US 10,833,873 B2Granted

Credential-based authorization

AssigneeInternational Business Machines Corporation

InventorsJan Camenisch, Daniel Kovacs, Kai Samelin, Dieter M. Sommer

Life of this patent

Estimating the term…

Loading patent…

Abstract

Methods and systems are provided for demonstrating authorization to access a resource to a verifier computer controlling access to the resource. The method comprises, at a user computer, storing an attribute credential certifying a set of attributes; and communicating with a revocation authority computer to obtain an auxiliary credential, bound to the attribute credential, certifying a validity status for each attribute in the attribute credential. The method further comprises, at the user computer, communicating with the verifier computer to prove possession of the attribute credential and the auxiliary credential such that the verifier computer can determine whether at least one attribute in the attribute credential, certified as valid by the auxiliary credential, satisfies an access condition for the resource.

Claims14

Dependent claims

A method, comprising:

receiving, at a revocation authority computer, notification from an issuer computer of issuance of an attribute credential, the receiving comprising receiving for the attribute credential a credential identification and an attribute specification, where the attribute specification lists a plurality of attributes certified in the attribute credential;
generating and storing, by the revocation authority computer, revocation data comprising, for each attribute in the attribute specification, validity status data indicating whether a corresponding attribute is valid or invalid, wherein the validity status data for all attributes are initially set as valid, but wherein the validity status data can be updated at any time in response to notification from the issuer computer that an attribute is no longer valid;
receiving, at the revocation authority computer from a user computer that provides the credential identification, a request for issue of an auxiliary credential corresponding to the attribute credential, wherein the auxiliary credential is cryptographically bound to the attribute credential;
determining by the revocation authority computer an auxiliary credential, wherein the auxiliary credential certifies a validity status for each attribute in the attribute credential and certifies, for each attribute of the plurality of attributes, validity status data indicating whether that attribute is valid or invalid, and wherein, through use of the auxiliary credential, attributes in the attribute credential can be revoked individually, leaving-one or more other attributes in the attribute credential still valid, without requiring reissue of the attribute credential as a whole;
and
providing, in response to the request, by the revocation authority computer the determined auxiliary credential to the user computer.

3 more elements

A method, comprising:

communicating, between a verifier computer and a user computer, to prove possession by the user computer of an attribute credential and an auxiliary credential to determine whether at least one other attribute of one or more other attributes in a plurality of attributes of the attribute credential, certified as valid by the auxiliary credential, satisfies an access condition for a resource for which access to the resource is controlled by the verifier computer, wherein the auxiliary credential is cryptographically bound to the attribute credential, wherein the auxiliary credential certifies a validity status for each attribute in the attribute credential using validity status data indicating whether, for each attribute of the plurality of attributes, that attribute is valid or invalid, and wherein, through use of the auxiliary credential, attributes in the attribute credential can be revoked individually, leaving the one or more other attributes in the attribute credential still valid, without requiring reissue of the attribute credential as a whole;
and
performing by the verifier computer one of the following:
permitting access to the resource in response to the verifier computer determining the access condition is satisfied;
or denying access to the resource in response to the verifier computer determining the access condition is not satisfied.

2 more elements

An apparatus, comprising:

a memory having computer-readable code thereon;
and
one or more processors, the one or more processors, in response to retrieval and execution of the computer-readable code, causing the apparatus to perform operations comprising:
communicating, between a verifier computer and a user computer, to prove possession by the user computer of an attribute credential and an auxiliary credential to determine whether at least one other attribute of one or more other attributes in a plurality of attributes of the attribute credential, certified as valid by the auxiliary credential, satisfies an access condition for a resource for which access to the resource is controlled by the verifier computer, wherein the auxiliary credential is cryptographically bound to the attribute credential, wherein the auxiliary credential certifies a validity status for each attribute in the attribute credential using validity status data indicating whether, for each attribute of the plurality of attributes, that attribute is valid or invalid, and wherein, through use of the auxiliary credential, attributes in the attribute credential can be revoked individually, leaving the one or more other attributes in the attribute credential still valid, without requiring reissue of the attribute credential as a whole;
and
performing by the verifier computer one of the following:
permitting access to the resource in response to the verifier computer determining the access condition is satisfied;
or denying access to the resource in response to the verifier computer determining the access condition is not satisfied.

5 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/666,539Filed 29 Oct 2019 · continuation
Priority: 9 Jun 2016
Published: US 2020/0067716 A127 Feb 2020
Granted: 10 Nov 2020
Term ends: Not estimatedThe source records don’t support an estimate.

Classification7 codes

H04L 9/3263
Including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity…:…
H04L 9/14
Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols: using a plurality of keys…
H04L 9/30
Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols: public key, i.e.…
H04L 9/3268
Involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements: using…

Family

Application15/177,391Parent of this continuation · filed 9 Jun 2016
US 2020/0067716 A1Pre-grant publication · published 27 Feb 2020
US 10,560,274 B2Parent of this continuation
US 2017/0359184 A1Published application
US 10,833,873 B2This patent

From the US filing history. Foreign family members aren’t listed.