Source: https://patents.google.com/patent/US8584230
Timestamp: 2018-07-17 19:26:49
Document Index: 128064789

Matched Legal Cases: ['application No. 201110162110', 'application No. 200780033359', 'application No. 200780033359', 'application No. 07842066', 'application No. 07842066', 'application No. 196524', 'application No. 196407', 'application No. 196524', 'application No. 196408', 'application No. 2009', 'Application No. 2007800333591', 'application No. 2009', 'application No. 2009']

US8584230B2 - Security authorization queries - Google Patents
US8584230B2
US8584230B2 US13246537 US201113246537A US8584230B2 US 8584230 B2 US8584230 B2 US 8584230B2 US 13246537 US13246537 US 13246537 US 201113246537 A US201113246537 A US 201113246537A US 8584230 B2 US8584230 B2 US 8584230B2
US13246537
US20120017263A1 (en )
This application is a continuation of, and claims priority to, U.S. patent application Ser. No. 11/530,438, filed Sep. 8, 2006, entitled “Security Authorization Queries”, which application is incorporated herein in its entirety by reference.
A says p read Foo if p possess r{(emailName, *@fabrikam.com)}
A says v1 read Foo AND A says v1 possess r{(emailName,*)} AND A says v2 read Foo AND A says v2 possess {(digest,*)}
A says p read Foo if p possess r{(emailName, *@fabrikam.com)},
A say p1 read Foo AND A says p2 read Foo AND (p1!=p2).
A says p read Bar if p possess r{(group, B)}.
(A says v read Foo OR A says v read BAR) AND NOT (A says v read Foo AND A says v read BAR).
At block 1006, the operation is provided to an authorization query table. For example, resource-specific operation 806 may be provided to authorization query table 224. At block 1008, an authorization query that is associated with the operation is ascertained. For example, a field 808 that includes resource-specific operation 806 may be located. The associated authorization query may then be retrieved from the located field 806.
More specifically, the retrieved authorization query may comprise an authorization query template. The associated authorization query template is converted into the authorization query by substituting actual principals, resources, etc. into predetermined corresponding slots of the authorization query template based on the security tokens provided by the requestor. In an example implementation, resource guard 214, which knows the actual variable information from request 704, performs this conversion by substitution.
The semantics of queries are defined by the relation AC,θ ├ q. In the following, let AC be an assertion context. Also, let θ be a substitution, and let ε be the empty substitution. Let Dom(θ) be the domain of the substitution θ. If X is a phrase of syntax, let Vars(X) be the set of variables occurring in X. An example formal semantics for authorization queries is as follows:
AC,ε ├ not(q) if AC,ε ├ q does not hold and Vars(q) = φ
AC,ε ├ c if Vars(c)= φ and c is valid .
Given a query q and an authorization context AC, an authorization algorithm returns the set of substitutions θ such that AC,θ ├ q. If the query is ground, the answer set is either empty (meaning “no” the request is denied) or a singleton set containing the empty substitution ε (meaning “yes” the request is granted). If the query contains variables, then the substitutions in the answer set are the variable assignments that make the query true.
not(Admin says requester has initiated payment).
AuthAns AC ⁡ ( e ⁢ ⁢ says ⁢ ⁢ fact ) = { θ | e ⁢ ⁢ θ ⁢ ⁢ says ⁢ ⁢ fact ⁢ ⁢ θ ⁢ ⁢ is ⁢ ⁢ deducible ⁢ ⁢ from ⁢ ⁢ AC ⁢ ⁢ and ⁢ ⁢ Dom ⁡ ( θ ) ⁢ ⊆ Vars ⁡ ( e ⁢ ⁢ says ⁢ ⁢ fact ) } AuthAns AC ⁡ ( q 1 , q 2 ) = { θ 1 ⁢ θ 2 | θ 1 ∈ AuthAns AC ⁡ ( q 1 ) ⁢ ⁢ and ⁢ ⁢ θ 2 ∈ AuthAns AC ⁡ ( q 2 ⁢ θ 1 ) } AuthAns AC ⁡ ( q 1 ⁢ ⁢ or ⁢ ⁢ q 2 ) = AuthAns AC ⁡ ( q 2 ) ⋃ AuthAns AC ⁡ ( q 2 ) AuthAns AC ⁡ ( not ⁡ ( q ) ) = { ɛ } if ⁢ ⁢ Vars ⁡ ( q ) = ϕ ⁢ ⁢ and ⁢ ⁢ AuthAns AC ⁡ ( q ) = ϕ = ϕ if ⁢ ⁢ Vars ⁡ ( q ) = ϕ ⁢ ⁢ and ⁢ ⁢ AuthAns AC ⁡ ( q ) ≠ ϕ = undefined otherwise AuthAns AC ⁡ ( c ) = { ɛ } if ⁢ ⁢ Vars ⁡ ( c ) = ϕ ⁢ ⁢ and ⁢ ⁢ c ⁢ ⁢ is ⁢ ⁢ valid = ϕ if ⁢ ⁢ Vars ⁡ ( c ) = ϕ ⁢ ⁢ and ⁢ ⁢ c ⁢ ⁢ is ⁢ ⁢ not ⁢ ⁢ valid = undefined otherwise
2. AC,θ ├ q iff θε AuthAnsAC (q).
applying, by the one or more processors, a multi-level security scheme to the request for access, the multi-level security scheme including an assertion level and a query level, wherein the assertion level disallows an assertion containing a negation, and wherein the query level permits an authorization query containing at least one negation; and
determining, by the one or more processors, an authorization result for the request, based at least on the application of the multi-level security scheme.
2. The method of claim 1, further comprising ascertaining the authorization query by applying an authorization query table to the request.
3. The method of claim 1, wherein the authorization query is an English-language expression.
translating the request for access to an operation to be performed on the resource; and
ascertaining the authorization query associated with the operation, based on an authorization query table included in the multi-level security scheme.
5. The method of claim 4, wherein the authorization query table maps one or more resource-specific operations to one or more associated authorization queries.
6. The method of claim 1, further comprising auditing the determination of the authorization result, based on an audit policy.
7. The method of claim 1, wherein the assertion level includes a syntactic validator for disallowing the assertion containing the negation.
8. The method of claim 1, wherein the authorization query is a logical operation.
one or more security components executed by the one or more processors to implement a multi-level security scheme that includes an assertion level and a query level, wherein the one or more security components perform actions including:
receiving a request to access a resource;
forming an assertion context at the assertion level, including disallowing an assertion containing a negation;
ascertaining an authorization query at the query level, based at least on an authorization query table; and
employing the authorization query and the assertion context to produce an authorization decision for the request to access the resource.
10. The system of claim 9, wherein the one or more security components include an audit component that audits the operation of at least one of the other security components.
11. The system of claim 9, wherein the actions further include permitting at least one negation within the authorization query, at the query level.
12. The system of claim 9, wherein the request includes a security token that includes one or more token assertions, and wherein the actions further include combining the one or more token assertions with one or more policy assertions to form the assertion context at the assertion level.
13. The system of claim 9, wherein disallowing the assertion containing the negation is performed using syntactic validation at the assertion level.
14. The system of claim 9, wherein the authorization query is a logical operation that includes at least one asserted fact and at least one logical operator.
15. The system of claim 9, wherein the actions further include:
translating the request into an operation to be performed on the resource;
providing the operation to the authorization query table that maps one or more resource-specific operations to one or more associated authorization queries; and
retrieving the authorization query associated with the operation, based on the mapping included in the authorization query table.
16. One or more computer-readable storage devices storing instructions that, when executed, configure one or more processors to perform actions comprising:
receiving a request to access a resource, wherein the request includes a security token with one or more token assertions;
applying a multi-level security scheme to the request for access, the multi-level security scheme including a first level and a second level;
determining an assertion context at the first level, based on the one or more token assertions;
employing syntactic validation to disallow an assertion containing a negation, at the first level;
ascertaining an authorization query at the second level; and
17. The one or more computer-readable storage devices of claim 16, wherein the actions further comprise auditing one or more of the actions based on an audit policy.
18. The one or more computer-readable storage devices of claim 16, wherein determining the assertion context includes combining the one or more token assertions with one or more policy assertions to form the assertion context.
19. The one or more computer-readable storage devices of claim 18, wherein the one or more policy assertions include at least one of a trust-related assertion and an authorization-related assertion.
20. The one or more computer readable storage devices of claim 16, wherein the second level permits at least one negation within the authorization query.
US13246537 2006-09-08 2011-09-27 Security authorization queries Expired - Fee Related US8584230B2 (en)
US11530438 US8060931B2 (en) 2006-09-08 2006-09-08 Security authorization queries
US13246537 US8584230B2 (en) 2006-09-08 2011-09-27 Security authorization queries
US11530438 Continuation US8060931B2 (en) 2006-09-08 2006-09-08 Security authorization queries
US20120017263A1 true US20120017263A1 (en) 2012-01-19
US8584230B2 true US8584230B2 (en) 2013-11-12
US11530438 Expired - Fee Related US8060931B2 (en) 2006-09-08 2006-09-08 Security authorization queries
US13246537 Expired - Fee Related US8584230B2 (en) 2006-09-08 2011-09-27 Security authorization queries
CN (2) CN102176226B (en)
CA (2) CA2657400A1 (en)
"eXtensible Rights Markup Language (XrML) 2.0 Specificaton Part II: Core Schema", ContentGuard, available at www.xrml.org, znob 20, 2001, 46 pgs.
"OASIS", eXtensible Access Control Markup Language (XACML) Version 2.0 Core Specification, 2005, accessed on Sep. 27, 2006 at <<www.oasis-open.org/committees/xacm1/>>, 6 pages.
"RFC 3280—Internet X.409 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", IEFT, retrieved on Sep. 22, 2006 from <<http://www.faqs.org/rfcs/rfc3280.html>>, Apr. 2002, 8 pages.
"RFC 3280-Internet X.409 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", IEFT, retrieved on Sep. 22, 2006 from >, Apr. 2002, 8 pages.
Ardagna, et al., "XML-based Access Control Languages ", retrieved at <<http://seclab.dti.unimi.it/Papers/RI-3.pdf>>, Information Security Technical Report, vol. 9, Issue 3, Jul.-Sep. 2004, pp. 1-14.
Ardagna, et al., "XML-based Access Control Languages ", retrieved at >, Information Security Technical Report, vol. 9, Issue 3, Jul.-Sep. 2004, pp. 1-14.
Becker, et al., "Cassandra: Distributed Access Control Policies with Tunable Expressiveness", IEEE 5th International Workshop on Policies for Distributed Systems and Networks, Jun. 2004, pp. 159-168.
Becker, et al., "Cassandra: Flexible Trust Management, Applied to Electronic Health Records", IEEE Computer Security Foundations Workshop, Jun. 2004, pp. 139-154.
Blaze, et al., "Decentralized Trust Management", IEEE Symposium on Security and Privacy, May 1996, pp. 164-173.
Blaze, et al., "The Role of Trust Management in Distributed Systems Security", Book, Secure Internet Programming, 1999, pp. 185-210.
Cederquist et al., "An Audit Logic for Accountability", 6th IEEE Intl Workshop on Policies for Distributed Systems and Networks, Policy 2005, Jun. 2005, 10 pgs.
Chinese Office Action mailed Jan. 30, 2012 for Chinese patent application No. 201110162110.4, a counterpart foreign application of US patent No. 8,060,931, 6 pages.
Chinese Office Action mailed Mar. 13, 2013 for Chinese patent application No. 200780033359.7, a counterpart foreign application of US patent No. 8,201,215, 8 pages.
Chinese Office Action mailed Sep. 13, 2012 for Chinese patent application No. 200780033359.7, a counterpart foreign application of US patent No. 8,201,215, 9 pages.
Dai et al., "Logic Based Authorization Policy Engineering", Proc 6th World Multiconference on Systemics, Cybernetics and Informatics, Jul. 2002, , 9 pgs.
European Office Action mailed Apr. 19, 2012 for European patent application No. 07842066.8, a counterpart foreign application of U.S. Appl. No. 11/530,446, 5 pages.
Extended European Search Report dated Jul. 22, 2011 for European patent application No. 07842066.8, 8 pgs.
Farrell et al., "Assertions and Protocols for the OASIS Security Assertion Markup Language (SAML) V2.0", OASIS Open, 2004, Aug. 2004, 87 pgs.
Final Office Action for U.S. Appl. 11/530,433, mailed on Jul. 8, 2011, Blair B. Dillaway, "Fact Qualifiers in Security Scenarios", 18 pgs.
Final Office Action for U.S. Appl. No. 11/530,427, mailed on Jun. 29, 2011, Blair B. Dillaway, "Variable Expressions in Security Assertions", 19 pgs.
Final Office Action for U.S. Appl. No. 11/530,429, mailed on Jul. 8, 2011, Blair B. Dillaway, "Authorization Decisions with Principal Attributes", 20 pgs.
Hallam-Baker et al., "Web Services Security: SAML Token Profile", OASIS Open, Sep. 23, 2002, 25 pgs.
Hallam-Barker, "Security Assertion Markup Language Straw-man Architecture", VeriSign, 2001, Feb. 16, 2001, 17 pgs.
Halpern, et al., "Using First-Order Logic to Reason About Policies", IEEE Computer Security Foundations Workshop, Jun. and Jul. 2003, available at <<http://arxiv.org/PS—cache/cs/pdf/0601/0601034.pdf>>, pp. 187-201.
Halpern, et al., "Using First-Order Logic to Reason About Policies", IEEE Computer Security Foundations Workshop, Jun. and Jul. 2003, available at >, pp. 187-201.
Hughs et al., "Security Assertion Markup Language (SAML) 2.0 Technical Overview", OASIS, Jul. 2004, 36 pgs.
Israeli Office Action mailed Aug. 13, 2012 for Israeli patent application No. 196524, a counterpart foreign application of U.S. Appl. No. 11/530,556, 2 pages.
Israeli Office Action mailed Mar. 19, 2012 for Israel patent application No. 196407, a counterpart foreign application of U.S. Appl. No. 11/530,446, 4 pages.
Israeli Office Action mailed Mar. 20, 2012 for Israel patent application No. 196524, a counterpart foreign application of U.S. Appl. No. 11/530,556, 1 page.
Israeli Office Action mailed May 6, 2012 for Israeli patent application No. 196408, a counterpart foreign application of US patent No. 8,060,931, 5 pages.
Japanese Office Action mailed May 31, 2013 for Japanese patent application No. 2009-527586, a counterpart foreign application of US patent No. 8,201,215, 7 pages.
Jim, "SD3: A Trust Management System with Certified Evaluation", Proceedings of the 2001 IEEE Symposium on Security and Privacy, May 2001, available at <<http://www.research.att.com/~trevor/papers/JimOakland2001.pdf#search=%22%22SD3%3A%20A%20Trust%20Management%20System%20with%20Certified%20Evaluation%22%22>>, pp. 106-115.
Jim, "SD3: A Trust Management System with Certified Evaluation", Proceedings of the 2001 IEEE Symposium on Security and Privacy, May 2001, available at <<http://www.research.att.com/˜trevor/papers/JimOakland2001.pdf#search=%22%22SD3%3A%20A%20Trust%20Management%20System%20with%20Certified%20Evaluation%22%22>>, pp. 106-115.
Lee, et al., "Security Assertion Exchange for the Agent on the Semantic Web", In the Proceedings of the IADIS International Conference WWW/Internet, Madrid, Spain, 2 Volumes, Oct. 2004, pp. 302-308 (9 pgs.).
Li, et al., "A Practically Implementable and Tractable Delegation Logic", IEEE Symposium on Security and Privacy, May 2000, available at <<http://www.cs.purdue.edu/homes/ninghui/papers/dl—oakland00.pdf>>, pp. 27-42.
Li, et al., "A Practically Implementable and Tractable Delegation Logic", IEEE Symposium on Security and Privacy, May 2000, available at >, pp. 27-42.
Li, et al., "Datalog with Constraints: A Foundation for Trust Management Languages", Proc. PADL, Jan. 2003, available at <<http://www.cs.purdue.edu/homes/ninghui/papers/cdatalog-padl03.pdf#search=%22%22Datalog%20with%20Constraints%3A%20A%20Foundation%20For%20Trust%20Management%20Languages%22%22>>, pp. 58-73.
Li, et al., "Datalog with Constraints: A Foundation for Trust Management Languages", Proc. PADL, Jan. 2003, available at <<http://www.cs.purdue.edu/homes/ninghui/papers/cdatalog—padl03.pdf#search=%22%22Datalog%20with%20Constraints%3A%20A%20Foundation%20For%20Trust%20Management%20Languages%22%22>>, pp. 58-73.
Li, et al., "Design of a Role-Based Trust Management Framework", Proceedings of the 2002 IEEE Symposium on Security and Privacy, Feb. 2002, available at <<http://www.cs.purdue.edu/homes/ninghui/papers/rt-oakland02.pdf#search=%22%22Design%20of%20a%20Role-Based%20Trust%20Management%20Framework%22%22>>, pp. 114-130.
Li, et al., "Design of a Role-Based Trust Management Framework", Proceedings of the 2002 IEEE Symposium on Security and Privacy, Feb. 2002, available at <<http://www.cs.purdue.edu/homes/ninghui/papers/rt—oakland02.pdf#search=%22%22Design%20of%20a%20Role-Based%20Trust%20Management%20Framework%22%22>>, pp. 114-130.
Non-Final Office Action for U.S. Appl. 11/530,446, mailed on Sep. 15, 2011, Blair B. Dillaway, "Controlling the Delegation of Rights", 30 pages.
Non-Final Office Action for U.S. Appl. No. 11/530,443, mailed on May 26, 2011, Blair B. Dillaway, "Security Assertion Revocation", 15 pgs.
Notice of Allowance from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,439, mailed Aug. 23, 2010, 13 pages.
OASIS, "Bindings for the OASIS Security Assertion Markup Language (SAML) V2.0", OASIS Standard , Mar. 15, 2005, 46 pgs.
Office action for U.S. Appl. No. 11/530,429, mailed on Jan. 22, 2013, Dillaway et al., "Authorization Decisions with Principal Attributes", 23 pages.
Office action for U.S. Appl. No. 11/530,433, mailed on Jan. 17, 2013, Dillaway et al., "Fact Qualifiers in Security Scenarios", 29 pages.
Office Action for U.S. Appl. No. 11/530,564, mailed on Apr. 12, 2011, Moritz Becker, "Security Language Expressions for Logic Resolution", 8 pgs.
Office action for U.S. Appl. No. 11/530,564, mailed on Sep. 27, 2012, Becker et al., "Security Language Expressions for Logic Resolution", 14 pages.
Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,427, mailed Mar. 3, 2010, 23 pages.
Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,427, mailed on Aug. 20, 2010, 15 pages.
Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,429, mailed on Aug. 20, 2009, 16 pages.
Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,429, mailed on Jan. 19, 2011, 22 pages.
Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,433, mailed Mar. 1, 2009, 25 pages.
Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,433, mailed on Aug. 21, 2009, 16 pages.
Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,438, mailed May 20, 2010, 21 pages.
Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,438, mailed Oct. 29, 2010, 23 pages.
Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,439, mailed on Mar. 5, 2010, 20 pages.
Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,443, mailed on Jun. 1, 2010, 14 pages.
Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,446, mailed on Feb. 24, 2010, 19 pages.
Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,446, mailed on Jul. 30, 2010, 25 pages.
Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,543, mailed on Jul. 8, 2010, 9 pages.
Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,556, mailed on Aug. 23, 2010, 7 pages.
Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,564, mailed on Sep. 15, 2010, 8 pages.
Pfenning et al., "System Description: Twelf-A Meta-Logical Framework for Deductive Systems", Proc 16th Intl Conf on Automated Deduction, Jul. 1999, 5 pgs.
Pfenning et al., "System Description: Twelf—A Meta-Logical Framework for Deductive Systems", Proc 16th Intl Conf on Automated Deduction, Jul. 1999, 5 pgs.
Ribeiro, et al., "SPL: An Access Control Language for Security Policies with Complex Constraints", retrieved at <<http://www.gsd.inesc-id.pt/˜cnr/splii.pdf>>, IST/INESC, Network and Distributed System Security Symposium, Feb. 2001, pp. 1-22.
Ribeiro, et al., "SPL: An Access Control Language for Security Policies with Complex Constraints", retrieved at >, IST/INESC, Network and Distributed System Security Symposium, Feb. 2001, pp. 1-22.
Stoller, "Trust Management A Tutorial", Stony Brook University, State University of New York, May 2006, 118 pgs.
Translated Chinese Office Action mailed Jan. 26, 2011 for Chinese Patent Application No. 2007800333591, a counterpart foreign application for U.S. Appl. No. 11/530,446, 8 pages.
Translated Japanese Office Action mailed Dec. 7, 2012 for Japanese patent application No. 2009-527540, a counterpart foreign application of US patent No. 8,060,931, 4 pages.
Translated Japanese Office Action mailed Oct. 26, 2012 for Japanese patent application No. 2009-527586, a counterpart foreign application of US patent No. 8,201,215, 7 pages.
Wang et al., "Extending the Security Assertion Markup Language to Support Delegation for Web Services and Grid Services", IEEE Internation Conference on Web Services 2005, Orlando, Fl, Jul. 12-15, 2005, 8 pgs.
Whitehead et al., "By Reason and Authority: A System for Authorization of Proof-Carrying Code", IEEE Computer Secuirty Foundations Workshop (CSFW04) Jun. 2004, 15 pgs.
WO2008030876A1 (en) 2008-03-13 application
CA2859932A1 (en) 2008-03-13 application
US20080066175A1 (en) 2008-03-13 application
EP2078256A1 (en) 2009-07-15 application
EP2078256B1 (en) 2015-01-07 grant
CN102176226B (en) 2013-02-13 grant
US8060931B2 (en) 2011-11-15 grant
EP2078256A4 (en) 2011-03-02 application
US20120017263A1 (en) 2012-01-19 application
KR101366435B1 (en) 2014-02-21 grant
JP2010503123A (en) 2010-01-28 application
KR20090048489A (en) 2009-05-13 application
CN101512504B (en) 2011-08-03 grant
CN102176226A (en) 2011-09-07 application
EP2733638A1 (en) 2014-05-21 application
CA2657400A1 (en) 2008-03-13 application
CN101512504A (en) 2009-08-19 application
JP5266229B2 (en) 2013-08-21 grant
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:DILLAWAY, BLAIR B.;BECKER, MORITZ Y.;GORDON, ANDREW D.;AND OTHERS;SIGNING DATES FROM 20061011 TO 20061020;REEL/FRAME:026977/0176