US 7,353,384 B2 · Collapsing chained credentials

Abstract

An intermediate entity can generate a necessary credential to allow two other entities to bypass the intermediate entity when establishing communications between two other entities in a computing system represented by either a directed or an undirected graph. The intermediate entity receives credentials for communications links between itself and each of the other two entities. The intermediate entity also receives a chaining parameter associated with the intermediate entity. With the two credentials and the chaining parameter, the intermediate entity can compute a necessary credential to allow communication between the other two entities. In addition, the intermediate entity can compute the necessary credential independent of a security manager during the computation operation.

Claims22

Dependent claims

A computer program storage medium encoding a computer program for executing on a computer system a computer process for generating a computed credential for establishing a communications link between a first node (Ni) and a second node (Nk) in a computing system, wherein the computing system includes at least the first node (Ni), the second node (Nk), and a third node (Ni), the computer process comprising:

receiving a first credential for establishing a communications link between the third node (Nj) and the first node (Ni), wherein the first credential includes (pirj2)e mod N, wherein e is a public exponent, N is a public modulus, pi is a random prime number associated with the first node (Ni) and privately stored by a security manager, and rj is a random prime number associated with the third node (Nj) and privately stored by the security manager, such that N−1/3e<pi, rj<N−1/3;
receiving a second credential for establishing a communications link between the third node (Nj) and the second node (Nk);
receiving a chaining parameter associated with the third node (Nj);
computing the computed credential for establishing the communications link between the first node (Ni) and the second node (Nk) based on the first credential, the second credential, and the chaining parameter;
and
sending the computed credential to the first node (Ni) to allow the first node (Ni) to access the second node (Nk).

3 more elements

A method of generating a computed credential for establishing a communications link between a first node (Ni) and a second node (Nk) in a computing system, wherein the computing system includes at least the first node (Ni), the second node (Nk), and a third node (Nj), the method comprising:

receiving a first credential for establishing a communications link between the third node (Nj) and the first node (Ni), the first credential including (pirj2)e mod N, wherein e is a public exponent, N is a public modulus, pi is a random prime number associated with the first node and privately stored by a security manager, and rj is a random prime number associated with the third node and privately stored by the security manager, such that N−1/3e<pi, rj<N−1/3;
receiving a second credential for establishing a communications link between the third node (Nj) and the second node (Nk);
receiving a chaining parameter associated with the third node (Nj);
and
computing the computed credential for establishing the communications link between the first node (Ni) and the second node (Nk) based on the first credential, the second credential, and the chaining parameter;
and
sending the computed credential to the first node (Ni) to allow the first node (Ni) to access the second node (Nk).

4 more elements

Dependencies are inferred from the claim text.

Collapsing chained credentials

Life of this patent

Collapsing chained credentials

Life of this patent

Abstract

Claims22