# US 10,122,708 B2 · Systems and methods for deployment of mission plans using access control technologies

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,122,708 B2
- Document ID: US10122708B2
- Status: Granted
- Kind: B2
- Application number: 14/086,431
- Filed: 2013-11-21
- Published: 2016-07-14
- Granted: 2018-11-06
- Earliest claimed: 2013-11-21
- Assignees: Harris Corporation
- Applicants: Harris Corporation
- Inventors: Wayne B. Smith; Margaret Knepper
- Web page: https://patentgrep.com/patent/US10122708B2

## CPC

- H04L 63/10: {for controlling access to devices or network resources}
- H04L 9/0877: {using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]}
- H04L 41/0894: Policy-based network configuration management
- H04L 41/12: Discovery or management of network topologies
- H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)}
- H04L 63/108: {when the policy decisions are valid for a limited amount of time}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 41/22: comprising specially adapted graphical user interfaces [GUI]
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Systems (100) and methods (1900) for configuring a computer network (“CN”). The methods comprise: receiving Access Control Information (“ACI”) input to a first network node (101-103, 105-107) by a user assigned to a mission; verifying that the user has a right to have access to the CN (100) based on the ACI; granting the user access to CN in response to the verifying; and obtaining Mission Related Information (“MRI”) by the first network node. The MRI is associated with the user and at least identifies a first mission plan (120) specifying a manner in which an assigned value for at least one first identity parameter is to be dynamically modified by at least one node (105-107, 113, 114) of CN. Thereafter, the first network node or a second network node (105-107, 113, 114) of CN is configured to operate in accordance with the first mission plan.

## Claims

### Claim 1

A method for configuring a computer network, the method comprising:
receiving first access control information input to a first network node of the computer network by a first user assigned to a first mission, said first access control information comprising user authentication information required for obtaining access to the first network node;
verifying that the first user of the first network node has a right to have access to the computer network based on the first access control information;
granting the first user access to the computer network in response to the verifying;
obtaining first mission related information by the first network node in response to the first user being granted access to the computer network, the first mission related information associated with the first user and at least identifying a first mission plan specifying a manner in which an assigned value for at least one first identity parameter is to be dynamically modified by at least one node of the computer network;
configuring the first network node or a second network node of the computer network to operate in accordance with the first mission plan during a first time period;
obtaining second mission related information based on second access control information input to the first network node by a second user; and
re-configuring the first network node or the second network node to operate in accordance with the second mission related information during a second time period, the second mission related information at least identifying a second mission plan that is different from the first mission plan;
wherein configuration and re-configuration of the first or second network node's mission specific operations are tied to at least one access control technique employed by the first or second network node.

### Claim 2 (depends on 1)

The method according to claim 1, wherein the first network node is a client computer capable of configuring the second network node so as to operate in accordance with the first mission plan.

### Claim 3 (depends on 1)

The method according to claim 1, wherein the first network node is a network device communicatively coupled to at least one client computer and configurable to operate in accordance with the first mission plan.

### Claim 4 (depends on 1)

The method according to claim 1, wherein the first access control information is input by the user via a user-software interaction or via a smart card reader.

### Claim 5 (depends on 1)

The method according to claim 1, wherein the first mission related information is obtained from a smart card.

### Claim 6 (depends on 5)

The method according to claim 5, wherein the first mission related information comprises at least one of an identifier of a mission for which the first mission plan was generated, an identifier of the first mission plan, an identifier of the first user, the first mission plan, and a cryptographic key for decrypting the first mission plan.

### Claim 7 (depends on 6)

The method according to claim 6, further comprising retrieving the first mission plan or at least configuration data of the first mission plan from a data store based on the first mission related information, where the data store is local to or remote from the first or second network node.

### Claim 8 (depends on 7)

The method according to claim 7, further comprising decrypting the first mission plan prior to configuring the computer network to operate in accordance therewith.

### Claim 9 (depends on 1)

The method according to claim 1, further comprising:
storing the first mission related information on a smart card when the first user is assigned to the first mission; and
storing second mission related information on the smart card when the first user is assigned to a second different mission, the second mission related information at least identifying a second mission plan specifying a manner in which an assigned value for at least one second identity parameter is to be dynamically modified by at least one node of the computer network.

### Claim 10 (depends on 1)

The method according to claim 1, further comprising:
terminating the first user's access to the computer network;
receiving the second access control information input to the first network node of the computer network by the second user assigned to the second mission;
verifying that the second user has a right to have access to the computer network based on the second access control information; and
granting the second user access to the computer network in response to the verifying;
wherein the second mission related information is associated with the second user and the second mission plan specifies a manner in which an assigned value for at least one second identity parameter is to be dynamically modified by at least one node of the computer network.

### Claim 11

A computer network, comprising:
a first network node operative to:
receive first access control information input by a first user assigned to a first mission, said first access control information comprising user authentication information required for obtaining access to the first network node;
verify that the first user of the first network node has a right to have access to the computer network based on the first access control information;
grant the first user access to the computer network in response to the verifying;
obtain first mission related information by the first network node in response to the first user being granted access to the computer network, the first mission related information associated with the first user and at least identifying a first mission plan specifying a manner in which an assigned value for at least one first identity parameter is to be dynamically modified by at least one node of the computer network;
configure the first network node or a second network node of the computer network to operate in accordance with the first mission plan;
obtain second mission related information based on second access control information input to the first network node by a second user; and
re-configuring the first network node or the second network node to operate in accordance with the second mission related information during a second time period, the second mission related information at least identifying a second mission plan that is different from the first mission plan;
wherein configuration and re-configuration of the first or second network node's mission specific operations are tied to at least one access control technique employed by the first or second network node.

### Claim 12 (depends on 11)

The computer network according to claim 11, wherein the first network node is a client computer capable of configuring the second network node so as to operate in accordance with the first mission plan.

### Claim 13 (depends on 11)

The computer network according to claim 11, wherein the first network node is a network device communicatively coupled to at least one client computer and configurable to operate in accordance with the first mission plan.

### Claim 14 (depends on 11)

The computer network according to claim 11, wherein the first access control information is input by the user via a user-software interaction or via a smart card reader.

### Claim 15 (depends on 11)

The computer network according to claim 11, wherein the first mission related information is obtained from a smart card.

### Claim 16 (depends on 15)

The computer network according to claim 15, wherein the first mission related information comprises at least one of an identifier of a mission for which the first mission plan was generated, an identifier of the first mission plan, an identifier of the first user, the first mission plan, and a cryptographic key for decrypting the first mission plan.

### Claim 17 (depends on 16)

The computer network according to claim 16, wherein the first network node is further operative to retrieve the first mission plan or at least configuration data of the first mission plan from a data store based on the first mission related information, where the data store is local to or remote from the first or second network node.

### Claim 18 (depends on 17)

The computer network according to claim 17, wherein the first mission plan is decrypted by the first network node or the smart card prior to when the first or second network node is configured to operate in accordance with the first mission plan.

### Claim 19 (depends on 11)

The computer network according to claim 11, further comprising a third network node operative to:
store the first mission related information on a smart card when the first user is assigned to the first mission; and
store second mission related information on the smart card when the first user is assigned to a second different mission, the second mission related information at least identifying a second mission plan specifying a manner in which an assigned value for at least one second identity parameter is to be dynamically modified by at least one node of the computer network.

### Claim 20 (depends on 11)

The computer network according to claim 11, wherein the first network node is further operative to:
terminate the first user's access to the computer network;
receive the second access control information input by the second user assigned to a second mission;
verify that the second user has a right to have access to the computer network based on the second access control information; and
grant the second user access to the computer network in response to the verifying;
wherein the second mission related information is associated with the second user and the second mission plan specifies a manner in which an assigned value for at least one second identity parameter is to be dynamically modified by at least one node of the computer network.