US 2009/0022325 A1Published application

Access control protocol for embedded devices

AssigneeABB Research Ltd.

InventorMartin NAEDELE

Life of this patent

Estimating the term…

Loading patent…

Abstract

The client requests from the authentication and authorization server a capability for accessing the target server. The authentication and authorization server sends client a capability (capC,S) comprising the public key (pubC) of the client, said capability being signed with a private key (privAA) of the authentication and authorization server. The client sends the capability (capC,S) to the target server. If the capability is valid, the target server grants the client access and a data exchange session can be initiated. The disclosed protocol is scalable, as it does not require individual configuration of each target server device, allows revocation of user access within reasonable time, stores no compromisable secret data on any target server device, enables individual access permission per user, and accountability of each user.

Claims20

Dependent claims

Access control protocol for controlling access of a client to a plurality of target servers in a computer network system, the protocol comprising:

storing in an authentication and authorization server information (ACLs) about the access rights of the client to the plurality of target servers;
requesting, by the client, from the authentication and authorization server a capability for accessing a target server;
checking, by the authentication and authorization server, based on the information stored in the data storage (ACLs), whether and what extent of access to target server is to be granted to client, and if so, sending a capability (capC,S) to the client, —sending, by the client, the capability (capC,S) received from the authentication and authorization server to the target server;
verifying, by the target server, the validity of the capability (capC,S) as well as the identity of the client and, if the capability is valid and the client is identified, allowing the client to access the target server;
storing, by the client and the authentication and authorization server, in a respective data storage a private key (privC) and a public key (pubC) of the client;
and
sending, by the authentication and authorization server, a capability (capC,S) to client comprising the public key (pubC) of the client.

4 more elements

Dependencies are inferred from the claim text.