Source: http://www.google.fr/patents/US8225378
Timestamp: 2017-11-19 14:28:36
Document Index: 645299705

Matched Legal Cases: ['art 1', 'application No. 07841896', 'application No. 07842186', 'application No. 07842066', 'application No. 2009', 'Application No. 200780033322', 'application No. 200780033359', 'Application No. 200780033359']

Brevet US8225378 - Auditing authorization decisions - Google Brevets
The auditing of authorization decisions is facilitated by integrating or coupling an audit policy to access control decisions. In an example implementation, an audit policy of an auditing scheme is coupled to a semantic framework of an access control scheme such that the audit policy is specified using...http://www.google.fr/patents/US8225378?utm_source=gb-gplus-shareBrevet US8225378 - Auditing authorization decisions
Numéro de publication US8225378 B2
Numéro de demande US 12/902,892
Date de priorité 8 sept. 2006
Autre référence de publication US7814534, US20080066146, US20110030038
Numéro de publication 12902892, 902892, US 8225378 B2, US 8225378B2, US-B2-8225378, US8225378 B2, US8225378B2
Inventeurs Blair B. Dillaway
Citations de brevets (118), Citations hors brevets (123), Référencé par (3), Classifications (13), Événements juridiques (2)
Auditing authorization decisions
US 8225378 B2
an auditing scheme module, stored in the memory and executable on the processor; and
an access control scheme module, stored in the memory and executable on the processor, that is integrated with the auditing scheme module, wherein
the access control scheme module makes authorization decisions in response to access requests for resources, the authorization decisions including inputs, outputs, and internal data, and
the auditing scheme module includes an audit policy that comprises audit policy rules, the audit policy rules including audit content rules that:
specify what audit information from any of the inputs, the outputs, or the internal data is to be included in an audit record, and
specify logical deduction data used or produced during evaluation algorithms of the authorization decisions, the logical deduction data comprising proof graphs indicating respective logical chains of deductions that occur within the evaluation algorithms.
2. The device as recited in claim 1, wherein the audit content rules utilize a semantic framework that is utilized by the access control scheme for making the authorization decisions.
3. The device as recited in claim 1, wherein the audit content rules further specify inputs to the authorization decisions in terms of logical assertions.
4. The device as recited in claim 3, wherein the audit content rules further specify the internal data of the authorization decisions in terms of logical deductions derived from the logical assertions.
5. The device as recited in claim 1, wherein the audit policy rules further include audit trigger rules that specify when the audit record is to be generated and added to an audit log.
6. The device as recited in claim 5, wherein the audit trigger rules further specify that the audit record is to be generated and added to the audit log responsive to access requests involving a particular authorization decision result, a particular targeted resource, a particular requested action, and/or a particular operation on a particular resource.
receiving an access request for a resource by an access control scheme;
performing by the access control scheme, at least partly in response to the access request, an authorization decision for the resource, the authorization decision comprising inputs, outputs, and internal data;
specifying, by an auditing scheme, an audit policy comprising audit policy rules, the audit policy rules including audit content rules that specify what audit information from any of the inputs, the outputs, or the internal data is to be included in an audit record, and specify logical deduction data used or produced during an evaluation algorithm of the authorization decision, the logical deduction data comprising a proof graph indicating a logical chain of deductions that occur within the evaluation algorithm; and
recording, by the auditing scheme, the audit record based at least in part on the specified audit policy.
8. The system as recited in claim 7, wherein the audit content rules utilize a semantic framework that is utilized by the access control scheme for performing the authorization decision.
9. The system as recited in claim 7, wherein the audit content rules further specify inputs to the authorization decision in terms of logical assertions.
10. The system as recited in claim 9, wherein the audit content rules further specify the internal data of the authorization decision in terms of logical deductions derived from the logical assertions.
11. The system as recited in claim 7, wherein the audit policy rules further include audit trigger rules that specify when the audit record is to be generated and added to an audit log.
12. The system as recited in claim 11, wherein the audit trigger rules further specify that the audit record is to be generated and added to the audit log responsive to access requests involving a particular authorization decision result, a particular targeted resource, a particular requested action, and/or a particular operation on a particular resource.
one or more processors executing following computer-readable instructions:
receiving an access request for a resource;
performing, at least partly in response to the access request, an authorization decision for the resource, the authorization decision comprising inputs, outputs, and internal data;
specifying, an audit policy comprising audit policy rules, the audit policy rules including audit content rules that specify what audit information from any of the inputs, the outputs, or the internal data is to be included in an audit record and specify logical deduction data used or produced during an evaluation algorithm of the authorization decision, wherein the logical deduction data comprises a proof graph indicating a logical chain of deductions that occur within the evaluation algorithm, and the audit content rules comprise a semantic framework; and
recording the audit record based at least in part on the specified audit policy.
14. The computer-implemented method as recited in claim 13, wherein the audit content rules specify inputs to the authorization decision in terms of logical assertions and internal data of the authorization decision in terms of logical deductions derived from the logical assertions.
15. The computer-implemented method as recited in claim 13, wherein the audit policy rules further include audit trigger rules that specify when the audit record is to be generated and added to an audit log, and wherein the audit trigger rules further specify that the audit record is to be generated and added to the audit log responsive to access requests involving a particular authorization decision result, a particular targeted resource, a particular requested action, and/or a particular operation on a particular resource.
This application is a continuation of and claims the benefit of priority of U.S. patent application Ser. No. 11/530,439, filed on Sep. 9, 2006, the disclosure of which is incorporated by reference herein.
Auditing is desirable in modern computing systems, including distributed systems. Distributed systems in particular usually involve complex interactions between multiple entities. They also have many potential failure points. Auditing provides a mechanism for collecting information about those interactions so that one can later review authorized interactions, attempts to engage in unauthorized interactions, malicious attacks against the system, combinations thereof, and so forth.
US5214702 13 mai 1992 25 mai 1993 Fischer Addison M Public key/signature cryptosystem with enhanced digital signature certification
US5649099 4 juin 1993 15 juil. 1997 Xerox Corporation Method for delegating access rights through executable access control program without delegating access rights not in a specification to any intermediary nor comprising server security
US6216231 25 avr. 1997 10 avr. 2001 At & T Corp. Specifying security protocols and policy constraints in distributed systems
US6256734 8 oct. 1999 3 juil. 2001 At&T Method and apparatus for compliance checking in a trust management system
US6256741 13 oct. 2000 3 juil. 2001 At&T Corp. Specifying security protocols and policy constraints in distributed systems
US6367009 17 déc. 1998 2 avr. 2002 International Business Machines Corporation Extending SSL to a multi-tier environment using delegation of authentication and authority
US6484261 11 déc. 1998 19 nov. 2002 Cisco Technology, Inc. Graphical network security policy management
US6779120 7 janv. 2000 17 août 2004 Securify, Inc. Declarative language for specifying a security policy
US6895503 31 mai 2001 17 mai 2005 Contentguard Holdings, Inc. Method and apparatus for hierarchical assignment of rights to documents and documents having such rights
US7127605 10 mai 2000 24 oct. 2006 Axalto, Inc. Secure sharing of application methods on a microcontroller
US7260715 9 déc. 1999 21 août 2007 Koninklijke Philips Electronics N.V. Method and apparatus for revocation list management
US7290138 19 févr. 2003 30 oct. 2007 Microsoft Corporation Credentials and digitally signed objects
US7426635 28 juin 2001 16 sept. 2008 Entrust Technologies Limited Bulk certificate lifetime allocation systems, components and methods
US7506364 1 oct. 2004 17 mars 2009 Microsoft Corporation Integrated access authorization
US7509489 11 mars 2005 24 mars 2009 Microsoft Corporation Format-agnostic system and method for issuing certificates
US7512782 15 août 2002 31 mars 2009 Microsoft Corporation Method and system for using a web service license
US7543140 26 févr. 2003 2 juin 2009 Microsoft Corporation Revocation of a certificate and exclusion of other principals in a digital rights management (DRM) system based on a revocation list from a delegated revocation authority
US7644284 24 avr. 2001 5 janv. 2010 Stuart Gerald Stubblebine Specifying security protocols and policy constraints in distributed systems
US7823192 1 avr. 2004 26 oct. 2010 Sprint Communications Company L.P. Application-to-application security in enterprise security services
US7844610 25 mai 2004 30 nov. 2010 Google Inc. Delegated authority evaluation system
US20010018675 9 févr. 2001 30 août 2001 Blaze Matthew A. Method and apparatus for compliance checking in a trust-management system
US20020109707 17 janv. 2002 15 août 2002 Guillermo Lao Method and apparatus for managing digital content usage rights
US20020184160 31 mai 2001 5 déc. 2002 Bijan Tadayon Method and apparatus for assigning conditional or consequential rights to documents and documents having such rights
US20020184517 31 mai 2001 5 déc. 2002 Bijan Tadayon Method and apparatus for hierarchical assignment of rights to documents and documents having such rights
US20030083877 23 sept. 2002 1 mai 2003 Asgent, Inc. Electronic equipment setting information creating method and apparatus, and security policy creating method and associated apparatus
US20030110192 21 mars 2002 12 juin 2003 Luis Valente PDstudio design system and method
US20030115292 * 24 oct. 2002 19 juin 2003 Griffin Philip B. System and method for delegated administration
US20030120955 6 janv. 2003 26 juin 2003 Lucent Technologies Inc. Method and apparatus for managing a firewall
US20030149714 26 oct. 2001 7 août 2003 Fabio Casati Dynamic task assignment in workflows
US20030225697 * 30 mai 2002 4 déc. 2003 Microsoft Corporation Method, system, and apparatus for providing secure access to a digital work
US20030229781 5 juin 2002 11 déc. 2003 Fox Barbara Lynch Cryptographic audit
US20040024764 * 18 juin 2003 5 févr. 2004 Jack Hsu Assignment and management of authentication & authorization
US20040034770 15 août 2002 19 févr. 2004 Microsoft Corporation Method and system for using a web service license
US20040034774 15 août 2002 19 févr. 2004 Le Saint Eric F. System and method for privilege delegation and control
US20040064707 30 sept. 2002 1 avr. 2004 Mccann Peter James Streamlined service subscription in distributed architectures
US20040068757 9 sept. 2003 8 avr. 2004 Heredia Edwin Arturo Digital signatures for digital television applications
US20040122958 19 déc. 2002 24 juin 2004 International Business Machines Corporation Method and system for peer-to-peer authorization
US20040123154 22 juil. 2003 24 juin 2004 Alan Lippman System and method for validating security access across network layer and a local file layer
US20040128393 31 déc. 2002 1 juil. 2004 International Business Machines Corporation Method and system for consolidated sign-off in a heterogeneous federated environment
US20040128546 31 déc. 2002 1 juil. 2004 International Business Machines Corporation Method and system for attribute exchange in a heterogeneous federated environment
US20040139352 15 janv. 2003 15 juil. 2004 Shewchuk John P. Uniformly representing and transferring security assertion and security response information
US20040162985 19 févr. 2003 19 août 2004 Freeman Trevor W. Credentials and digitally signed objects
US20040181665 12 mars 2004 16 sept. 2004 Houser Daniel D. Trust governance framework
US20040221174 29 avr. 2003 4 nov. 2004 Eric Le Saint Uniform modular framework for a host computer system
US20040243811 21 avr. 2004 2 déc. 2004 France Telecom Electronic signature method with a delegation mechanism, and equipment and programs for implementing the method
US20040243835 28 mai 2004 2 déc. 2004 Andreas Terzis Multilayer access control security system
US20040250112 15 juin 2004 9 déc. 2004 Valente Luis Filipe Pereira Declarative language for specifying a security policy
US20050015586 18 juil. 2003 20 janv. 2005 Brickell Ernie F. Revocation distribution
US20050033813 29 avr. 2004 10 févr. 2005 International Business Machines Corporation Collaborative email with delegable authorities
US20050055363 5 oct. 2001 10 mars 2005 Mather Andrew Harvey System for storing and retrieving data
US20050066198 2 sept. 2004 24 mars 2005 Gelme Andrew A. Controlling cooperation between objects in a distributed software environment
US20050071280 25 sept. 2003 31 mars 2005 Convergys Information Management Group, Inc. System and method for federated rights management
US20050079866 30 sept. 2002 14 avr. 2005 Tianwei Chen Verifying check-in authentication by using an access authentication token
US20050080766 9 oct. 2003 14 avr. 2005 Ghatare Sanjay P. Partitioning data access requests
US20050097060 7 juin 2004 5 mai 2005 Lee Joo Y. Method for electronic commerce using security token and apparatus thereof
US20050108176 30 avr. 2004 19 mai 2005 Jarol Scott B. Configurable rules based content item consumption
US20050132220 10 déc. 2003 16 juin 2005 International Business Machines Corporation Fine-grained authorization by authorization table associated with a resource
US20050138357 1 oct. 2004 23 juin 2005 Sony Corporation Rendering rights delegation system and method
US20050187877 22 avr. 2005 25 août 2005 Contentguard Holding, Inc. Method and apparatus for hierarchical assignment of rights to documents and documents having such rights
US20050188072 20 févr. 2004 25 août 2005 Microsoft Corporation Policy application across multiple nodes
US20050220304 27 mai 2003 6 oct. 2005 Koninklijke Philips Electronics N.V. Method for authentication between devices
US20060005010 16 juin 2004 5 janv. 2006 Henrik Olsen Identification and authentication system and method for a secure data exchange
US20060005227 1 juil. 2004 5 janv. 2006 Microsoft Corporation Languages for expressing security policies
US20060015728 14 juil. 2004 19 janv. 2006 Ballinger Keith W Establishment of security context
US20060026667 30 juil. 2004 2 févr. 2006 Bhide Manish A Generic declarative authorization scheme for Java
US20060041421 17 août 2004 23 févr. 2006 Contentguard Holdings, Inc. Method and system for processing grammar-based legality expressions
US20060041929 20 oct. 2005 23 févr. 2006 Microsoft Corporation Virtual distributed security system
US20060048216 21 juil. 2004 2 mars 2006 International Business Machines Corporation Method and system for enabling federated user lifecycle management
US20060101521 17 oct. 2002 11 mai 2006 Shlomo Rabinovitch System and method for secure usage right management of digital products
US20060106856 4 nov. 2004 18 mai 2006 International Business Machines Corporation Method and system for dynamic transform and load of data from a data source defined by metadata into a data store defined by metadata
US20060129817 14 déc. 2005 15 juin 2006 Borneman Christopher A Systems and methods for enabling trust in a federated collaboration
US20060136990 16 déc. 2004 22 juin 2006 Hinton Heather M Specializing support for a federation relationship
US20060156391 11 janv. 2005 13 juil. 2006 Joseph Salowey Method and apparatus providing policy-based revocation of network security credentials
US20060195690 28 févr. 2005 31 août 2006 Microsoft Corporation Extendable data-driven system and method for issuing certificates
US20060200664 7 mars 2005 7 sept. 2006 Dave Whitehead System and method for securing information accessible using a plurality of software applications
US20060206707 11 mars 2005 14 sept. 2006 Microsoft Corporation Format-agnostic system and method for issuing certificates
US20060206925 11 mars 2005 14 sept. 2006 Microsoft Corporation Delegating right to access resource or the like in access management system
US20060206931 * 14 mars 2005 14 sept. 2006 Microsoft Corporation Access control policy engine controlling access to resource based on any of multiple received types of security tokens
US20060225055 3 mars 2005 5 oct. 2006 Contentguard Holdings, Inc. Method, system, and device for indexing and processing of expressions
US20060230432 8 avr. 2005 12 oct. 2006 Microsoft Corporation Policy algebra and compatibility model
US20060236382 1 avr. 2005 19 oct. 2006 Hinton Heather M Method and system for a runtime user account creation operation within a single-sign-on process in a federated computing environment
US20060242075 27 avr. 2006 26 oct. 2006 Intertrust Technologies Corp. Trusted infrastructure support systems, methods and techniques for secure electronic commerce, electronic transactions, commerce process control and automation, distributed computing and rights management
US20060242162 21 avr. 2005 26 oct. 2006 Conner Michael H Web services response templates
US20060242688 * 22 avr. 2005 26 oct. 2006 Microsoft Corporation Supporting statements for credential based access control
US20060259776 13 mai 2005 16 nov. 2006 Microsoft Corporation Extensible account authentication system
US20070006284 29 juin 2005 4 janv. 2007 Research In Motion Limited System and method for privilege management and revocation
US20070043607 22 août 2005 22 févr. 2007 Raytheon Company Method to incorporate user feedback into planning with explanation
US20070055887 25 oct. 2006 8 mars 2007 Microsoft Corporation Digital Identity Management
US20070056019 23 août 2005 8 mars 2007 Allen Paul L Implementing access control policies across dissimilar access control platforms
US20070061872 14 sept. 2005 15 mars 2007 Novell, Inc. Attested identities
US20070143835 19 déc. 2005 21 juin 2007 Microsoft Corporation Security tokens including displayable claims
US20070169172 17 janv. 2006 19 juil. 2007 International Business Machines Corporation Method and system for memory protection and security using credentials
US20070199059 14 févr. 2005 23 août 2007 Masahiro Takehi System, method and program for user authentication, and recording medium on which the program is recorded
US20070283411 2 juin 2006 6 déc. 2007 Microsoft Corporation Abstracting security policy from, and transforming to, native representations of access check mechanisms
US20070300285 21 juin 2006 27 déc. 2007 Microsoft Corporation Techniques for managing security contexts
US20080066158 8 sept. 2006 13 mars 2008 Microsoft Corporation Authorization Decisions with Principal Attributes
US20080066159 8 sept. 2006 13 mars 2008 Microsoft Corporation Controlling the Delegation of Rights
US20080066160 11 sept. 2006 13 mars 2008 Microsoft Corporation Security Language Expressions for Logic Resolution
US20080066169 8 sept. 2006 13 mars 2008 Microsoft Corporation Fact Qualifiers in Security Scenarios
US20080066175 8 sept. 2006 13 mars 2008 Microsoft Corporation Security Authorization Queries
US20080127320 30 sept. 2005 29 mai 2008 Paolo De Lutiis Method and System For Transparently Authenticating a Mobile User to Access Web Services
US20080172721 24 févr. 2005 17 juil. 2008 Jong Hyouk Noh Internet Access Time Control Method Using Authentication Assertion
US20090126022 25 nov. 2005 14 mai 2009 Nec Corporation Method and System for Generating Data for Security Assessment
WO2008030876A1 5 sept. 2007 13 mars 2008 Microsoft Corporation Security authorization queries
WO2008031043A1 7 sept. 2007 13 mars 2008 Microsoft Corporation Controlling the delegation of rights
1 "ContentGuard", eXtensible rights Markup Language (XrML) 2.0 Specificaton Part II: Core Schema, 2001, available at www.xrml.org.
2 "OASIS", eXtensible Access Control Markup Language (XACML) Version 2.0 Core Specification, 2005, accessed on Sep. 27, 2006 at <<www.oasis-open.org/committees/xacml/>>, 6 pages.
3 "OASIS", eXtensible Access Control Markup Language (XACML) Version 2.0 Core Specification, 2005, accessed on Sep. 27, 2006 at >, 6 pages.
4 "OASIS, Security Assertion Markup Language (SAML)", accessed on Sep. 27, 2006 from <<www.oasis-open.org/committees/security>>, 8 pages.
5 "OASIS, Security Assertion Markup Language (SAML)", accessed on Sep. 27, 2006 from >, 8 pages.
6 "RFC 3280—Internet X.409 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", IETF, retrieved on Sep. 22, 2006 from <<http://www.faqs.org/rfcs/rfc3280.html>>, Apr. 2002, 8 pages.
7 "RFC 3280-Internet X.409 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", IETF, retrieved on Sep. 22, 2006 from >, Apr. 2002, 8 pages.
8 "Security Assertion Markup Language (SAML) 2.0 Technical Overview", OASIS, Working Draft 01, Jul. 22, 2004, pp. 1-36.
9 Abadi, "Logic in Access Control," Proceedings 18th Annual IEEE Symposium on Logic in Computer Science, Jun. 22-25, 2003, Ottawa, Ontario, Canada, pp. 228-233.
10 Advisory Action for U.S. Appl. No. 11/530,427, mailed on Sep. 26, 2011, Blair B. Dillaway, "Variable Expressions in Security Assertions," 4 pages.
11 Advisory Action for U.S. Appl. No. 11/530,433, mailed on Sep. 27, 2011, Blair B. Dillaway, "Fact Qualifiers in Security Scenarios," 3 pages.
12 Ardagna, et al., "XML-based Access Control Languages ", retrieved at <<http://seclab.dti.unimi.it/Papers/RI-3.pdf>>, Universita degli Studi di Milano, Italy, pp. 1-14, 2004.
13 Ardagna, et al., "XML-based Access Control Languages ", retrieved at <<http://seclab.dti.unimi.it/Papers/Ri-3.pdf>>, Universita degli Studi di Milano, Italy, pp. 1-14, Information Security Tech. Report, Jul. 2004.
14 Ardagna, et al., "XML-based Access Control Languages ", retrieved at >, Universita degli Studi di Milano, Italy, pp. 1-14, 2004.
15 Ardagna, et al., "XML-based Access Control Languages ", retrieved at >, Universita degli Studi di Milano, Italy, pp. 1-14, Information Security Tech. Report, Jul. 2004.
16 Becker et al., "SecPAL: Design and Semantics of a Decentralized Authorization Language—Technical Report MSR-TR-2006-120," Sep. 1, 2006, Microsoft Research, Cambridge, UK, retrieved from the Internet at <<http://courses.cs.vt.edu/cs5204/fall10-kafura-NVC/Papers/Security/SecPal-Reference.pdf>> on Dec. 21, 2011, 46 pages.
17 Becker et al., "SecPAL: Design and Semantics of a Decentralized Authorization Language-Technical Report MSR-TR-2006-120," Sep. 1, 2006, Microsoft Research, Cambridge, UK, retrieved from the Internet at > on Dec. 21, 2011, 46 pages.
18 Becker, et al., "Cassandra: Distributed Access Control Policies with Tunable Expressiveness", IEEE 5th International Workshop on Policies for Distributed Systems and Networks, 2004, pp. 159-168.
19 Becker, et al., "Cassandra: Flexible Trust Management, Applied to Electronic Health Records", IEEE Computer Security Foundations Workshop, 2004, pp. 139-154.
20 Bindings for the OASIS Security Assertion Markup Language (SAML) V2.0, OASIS Standard, Mar. 15, 2005.
21 Bindings for the OASIS Security Assertion Markup Language (SSML) V2.0, OASIS Standard , Mar. 15, 2005.
22 Blaze, et al., "Decentralized Trust Management", IEEE Symposium on Security and Privacy, 1996, pp. 164-173.
23 Blaze, et al., "The Role of Trust Management in Distributed Systems Security", Secure Internet Programming, 1999, pp. 185-210.
24 Blaze, et al.,"The Role of Trust Management in Distributed Systems Security", Secure Internet Programming, 1999, pp. 185-210.
25 Cederquist et al., "An Audit Logic for Accountability", IEEE, 2005, pp#1-pp#10.
26 Chadwick, "An Authorisation Interface for the GRID", In the Proceedings of the E-Science All Hands Meeting, Nottingham, Sep. 2003, 14 pgs.
27 Chen et al., "Tabled Evaluations with Delaying for General Logic Programs," Journal of the ACM, vol. 43, No. 1, Jan. 1996, pp. 20-74.
28 ContentGuard, "eXtensibe rights Markup Language (XrML) 2.0 Specification Part 1: Primer," Nov. 20, 2001, pp. 1-39.
29 Dai et al., "Logic Based Authorization Policy Engineering", 2001, pp#1-pp#9.
30 Damianou, et al., "Ponder: A Language for Specifying Security and Management Policies for Distributed Systems", retrieved at <<http://www.doc.ic.ac.uk/˜ncd/policies/files/PonderSpec.pdf>>, Imperial College of Science, Technology and Medicine, London, U.K, Oct. 20, 2000, pp. 1-49.
31 Damianou, et al., "Ponder: A Language for Specifying Security and Management Policies for Distributed Systems", retrieved at >, Imperial College of Science, Technology and Medicine, London, U.K, Oct. 20, 2000, pp. 1-49.
32 DeTreville, "Binder, A Logic-Based Security Language", IEEE Symposium on Security and Privacy, 2002, pp. 105-113.
33 Ellison, et al., "RFC 2693—SPKI Certificate Theory", available at <<http://www.ietf.org/rfc/rfc2693.txt>>, accessed on Sep. 27, 2006, 38 pages.
34 Ellison, et al., "RFC 2693-SPKI Certificate Theory", available at >, accessed on Sep. 27, 2006, 38 pages.
35 Erdos, et al., "Shibboleth-Architecture", Draft Version 4, Nov. 2001, 39 pgs.
36 European Office Action mailed Dec. 22, 2011 for European patent application No. 07841896.9, a counterpart foreign application of US patent No. 8,060,931, 4 pages.
37 Extended European Search Report mailed Jan. 18, 2012 for European patent application No. 07842186.4, 9 pages.
38 Extended European Search Report mailed Jul. 22, 2011 for European patent application No. 07842066.8, 8 pages.
39 Farrell et al., "Assertions and Protocols for the OASIS Security Assertion Markup Language (SAML) V2.0", OASIS Open, 2004, Aug. 2004, pp#1-pp#87.
40 Farrell et al., "Assertions and Protocols for the OASIS Security Assertion Markup Language (SAML) V2.0", OASIS Open, Aug. 2004, pp#1-pp#87.
41 Final Office Action for U.S. Appl. No. 11/530,427, mailed on Jun. 29, 2011, Blair B. Dillaway, "Variable Expressions in Security Assertions," 23 pages.
42 Final Office Action for U.S. Appl. No. 11/530,429, mailed on Jul. 8, 2011, Blair B. Dillaway, "Authorization Decisions with Principal Attributes," 23 pages.
43 Final Office Action for U.S. Appl. No. 11/530,433, mailed on Jul. 8, 2011, Blair B. Dillaway, "Fact Qualifiers in Security Scenarios," 20 pages.
44 Geuer-Pollmann et al., "Web Services and Web Service Security Standards," Elsevier Advanced Technology Publications, Journal of Information Security Technology Report, Jan. 2005, vol. 10, Issue 1, pp. 15-24.
45 Haidar et al., "An Extended RBAC Profile of XACML," In the Proceedings of the 3rd ACM Workshop on Secure Web Services, 2006, pp. 13-22.
46 Hallam-Baker et al., "Web Services Security: SAML Token Profile", OASIS Open, Sep. 23, 2002, pp#1-pp#25.
47 Hallam-Barker, "Security Assertion Markup Language Straw-man Architecture", VeriSign, 2001, Feb. 16, 2001, pp#1-pp#17.
48 Halpern, et al., "Using First-Order Logic to Reason About Policies", IEEE Computer Security Foundations Workshop, 2003, available at <<http://arxiv.org/PS—cache/cs/pdf/0601/0601034.pdf>>, pp. 187-201.
49 Halpern, et al., "Using First-Order Logic to Reason About Policies", IEEE Computer Security Foundations Workshop, 2003, available at >, pp. 187-201.
50 Hughes et al., "Security Assertion Markup Language (SAML) 2.0 Technical Overview", OASIS, 2004, pp#1-pp#36.
51 * J. G. Cederquist et al, "An Audit Logic for Accountability", pp. 1-10, IEEE, 2005.
52 Japanese Office Action mailed Jan. 24, 2012 for Japanese patent application No. 2009-527617, a counterpart foreign application of U.S. Appl. No. 11/530,556, 14 pages.
53 Jim, "SD3: A Trust Management System with Certified Evaluation", Proceedings of the 2001 IEEE Symposium on Security and Privacy, 2001, available at <<http://www.research.att.com/~trevor/papers/JimOakland2001.pdf#search=%22%22SD3%3A%20A%20Trust%20Management%20System%20with%20Certified%20Evaluation%22%22>>, pp. 106-115.
54 Jim, "SD3: A Trust Management System with Certified Evaluation", Proceedings of the 2001 IEEE Symposium on Security and Privacy, 2001, available at <<http://www.research.att.com/˜trevor/papers/JimOakland2001.pdf#search=%22%22SD3%3A%20A%20Trust%20Management%20System%20with%20Certified%20Evaluation%22%22>>, pp. 106-115.
55 * John DeTreville, "Binder, a logic-based security language", pp. 1-9, IEEE, 2002.
56 * John Hughes et al, Security Assertion Markup Language (SAML) 2.0 Technical Overview, pp. 1-36, OASIS, 2004.
57 Kagal et al., "Trust-Based Security in Pervasive Computing Environments," IEEE Computer, Dec. 1, 2011, vol. 34, No. 12, pp. 154-157.
58 Keoh et al., "Towards Flexible Credential Verification in Mobile Ad-hoc Networks", ACM 2002, POMC '02, Oct. 30-31, 2002, pp#58-pp#65.
59 Lee, et al., "Security Assertion Exchange for the Agent on the Semantic Web", In the Proceedings of the IADIS International Conference WWW/Internet, Madrid, Spain, 2 Volumes, 2004, pp. 302-308 (9 pgs.).
60 Li, et al. "A Practically Implementable and Tractable Delegation Logic", IEEE Symposium on Security and Privacy, 2000, available at <<http://www.cs.purdue.edu/homes/ninghui/papers/dl—oakland00.pdf>>, pp. 27-42.
61 Li, et al. "A Practically Implementable and Tractable Delegation Logic", IEEE Symposium on Security and Privacy, 2000, available at >, pp. 27-42.
62 Li, et al., "Datalog with Constraints: A Foundation for Trust Management Languages", Proc. PADL, 2003, available at <<http://www.cs.purdue.edu/homes/ninghui/papers/cdatalog-pad103.pdf#search=%22%22Datalog%20with% 20Constraints%3A%20A%20Foundation%20For%20Trust%20Management%20Languages%22%22>>, pp. 58-73.
63 Li, et al., "Datalog with Constraints: A Foundation for Trust Management Languages", Proc. PADL, 2003, available at <<http://www.cs.purdue.edu/homes/ninghui/papers/cdatalog—pad103.pdf#search=%22%22Datalog%20with% 20Constraints%3A%20A%20Foundation%20For%20Trust%20Management%20Languages%22%22>>, pp. 58-73.
64 Li, et al., "Datalog with Constraints: A Foundation For Trust Management Languages", Proc. PADL, 2003, available at <<http://www.cs.purdue.edu/homes/ninghui/papers/cdatalog-padl03.pdf#search=%22%22Datalog%20with%20Constraints%3A%20A%20Foundation%20For%20Trust%20Management%20Languages%22%22>>, pp. 58-73.
65 Li, et al., "Datalog with Constraints: A Foundation For Trust Management Languages", Proc. PADL, 2003, available at <<http://www.cs.purdue.edu/homes/ninghui/papers/cdatalog—padl03.pdf#search=%22%22Datalog%20with%20Constraints%3A%20A%20Foundation%20For%20Trust%20Management%20Languages%22%22>>, pp. 58-73.
66 Li, et al., "Design of a Role-Based Trust Management Framework", Proceedings of the 2002 IEEE Symposium on Security and Privacy, 2002, available at <<http://www.cs.purdue.edu/homes/ninghui/papers/rt-oakland02.pdf#search=%22%22Design%20of%20a%20Role-Based%20Trust%20Management%20Framework%22%22>>, pp. 114-130.
67 Li, et al., "Design of a Role-Based Trust Management Framework", Proceedings of the 2002 IEEE Symposium on Security and Privacy, 2002, available at <<http://www.cs.purdue.edu/homes/ninghui/papers/rt—oakland02.pdf#search=%22%22Design%20of%20a%20Role-Based%20Trust%20Management%20Framework%22%22>>, pp. 114-130.
68 Navarro et al., "Constrained delegation in XML-based Access Control and Digital Right Management Standards", Communication, Network and Information Security 2003, pp#1-pp#6.
69 Non-Final Office Action for U.S. Appl. No. 11/530,443, mailed on May 26, 2011, Blair B. Dillaway, "Security Assertion Revocation".
70 Non-Final Office Action for U.S. Appl. No. 11/530,443, mailed on May 26, 2011, Blair B. Dillaway, "Security Assertion Revocation," 15 pages.
71 Non-Final Office Action for U.S. Appl. No. 11/530,446, mailed on Sep. 15, 2011, Blair B. Dillaway, "Controlling the Delegation of Rights," 30 pages.
72 Notice of Allowance from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,438, mailed Apr. 4, 2011, 8 pages.
73 Notice of Allowance from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,438, mailed Apr. 4, 2011, Blair Dillaway, "Security Authorization Queries," 8 pages.
74 Notice of Allowance from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,439, mailed Aug. 23, 2010, 22 pages.
75 Office Action for U.S. Appl. No. 11/530,564, mailed on Apr. 12, 2011, Moritz Becker, "Security Language Expressions for Logic Resolution".
76 Office Action for U.S. Appl. No. 11/530,564, mailed on Apr. 12, 2011, Moritz Becker, "Security Language Expressions for Logic Resolution," 8 pages.
77 Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,427, mailed Mar. 3, 2010, 26 pages.
78 Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,427, mailed on Aug. 20, 2010, 23 pages.
79 Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,427, mailed on Dec. 23, 2010, 33 pages.
80 Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,429, mailed on Aug. 20, 2009, 24 pages.
81 Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,429, mailed on Jan. 19, 2011, 34 pgs.
82 Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,429, mailed on Mar. 2, 2010, 21 pages.
83 Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,433 mailed on Jan. 18, 2011, 35 pages.
84 Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,433 mailed on Jan. 18, 2011, Blair B. Dillaway, "Security Assertion Revocation," 35 pages.
85 Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,433, mailed Mar. 1, 2009, 26 pages.
86 Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,433, mailed on Aug. 21, 2009, 24 pages.
87 Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,438, mailed May 20, 2010, 35 pages.
88 Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,438, mailed Oct. 29, 2010, 31 pages.
89 Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,439, mailed on Mar. 5, 2010, 32 pages.
90 Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,443, mailed Dec. 7, 2010, 21 pgs.
91 Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,443, mailed on Jun. 1, 2010, 30 pages.
92 Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,446 mailed on Feb. 3, 2011, 35 pages.
93 Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,446 mailed on Feb. 3, 2011, Blair B. Dillaway, "Controlling the Delegation of Rights," 35 pages.
94 Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,446, mailed on Feb. 24, 2010, 30 pages.
95 Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,446, mailed on Jul. 30, 2010, 29 pages.
96 Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,543, mailed on Dec. 27, 2010, 17 pgs.
97 Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,543, mailed on Jul. 8, 2010, 12 pages.
98 Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,556 mailed on Feb. 4, 2011, 8 pages.
99 Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,556 mailed on Feb. 4, Moritz Becker, "Security Language Translations with Logic Resolution," 2011, 8 pages.
100 Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,556, mailed on Aug. 23, 2010, 14 pages.
101 Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,556, mailed on Aug. 23, 2010, 14pages.
102 Office Action from the U.S. Patent and Trademark Office for U.S. Appl. No. 11/530,564, mailed on Sep. 15, 2010, 17 pages.
103 * Peter Chapin et al, "Risk Assessment in Distributed Authorization", pp. 33-41, ACM, 2005.
104 Pfenning et al., "System Description: Twelf-A Meta-Logical Framework for Deductive Systems", 1999, pp#1-pp#5.
105 Pfenning et al., "System Description: Twelf—A Meta-Logical Framework for Deductive Systems", 1999, pp#1-pp#5.
106 Pimlott et al., "Soutei, a Logic-Based Trust-Management System," Functional and Logic Programming, 8th International Symposium, FLOPS 2006 Proceedings, LNCS 3945, Apr. 24-26, 2006, pp. 130-145.
107 Ribeiro, et al., "SPL: An access control language for security policies with comples constraints", retrieved at <<http://www.gsd.inesc-id.pt/˜cnr/splii.pdf>>, IST/INESC, Portugal, pp. 1-22, 1999.
108 Ribeiro, et al., "SPL: An access control language for security policies with comples constraints", retrieved at <<http://www.gsd.inesc-id.pt/˜cnr/splii.pdf>>, IST/INESC, Portugal, pp. 1-22.
109 Ribeiro, et al., "SPL: An access control language for security policies with comples constraints", retrieved at >, IST/INESC, Portugal, pp. 1-22, 1999.
110 Ribeiro, et al., "SPL: An access control language for security policies with comples constraints", retrieved at >, IST/INESC, Portugal, pp. 1-22.
111 Rivest, et al., "SDSI—A Simple Distributed Security Infrastructure", available at <<http://theory.lcs.mit.edu/˜rivest/sdsi10.ps>>, Apr. 30, 1996, pp. 1-37.
112 Rivest, et al., "SDSI-A Simple Distributed Security Infrastructure", available at >, Apr. 30, 1996, pp. 1-37.
113 Stoller, "Trust Management A Tutorial", Stony Brook University, State University of New York, May 2006, pp#1-pp#118.
114 Translated Chinese Notice of Grant of Patent Right for Invention mailed Mar. 25, 2011 for Chinese Patent Application No. 200780033322.4 a counterpart foreign application for U.S. Appl. No. 11/530,438, 4 pages.
115 Translated Chinese Office Action mailed Aug. 25, 2011 for Chinese patent application No. 200780033359.7, a counterpart foreign application of U.S. Appl. No. 11/530,446, 15 pages.
116 Translated Chinese Office Action mailed Jan. 26, 2011 for Chinese Patent Application No. 200780033359.7, a counterpart foreign application for U.S. Appl. No. 11/530,446.
117 Upadhyay et al., "Generic Security Service API Version 2: Java Bindings Update: draft-ietf-kitten-rfc2853bis-01.txt," IETF Standard-Working-Draft, Internet Engineering Task Force, IETF, CH, vol. kitten, No. 1, Jan. 27, 2006, 102 pages.
118 Wainer et al., "A Fine-Grained, Controllable, User-to-User Delegatino Method in RBAC," Proceedings of the Tenth ACM Symposium on Access Control Models and Technologies, SACMAT, Jan. 1, 2005, 8 pages.
119 Wang et al., "Extending the Security Assertion Markup Language to Support Delegation for Web Services and Grid Services", IEEE Internation Conference on Web Services 2005, Orlando, Fl, Jul. 12-15, 2005, pp#1-pp#8.
120 Whitehead et al., "By Reason and Authority: A System for Authorization of Proof-Carrying Code", IEEE Computer Secuirty Foundations Workshop (CSFW'04) 2004, pp#1-pp#15.
121 Wu, et al., "Evaluation of Authorization-Authentication Tools: PERMIS, OASIS, EACML, and SHIBOLETH", Technical Report CS-TR-935, University of Newcastle upon Tyne, 2005.
122 Wu, et al., "Evaluation of Authorization-Authentication Tools: PERMIS, OASIS, XACML, and SHIBOLETH", Technical Report CS-TR-935, University of Newcastle upon Tyne, 2005.
123 Yin et al., "A Rule-based Framework for Role0based Constrained Delegation," Proceedings of the 3rd International Conference on Information Security, INFOSECU, Jan. 1, 2004, pp. 186-191.
US20130317990 * 6 mai 2013 28 nov. 2013 Institutional Cash Distributors Technology, Llc Secure transaction object creation, propagation and invocation
Classification aux États-Unis 726/4, 713/155, 726/2, 726/5, 726/3, 717/117, 713/185, 726/1, 726/14
Classification coopérative G06F21/6218, G06F2221/2101