Trusted internet identity
AssigneeMicrosoft Corporation
InventorsTodd L. Carpenter, David Steeves, David Abzarian
Life of this patent
Estimating the term…
Abstract
A token or other storage device uses Internet identities to set file access attribute rights. Subsequently, requests to access a file can be controlled by confirming the Internet identity of the requestor by either validating the request with a known public key or retrieving the public key from an Internet identity provider. Files may be stored encrypted and may be re-encrypted with the public key associated with Internet identity making the request.
Claims20
A removable storage token that is removably couplable to a user computing device and supports file access control, the removable storage token comprising:
- a processor;
- a secure memory storing at least one private key and executable code for use by the processor;
- a general-use memory storing one or more files;
- a first bus coupling the processor, secure memory, and the general-use memory;
- a second bus for removably coupling the removable storage token to the user computing device;
- a storage management module executable by the processor for assigning access control rights to the one or more files stored in the general-use memory;
- a communication module for execution by the processor for parsing a request for access to a particular one of the files stored in the general-use memory into a file identifier and a credential;
- and
- a request module executable by the processor for determining when the credential includes a valid Internet identifier corresponding to an access control right assigned to the particular file stored in the general-use memory, and wherein user access to the particular file is provided using the private key.
A method of performing file access control comprising:
- receiving, at a user computer, a request to access a file from a user of the user computer, the file being stored local to the user computer;
- acquiring an Internet identity of the user;
- sending, over a network from the user computer, a confirmation request to an Internet identity provider that is distinct from the user computer;
- receiving, from the Internet identity provider, a credential in response to the confirmation request;
- determining if the credential matches the Internet identity;
- and
- providing access to the file when the credential matches the Internet identity.
A storage token couplable to a computing device and supporting file access control, the storage token comprising:
- a processor;
- a general-use memory storing at least one user file;
- a secure memory storing executable code for use by the processor to support file access control for the user file stored in the general-use memory;
- a storage management module configured to assign access control rights to the user file stored in the general-use memory;
- a communication module configured to parse a request for access to the user file stored in the general-use memory into an identifier that identifies the user file and a credential;
- and
- a request module configured to determine when the credential includes a valid Internet identifier corresponding to an access control right assigned to the user file, wherein access to the user file is provided based on the determination.
A removable storage token supporting file access control, the storage token comprising:
- a processor;
- a secure memory;
- a general-use memory;
- a cryptographic processor;
- a first bus coupling the processor, the general-use memory, and the cryptographic processor, wherein the secure memory is accessible via the cryptographic processor;
- a second bus for removably coupling the removable storage token to a computing device;
- a storage management module executable by the processor for assigning access control rights to data stored in the general-use memory;
- a communication module for execution by the processor for parsing a request for access to the general-use memory into a file identifier and a credential;
- and
- a request module executable by the processor for determining when the credential includes a valid Internet identifier corresponding to an assigned access control right.
Dependencies are inferred from the claim text.