# US 7,610,616 B2 · Pervasive security mechanism by combinations of network and physical interfaces

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 7,610,616 B2
- Document ID: US7610616B2
- Status: Granted
- Kind: B2
- Application number: 10/943,143
- Filed: 2004-09-17
- Published: 2005-06-23
- Granted: 2009-10-27
- Earliest claimed: 2003-10-17
- Assignees: Fujitsu Limited
- Inventors: Ryusuke Masuouka; Narendar Shankar; Zhexuan Song; Wei-Iun Chen; Michael Grove; Yannis Labrou; Jonathan Russell Agre
- Web page: https://patentgrep.com/patent/US7610616B2

## CPC

- H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)}
- G06F 21/42: using separate channels for security data
- G06F 21/445: {by mutual authentication, e.g. between devices or programs}
- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS
- Y04S 40/20: Information technology specific aspects, e.g. CAD, simulation, modelling, system security
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- Y04S: SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS

## Abstract

Pervasive security is provided by a combination of physical interfaces and network interfaces to a service to a user includes establishing by the user's client device network connectivity to the service, transmitting by the service an identifier to the user's client device, determining by the service whether the user enters the identifier into the service in physical proximity to the service, and invoking the service once the user has entered the identifier into the service while in physical proximity to the service. The service can provide indication that the service has been granted by sending a control page to the user's client device.

## Claims

### Claim 1

A method of providing pervasive security by a combination of physical interfaces and network interfaces to a service to a user, comprising:
establishing by the user's client device network connectivity to the service;
generating and transmitting by the service a check-in phase credential to the user's client device, in response to the connectivity to the service;
determining by the service whether the user enters the generated check-in phase credential into the service in physical proximity to the service; and
invoking the service if the user has entered the generated check-in phase credential into the service in physical proximity to the service,
wherein the determining by the service determines whether the service is locked by another checked-in user and denies access of the service to the user if the service is locked by another user.

### Claim 2 (depends on 1)

The method as in claim 1, wherein the determining by the service comprises determining by the service whether the entered check-in phase credential of the user's client device is valid.

### Claim 3 (depends on 2)

The method as in claim 2, wherein the entered check-in phase credential comprises one or more of a bar code, a PIN, a pass phrase, a lease, a certificate, a key, and a biometric identifier.

### Claim 4 (depends on 3)

The method as in claim 3, wherein the biometric identifier comprising at least one of a fingerprint, an iris scan, vein identification, and facial identification.

### Claim 5 (depends on 2)

The method as in claim 2, wherein the check-in phase credential is provided to the user's client device by the service upon check-in by the user's client device to the network and is revoked by the network upon check-out from the service.

### Claim 6 (depends on 2)

The method as in claim 2, wherein the user's client device is denied access to the service if the check-in credential is not valid.

### Claim 7 (depends on 2)

The method as in claim 2, wherein the accesses by the user to the service are tracked by the service.

### Claim 8 (depends on 1)

The method as in claim 1, further comprising allocating a time slice of the service to the user's client device if the user's client device is permitted access to the service.

### Claim 9 (depends on 1)

The method as in claim 1, further comprising issuing by the service to the user's client device a lease for usage of the service.

### Claim 10 (depends on 9)

The method as in claim 9, wherein the lease is valid for the duration of usage by the user's client device.

### Claim 11 (depends on 10)

The method as in claim 10, wherein the lease is valid for a fixed duration.

### Claim 12 (depends on 9)

The method as in claim 9, wherein the lease is renewable by continued usage by the user's client device.

### Claim 13 (depends on 1)

The method as in claim 1, further comprising instructing by the service to the user's client device input of information to enable usage of the service by the user's client device.

### Claim 14

The method as in 13, wherein the usage of the service by the user's client device is unrestricted once the information is input.

### Claim 15 (depends on 9)

The method as in claim 9, wherein the service comprising use of a networked service device for displaying information.

### Claim 16 (depends on 15)

The method as in claim 15, wherein the displaying comprising display information on a computer screen.

### Claim 17 (depends on 15)

The method as in claim 15, wherein the displaying comprising displaying information by a projector.

### Claim 18 (depends on 17)

The method as in claim 17, wherein the information comprising a map.

### Claim 19 (depends on 15)

The method as in claim 15, further comprising printing the information on a printer.

### Claim 20 (depends on 1)

The method as in claim 1, further comprising providing service-level security to the pervasive computer system, the service-level security comprising a security released mode in which the service will accept and provide service to any IP address invoking the service, and a security enforcement mode in which the service will accept and provide service based upon the input of a valid identifier related to the IP address of the client device.

### Claim 21 (depends on 1)

The method as in claim 1, wherein the determining by the service comprising determining whether a user is in physical proximity to the service by requiring input of a generated check-in phase PIN as the generated check-in phase credential on an input device coupled to a networked service device providing the service.

### Claim 22 (depends on 1)

The method of claim 1, wherein the invoking of the service provides a control panel function for the service on the client's user device permitting access to the service.

### Claim 23 (depends on 1)

The method of claim 1, further comprising providing a physical embodiment of the service by one of more servers and one or more networked service devices.

### Claim 24 (depends on 1)

The method of claim 1, further comprising:
requesting, by the client device, the service,
sending, by the service, a generated check-in phase PIN to the client device as the generated check-in phase credential,
inputting, by the user operator of the client device, the generated check-in phase PIN into an input device for the service in physical proximity to the service,
sending, by the service, a control page to the client device, and
accessing, by the user, the service through the client device.

### Claim 25

A computer-readable medium storing a program which when executed by a computer, causes the computer to provide pervasive security by a combination of network and physical interfaces to a service to a user including the functions comprising:
establishing by the user's client device network connectivity to the service;
generating and transmitting by the service a check-in phase credential to the user's client device, in response to the connectivity to the service;
determining by the service whether the user enters the generated check-in phase credential into the service in physical proximity to the service; and
invoking the service if the user has entered the generated check-in phase credential into the service in physical proximity to the service,
wherein the determining by the service determines whether the service is locked by another checked-in user and denies access of the service to the user if the service is locked by another user.

### Claim 26 (depends on 25)

The medium as in claim 25, wherein the determining by the service comprises determining by the service whether the entered check-in phase credential of the user's client device is valid.

### Claim 27 (depends on 26)

The medium as in claim 26, wherein the entered check-in phase credential comprises one or more of a bar code, a PIN, a pass phrase, a lease, a certificate, a key, and a biometric identifier.

### Claim 28 (depends on 27)

The medium as in claim 27, wherein the biometric identifier comprising at least one of a fingerprint, an iris scan, vein identification, and facial identification.

### Claim 29 (depends on 26)

The medium as in claim 26, wherein the check-in phase credential is provided to the user's client device by the service upon check-in by the user's client device to the service, and is revoked by the pervasive security network upon check-out from the service.

### Claim 30 (depends on 26)

The medium as in claim 26, wherein the user's client device is denied access to the service if the check-in credential is not valid.

### Claim 31 (depends on 26)

The medium as in claim 26, wherein the accesses by the user to the service are tracked by the service.

### Claim 32 (depends on 25)

The medium as in claim 25, further comprising allocating a time slice of the service to the user's client device if the user's client device is permitted access to the service.

### Claim 33 (depends on 25)

The medium as in claim 25, further comprising issuing by the service to the user's client device a lease for usage of the service.

### Claim 34 (depends on 33)

The medium as in claim 33, wherein the lease is valid for the duration of usage by the user's client device.

### Claim 35 (depends on 34)

The medium as in claim 34, wherein the lease is valid for a fixed duration.

### Claim 36 (depends on 33)

The medium as in claim 33, wherein the lease is renewable by continued usage by the user's client device.

### Claim 37 (depends on 25)

The medium as in claim 25, further comprising instructing by the service to the user's client device input of information to enable usage of the service by the user's client device.

### Claim 38 (depends on 37)

The medium as in claim 37 wherein the usage of the service by the user's client device is unrestricted once the information is input.

### Claim 39 (depends on 33)

The medium as in claim 33, wherein the service comprising displaying information.

### Claim 40 (depends on 39)

The medium as in claim 39, wherein the displaying comprising display information on a computer screen.

### Claim 41 (depends on 39)

The medium as in claim 39, wherein the displaying comprising displaying information by a projector.

### Claim 42 (depends on 41)

The medium as in claim 41, wherein the information comprising a map.

### Claim 43 (depends on 39)

The medium as in claim 39, further comprising printing the information on a printer.

### Claim 44 (depends on 25)

The medium as in claim 25, further comprising providing service-level security to the pervasive computer system, the service-level security comprising a security released mode in which the service will accept and provide service to any IP address invoking the service, and a security enforcement mode in which the service will accept and provide service based upon the input of a valid identifier.

### Claim 45 (depends on 25)

The medium as in claim 25, wherein the determining by the service comprising determining whether a user is in physical proximity to the service by requiring input of a generated PIN as the generated check-in phase credential on an input device coupled to a networked service device providing the service.

### Claim 46

A pervasive computer system providing a service, comprising:
mean for determining whether the service is locked by another user and denying access of the service to the user if the service is locked by another user;
means for inputting a check-in phase credential to a service in physical proximity to the service;
means for authenticating the check-in phase credential;
means for authorizing use of the service based on the authentication of the check-in phase credential; and
means for providing invisible security to the pervasive computer system using at least one of a check-in/check-out function and a leasing function.

### Claim 47 (depends on 46)

The system as in claim 46, wherein the means for inputting comprising at least one of a keypad, keyboard, and biometric input.

### Claim 48 (depends on 46)

The system as in claim 46, wherein the check-in phase credential comprises one or more of a key, a certificate, a PIN, a pass phrase, and smart token.

### Claim 49 (depends on 46)

The system as in claim 46, wherein the means for authenticating comprising authenticating the check-in phase credential by the service prior to the service being invoked.

### Claim 50 (depends on 46)

The system as in claim 46, wherein the means for authorizing comprising authorizing by the service the use of the service by a user corresponding to the check-in phase credential prior to invoking the service.

### Claim 51 (depends on 46)

The system as in claim 46, wherein the means for providing invisible security comprising check-in/check-out, lease architecture, and device scheduling.

### Claim 52 (depends on 1)

The method as in claim 1, further comprising:
establishing, by the user's client device, connectivity to the networked service;
interacting, by the user's client device, with the networked service;
accepting, by the user's client device, commands from the user; and
communicating, by the user's client device, to the user the check-in phase credential and the control page provided by the service.

### Claim 53 (depends on 1)

The method as in claim 1, wherein the user's client device comprising one of a mobile computing device including a cell phone, a personal digital assistant (PDA), and a laptop computer.

### Claim 54 (depends on 1)

The method of claim 1, further comprising connecting the user's client device to the network using a wireless connection.