-to-peer network;


 


granting
the second device access to the first resource according to an access policy that specifies a set of rights for accessing the
first resource;


 


receiving
a request for access to the first resource from a third device indirectly connected to the first device in the peer-to-peer network
via the second device;


 


determining
an access policy for the third device for accessing the first resource based on the access policy granted to the second device,
the access policy determined for the third device specifying a subset of the set of rights specified by the access policy granted
to the second device; and


 


providing
the third device access to the first resource according to the determined access policy.


 


2.    The
method of claim 1, wherein the third device is also connected to the first device via a fourth device.


 


3.    The
method of claim 2, further comprising determining the access policy for the third device based on the access policies granted
to both the second and fourth devices.


 


4.    The
method of claim 3, wherein the access policies granted to the second and fourth devices share a common set of rights, wherein
the access policy determined for the third device specifies a subset of the common set of rights for accessing the first resource.


 


5.    The
method of claim 3, wherein the access policies granted to the second and fourth devices do not share a common set of rights,
wherein the access policy determined for the third device specifies no right for accessing the first resource.


 


6.    The
method of claim 1, wherein the set of rights comprises at least one of: copy, write, read, contribute, and delete.


 


7.    The
method of claim 1, wherein the first resource comprises a service providing a set of features.






    	 



    	 



    

 








8.    The
method of claim 7, wherein the determined access level allows the third device to access only a subset of features provided
by the service.


 


9.    The
method of claim 1, wherein the second device is a smart router.


 


10. 
A method of managing resources in an ad hoc peer-to- peer network, comprising:


establishing
an ad-hoc peer-to-peer network for a plurality of devices comprising a first device that is associated with a first resource comprising
a document, wherein the first device is directly connected to a second device in the peer-to-peer network;


 


granting
the second device access to the first resource according to an access policy;


 


receiving
a request for access to the first resource from a third device indirectly connected to the first device in the peer-to-peer network
via the second device;


 


determining
an access policy for the third device for access the first resource based on the access policy granted to the second device, wherein
the access policy determined for the third device allows the third device to access only a portion of the document; and


 


providing
the third device access to the first resource according to the determined access policy.


 


11. The
method of claim 10, wherein the access policy determined for the third device allows the second device to access only a
redacted version of the document.


 


12. A
method of managing resources in an ad hoc peer-to-peer network, comprising:


 


establishing
an ad-hoc peer-to-peer network for a plurality of devices comprising a first device that is associated with a first resource comprising
media content, wherein the first device is directly connected to a second device in the peer-to-peer network;


 


granting
the second device access to the first resource according to an access policy;


 


receiving
a request for access to the first resource from a third device indirectly connected to the first device in the peer-to-peer network
via the second device;


 


determining
an access policy for the third device for accessing the first resource based on the access policy granted to the second device,
wherein the access policy determined for the third device allows the second device to access a portion of the media content; and


 


providing
the third device access to the first resource according to the determined access policy.


 


13.  The
method of claim 12, wherein the determined access level disallows the third device to access metadata of the media content.


 


14.  The
method of claim 12, wherein the determined access level allows the third device to access a degraded version of the media
content.


 


15.  The
method of claim 14, wherein the degraded version has a lower resolution than the original media content.


 


*   *   *   *   *