Source: http://www.google.de/patents/US9477832?hl=de
Timestamp: 2017-11-19 14:17:05
Document Index: 129924336

Matched Legal Cases: ['application No. 2499932', 'application No. 505', 'application No. 2005', 'Application No. 10', 'Application No. 200510052746', 'application No. 2005', 'Application No. 2005', 'application No. 2005']

Patent US9477832 - Digital identity management - Google Patentsuche
One aspect relates to a process and associated device for managing digital ID lifecycles for application programs, and abstracting application programs for multiple types of credentials through a common Digital Identity Management System (DIMS) and Application Programming Interface (API) layer....http://www.google.de/patents/US9477832?utm_source=gb-gplus-sharePatent US9477832 - Digital identity management
Veröffentlichungsnummer US9477832 B2
Anmeldenummer US 14/467,615
Eingetragen 25. Aug. 2014
Auch veröffentlicht unter US7703128, US8151332, US8819797, US20040162786, US20070055887, US20120174200, US20140366108, US20170012784
Veröffentlichungsnummer 14467615, 467615, US 9477832 B2, US 9477832B2, US-B2-9477832, US9477832 B2, US9477832B2
Erfinder David B. Cross, Matthew W. Thomlinson, Philip J. Hallin, Thomas C. Jones
Patentzitate (93), Nichtpatentzitate (45), Klassifizierungen (14), Juristische Ereignisse (2)
US 9477832 B2
1. A stand-alone computer outside of a domain defined by a plurality of clients, the stand-alone computer comprising:
an application program stored in the memory that, based on execution by the at least one processing device, configures the at least one processing device to:
access a Digital Identity Management System (DIMS), the DIMS including an abstraction layer configured to abstract a digital ID associated with the application program as an abstracted digital ID;
search for credentials based on one or more attributes;
return results of the credential search to the DIMS, the DIMS being configured to open the credentials based on a cryptographic key and to return an object reference to the application program; and
use the object reference to perform an operation on the stand-alone computer.
9. An apparatus outside of a domain defined by a plurality of clients, the apparatus comprising:
memory coupled to the at least one processing device; and
find credentials based on one or more attributes, the DIMS being configured to:
return results to the application program based at least on finding credentials; and
return an object reference to the application program;
open at least one or more of the found credentials based at least on a cryptographic key; and
use the object reference to perform an operation on the apparatus.
the application program further configures the apparatus to present the object reference to a security token service (STS).
19. An apparatus outside of a domain defined by a plurality of clients, the apparatus comprising:
memory coupled to the at least one processing device;
access a Digital Identity Management System (DIMS) including an abstraction layer configured to abstract a digital ID associated with the application program as an abstracted digital ID;
the DIMS being configured to return results in response to the application program finding credentials based at least on attributes, open at least one or more of the credentials based on a cryptographic key, and return an object reference to the application program; and
The DIMS 100 can run on a variety of networked computer and stand-alone computer configurations. For example, FIG. 1a illustrates one embodiment of computer environment 102 including one or more servers 104, a network 106, and one or more clients 108 that are arranged in a network configuration. The embodiment of DIMS 100 shown in FIG. 1a provides data communications between different instances of the client computers 108 and/or the server computers 104. In this disclosure, the client computers 108 are referred to as being configured as “domain-joined” computers. The clients 108 and the servers 104 may be configured as distinct computers, networked workstations, mainframes, embedded devices, or physically small computing devices such as a PDA or cellular telephone arranged in a local area network (LAN), wide area network (WAN), wireless, wired-base, or other networked configuration.
FIG. 1b illustrates another embodiment of DIMS 100 that runs on a stand-alone computer 110, which is in communication with the network 106 (often over the Internet). The stand-alone computer configuration can be viewed as a small or large computer environment 102. For example, the stand-alone computer 110 could be a personal computer, an embedded computer device, a mainframe, or a PDA. In this disclosure, the stand-alone computer 110 is referred to as being configured as a “non-domain joined” computer. The digital ID and encryption concepts of the DIMS 100 can be applied to computer environments 102 of any size or complexity such as shown in FIGS. 1a, 1b , and 13.
FIG. 2 shows one embodiment of computer environment 102 including a client computer. The client computer may be the client (domain-joined) computer 108 as shown in FIG. 1a or the stand-alone (non-domain joined) computer 110 as shown in FIG. 1b . The client computer 108 includes an Application Programming Interface (API) 204 for the DIMS 100 and a digital ID store(s) 206. The digital ID store(s) 206 can include a database (different embodiments of which include a relational database) or some other memory storage configuration. More components relating to the digital ID store(s) 206 are described relative to FIG. 7.
FIG. 3 shows one embodiment of software components associated with the DIMS 100 (that runs on a computer environment 102 as described relative to FIG. 13, different embodiment of which are shown in FIGS. 1a and 1b ). The DIMS 100 may include one or more security token services 302 such as a certificate authority, a lifecycle management component 304 including an auto-enrollment service 306, a system notification portion 308, a digital ID manager component 310, a trusted store 312, a trust provider 314, a root or trusted STS 316, a cache of tokens 318 issued from the root or trusted STS 316, a personal user store 320, and a digital IDs property portion 322.
The digital ID manager component 310, the trusted store 312, the trust provider 314, the root or trusted STS 316, the cache of tokens 318 issued by the root or trusted STS 316, the personal user store 320, and the digital ID properties 322 together provide the functions of storing, retrieving, and modifying data structures and other digital IDs for the auto-encryption process. Within different embodiments of the DIMS, each individual one of the security token services 302, the lifecycle management component 304 including the auto-enrollment service 306, the system notification portion 308, the digital ID manager component 310, the trusted store 312, the trust provider 314, the root or trusted STS 316, the root or trusted STS 316, the cache of tokens 318 issued by the root or trusted STS 316, the personal user store 320, and the digital ID properties 322 can be located in different locations among the client 108, the network 106, or the server 104 as shown in FIG. 1a , or in the stand-alone computer 110 shown in FIG. 1b . In other words, the DIMS 100 can be configured to run on a computer in any networked domain-joined or any stand-alone non-domain joined configuration that is desired.
Auto-enrollment of user digital IDs provides a quick and simple technique to issue digital IDs to users, and to enable PKI application programs (including smartcard logon, encrypting file system (EFS), SSL, and S/MIME). SSL and S/MIME are considered to be general purpose encryption protocols because they do not place any limits on the size of the data being encrypted. Though the auto-enrollment service 306 of the lifecycle management component 304 can be located in any location in a network or stand-alone computer environment 102 as shown in FIG. 1b , the present disclosure describes providing the auto-enrollment service 306 within the client computer 108.
The DIMS 100 includes the lifecycle management component 304 (which in turn includes the auto-enrollment service 306). The auto-enrollment service 306 supports pending digital ID requests such as those that must undergo registration authority or workflow processes before issuance. For the digital ID requests, a user of the DIMS 100 can manually or automatically request a digital ID from a security token services 302 located at a server 104 (see FIG. 1a ) or another network or stand-alone location. Once the digital ID has been approved or issued, the auto-enrollment process 402 will install the digital ID into the users client computer automatically. The auto-enrollment system 306 also supports renewal of an expired user digital ID. Digital IDs are automatically renewed on behalf of the user, machine or application service depending on the configuration of the digital ID template.
The DIMS 100 performs lifecycle management of the digital IDs that allows for digital ID renewal, superseding of digital IDs, and multiple signature requirements. In one embodiment, auto-enrollment can occur in certain DIMS 100 embodiments except where the user interaction is explicitly defined (for example, in a digital ID template in the active directory). The auto-enrollment process 402 is triggered, for example, by the local or interactive logon process. The operating system (within the client computer 108) queries the central repository or possibly the active directory to download a digital ID from the appropriate digital ID store(s) 206 (such as the trusted store 312 shown in FIG. 3) into the personal user store 320 (such as “My Store” that exists in certain embodiments of the Windows® Operating Systems) on the client computer 108. The digital ID properties 322 are under the control of, and can largely be set by, the user in the client computer 108 in FIG. 1a or the stand-alone computer 110 shown in FIG. 1 b.
FIGS. 4a, 4b, and 4c illustrate one embodiment of digital information management process 400 that can be applied to DIMS 100 within both non-domain joined computers as well as domain joined computers. From the server 104 side as illustrated in FIG. 1a , requests from DIMS 100 applied to both non-domain joined and domain joined computers are responded to. The digital information management process 400 includes auto-enrollment process 402 and includes 404 in which the DIMS 100 examines the digital ID store(s) 206 or the certificate store. The digital information management process 400 including auto-enrollment process 402 continues to decision 406 in which it is determined whether renewal of the digital ID is required. If the answer to decision 406 is no, then the digital information management process 400 including auto-enrollment process 402 terminates. If the answer to decision 406 is yes, then renewal of the digital ID is necessary, and the digital information management process 400 including auto-enrollment process 402 continues to decision 408.
The auto-enrollment process of the DIMS 100 can be triggered by the logon process (such as Winlogon in Windows® Operating Systems). The user management console 706 is described that treats all credentials and digital IDs in the same manner whether they are passwords, keys, x.509 certificates, or XRML licenses. In those embodiments where the DIMS 100 is contained within the client 108 of FIG. 1a or the stand-alone computer 110 in FIG. 1b , the user can configure and control the generation of the digital IDs by the DIMS 100 to provide a consistent experience for the user. As such, the user will be able to more consistently and effectively apply the digital identification as the user utilizes the application programs.
US6122631 * 28. März 1997 19. Sept. 2000 International Business Machines Corporation Dynamic server-managed access control for a distributed file system
US6202157 8. Dez. 1997 13. März 2001 Entrust Technologies Limited Computer network security system and method having unilateral enforceable security policy provision
US6438690 31. Dez. 1998 20. Aug. 2002 International Business Machines Corp. Vault controller based registration application serving web based registration authorities and end users for conducting electronic commerce in secure end-to-end distributed information system
US6499110 30. Juni 1999 24. Dez. 2002 Entrust Technologies Limited Method and apparatus for facilitating information security policy control on a per security engine user basis
US6802003 * 30. Juni 2000 5. Okt. 2004 Intel Corporation Method and apparatus for authenticating content
US6865671 * 1. Mai 2000 8. März 2005 Sendmail, Inc. Electronic mail system with authentication methodology for supporting relaying in a message transfer agent
US6883100 * 10. Mai 1999 19. Apr. 2005 Sun Microsystems, Inc. Method and system for dynamic issuance of group certificates
US6986060 * 23. Mai 2000 10. Jan. 2006 Oracle International Corp. Method and apparatus for sharing a security context between different sessions on a database server
US7290133 17. Nov. 2000 30. Okt. 2007 Entrust Limited Method and apparatus improving efficiency of end-user certificate validation
US7703128 13. Febr. 2003 20. Apr. 2010 Microsoft Corporation Digital identity management
US20010044894 4. Juni 2001 22. Nov. 2001 Yoko Saito Security management method for network system
US20020013898 26. März 2001 31. Jan. 2002 Sudia Frank W. Method and apparatus for roaming use of cryptographic values
US20020027992 31. Aug. 2001 7. März 2002 Sony Corporation Content distribution system, content distribution method, information processing apparatus, and program providing medium
US20020116646 20. Febr. 2002 22. Aug. 2002 Hewlett Packard Company Digital credential exchange
US20020178377 21. März 2001 28. Nov. 2002 International Business Machines Corporation Method and system for server support for pluggable authorization systems
US20030074660 12. Okt. 2001 17. Apr. 2003 Liberate Technologies System method and apparatus for portable digital identity
US20030079136 * 20. Juni 2002 24. Apr. 2003 Emmanuel Ericta Security framework
US20030110376 14. Okt. 1997 12. Juni 2003 Michael J. Wiener Method and system for providing updated encryption key pairs and digital signature key pairs in a public key system
US20030115322 13. Sept. 2002 19. Juni 2003 Moriconi Mark S. System and method for analyzing security policies in a distributed computer network
US20030115468 * 19. Dez. 2001 19. Juni 2003 Aull Kenneth W. Assignment of user certificates/private keys in token enabled public key infrastructure system
US20030131245 6. Jan. 2003 10. Juli 2003 Michael Linderman Communication security system
US20030145223 * 28. Jan. 2002 31. Juli 2003 Intel Corporation Controlled access to credential information of delegators in delegation relationships
US20030167405 14. Nov. 2001 4. Sept. 2003 Gregor Freund System methodology for automatic local network discovery and firewall reconfiguration for mobile computing devices
US20030236975 * 20. Juni 2002 25. Dez. 2003 International Business Machines Corporation System and method for improved electronic security credentials
US20040001594 * 28. Juni 2002 1. Jan. 2004 Microsoft Corporation Systems and methods for providing secure server key operations
US20040024889 16. Jan. 2003 5. Febr. 2004 Interactual Technologies, Inc., A California Corporation System, method and article of manufacture for remote control and navigation of local content
US20040073787 11. März 2003 15. Apr. 2004 Amir Ban Personal portable storage medium
US20040088578 * 31. Okt. 2002 6. Mai 2004 International Business Machines Corporation System and method for credential delegation using identity assertion
US20040139352 * 15. Jan. 2003 15. Juli 2004 Shewchuk John P. Uniformly representing and transferring security assertion and security response information
US20060069913 11. Okt. 2005 30. März 2006 Tvworks, Llc Hierarchical open security information delegation and acquisition
US20060075472 27. Juni 2005 6. Apr. 2006 Sanda Frank S System and method for enhanced network client security
US20070055887 25. Okt. 2006 8. März 2007 Microsoft Corporation Digital Identity Management
US20070124812 21. Dez. 2006 31. Mai 2007 Intertrust Technologies Corp. Trust Management Systems and Methods
JP4271462B2 Titel nicht verfügbar
JP4271465B2 Titel nicht verfügbar
JP2002132728A Titel nicht verfügbar
1 "ArcotID Software Smart Card", available at <<http://www.arcot.com/arcotID.html>>, Apr. 2004, 3 pages.
2 "ArcotID Software Smart Card", available at >, Apr. 2004, 3 pages.
3 "Entrust Authority (tm) Roaming Server", available at <<http://www.entrust.com/authority/roaming/datasheet.htm>>, Apr. 2004, 2 pages.
4 "Entrust Authority (tm) Roaming Server", available at >, Apr. 2004, 2 pages.
6 "Managed PKI: Roaming", available at <<http://www.verisign.com/products/roaming/index.html>>, Apr. 2004, copyright 1995 to 2004, 2 pages.
7 "Managed PKI: Roaming", available at >, Apr. 2004, copyright 1995 to 2004, 2 pages.
8 "Novell SecureLogin", retrieved on Jun. 29, 2006 at <<http://www.novell.com/documentation/securelogin30/pdfdoc/nsladm304/nsladm304.pdf>>Oct. 31, 2003, Section 1, pp. 1-198.
9 "Novell SecureLogin", retrieved on Jun. 29, 2006 at >Oct. 31, 2003, Section 1, pp. 1-198.
10 "Partial containment structure for integration of distributed computing environment and local registries", IBM Technical disclosure bulletin, IBM Corp. New York, US, vol. 38, No. 9, Sep. 1, 1995, pp. 535-538.
11 "RSA Security Introduces Web-based Digital Credential Store", available at <<http://www.rsasecurity.com/company/news/releases/pr.asp?doc-id=312>>, Apr. 2004, 2 pages.
12 "RSA Security Introduces Web-based Digital Credential Store", available at >, Apr. 2004, 2 pages.
13 "v-Go Single-Sign on by Passlogix" retrieved on May 29, 2006 at <<http://www.biometricsdirect.com/Documents/brochure-SSO.pdf>> Passlogix, Apr. 8, 2003, 7 pages.
14 "v-Go Single-Sign on by Passlogix" retrieved on May 29, 2006 at > Passlogix, Apr. 8, 2003, 7 pages.
15 Allen, et al., Single Sign-ON: A Set of Scribe Notes Describing the Operation of Single Sign-ON After a Lecture Given by Almerindo Graziano, retrieved from the internet on Jan. 21, 2011 at <<http://www.besnard.org/sso.pdf>>, 3 pages.
16 Allen, et al., Single Sign-ON: A Set of Scribe Notes Describing the Operation of Single Sign-ON After a Lecture Given by Almerindo Graziano, retrieved from the internet on Jan. 21, 2011 at >, 3 pages.
17 Brovick et al., "Windows 2000 Active Directory", New Riders Publishing, 2000, Chapter 10 pp. 1-8.
18 Christoffel, Jurgen, "Bal-A Tool to Synchronize Document Collections Between Computers", Proceedings of the Eleventh Systems Administration Conference (LISA 97), San Diego, California, Oct. 1997, pp. 85-88.
19 Cross, "Certificate Autoenrollment in Windows Server 2003", retrieved on Apr. 8, 2004 from <<http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/securty . . . >>, Apr. 2003, 31 pages.
21 Gupta, et al., "Security Characteristics of Cryptographic Mobility Solutions" retrieved on May 29, 2006 at <<http:″www.cs.dartmouth.edu/{pki02/Gupta/paper.pdf>> Jul. 30, 2002, pp. 117-126.
24 Nemoto, Novelle Announces a Rule for Consolidating Passwords in an Environment Including a Plurality of Servers, retrieved from the internet on Jan. 21, 2011 at <<http://itpro.nikkeibp.co.jp/free/NT/NEWS/20040318/1>> Mar. 18, 2004, 3 pages.
25 Nemoto, Novelle Announces a Rule for Consolidating Passwords in an Environment Including a Plurality of Servers, retrieved from the internet on Jan. 21, 2011 at > Mar. 18, 2004, 3 pages.
26 Novelle Announces Products for Achieving Both Security and Efficiency, retrieved from the internet on Jan. 21, 2011 at <<http://journal.mycom.co.jp.news/2002/05/20/06.html>> May 20, 2002, 1 page.
27 Novelle Announces Products for Achieving Both Security and Efficiency, retrieved from the internet on Jan. 21, 2011 at > May 20, 2002, 1 page.
28 Office action for U.S. Appl. No. 13/410,173, mailed on Aug. 9, 2013,Cross et al., "Digital Identity Management", 21 pages.
29 Office action for U.S. Appl. No. 13/410,173, mailed on Feb. 28, 2013, Cross et al., "Digital Identity Management", 23 pages.
30 Office action for U.S. Appl. No. 13/410,173, mailed on Jan. 22, 2014, Cross, et al., "Digital Identity Management", 30 pages.
31 Office action for U.S. Appl. No. 13/410,173, mailed on Nov. 29, 2013, Cross, et al., "Digital Identity Management", 21 pages.
32 Shibutani, "Coexistence of Active Directory and NDS, Detailed Explanation: Services for NetWare 5.0", INTEROP Magazine, vol. 10, No. 10, pp. 167-173, Softbank Publishing Inc., Oct. 1, 2000.
33 Single Sign-ON: Improving Convenience and Reducing Management Burdens for Users in a Secure Sing-ON Environment, retrieved from the internet at <<http://itpro.nikkeibp.co.jp/as/novell-sec/sp1/index.html>> 2003, 4 pages.
34 Single Sign-ON: Improving Convenience and Reducing Management Burdens for Users in a Secure Sing-ON Environment, retrieved from the internet at > 2003, 4 pages.
35 Stern, et al., NFS & NIS, 2nd Ed., pp. 72-77, OReilly Japan, Inc., published on Apr. 27, 2002, 7 pages.
36 Taguchi, Novell Announces a Network-Security Related New Product Novell SecureLogin 3.0, retrieved from the internet on Jan. 21, 2011 at http://ascii.jp.elem/000/000/331/331049/ May 21, 2002, 14 pages.
37 The Canadian Office Action mailed Aug. 14, 2012 for Canadian patent application No. 2499932, a counterpart foreign application of U.S. Pat. No. 7,984,488, 3 pages.
38 The Indian Office Action mailed Aug. 2, 2013 for Indian patent application No. 505/DEL/2005, a counterpart foreign application of U.S. Pat. No. 7,984,488, 2 pages.
39 The Japanese Office Action mailed Sep. 4, 2012 for Japanese patent application No. 2005-55981, a counterpart foreign application of U.S. Pat. No. 7,984,488, 9 pages.
40 The Korean Office Action mailed Apr. 28, 2011 for Korean Patent Application No. 10-2005-19076, a counterpart foreign application of U.S. Appl. No. 10/821,603, 3 pages.
41 Translated Chinese Office Action mailed Mar. 11, 2011 for Chinese Patent Application No. 200510052746.8, a counterpart foreign application of U.S. Appl. No. 10/821,603.
42 Translated Japanese Office Action mailed Oct. 1, 2013 for Japanese patent application No. 2005-55981, a counterpart foreign application of U.S. Pat. No. 7,984,488, 24 pages.
43 Translated Japanese Office Action mailed on Jan. 28, 2011 for Japanese Patent Application No. 2005-55981, a counterpart foreign application of U.S. Appl. No. 10/821,603.
44 Translated Japanese Office Action mailed Sep. 27, 2011 for Japanese patent application No. 2005-55981, a counterpart foreign application of U.S. Pat. No. 7,984,488, 3 pages.
45 Yamaguchi, "Visual J++ Becomes Unsuitable for Pure Java, and Restarts as a Win Development Tool", Nikkei Byte, No. 178, pp. 158-163, Nikkei Business Publications, Inc., May 22, 1998.
Internationale Klassifikation G06F21/33, G06F21/00, H04L9/32, G06F21/45
Unternehmensklassifikation G06F21/45, H04L9/30, H04L9/006, H04L9/14, H04L9/3263, H04L63/06, H04L9/3231, H04L2209/603, H04L9/3234, G06F21/33
12. Juli 2016 AS Assignment
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:CROSS, DAVID B.;HALLIN, PHILIP J.;THOMLINSON, MATTHEW W.;AND OTHERS;REEL/FRAME:039137/0527