System and method for network operation

US 20030233541A1
Filed: 06/14/2002
Published: 12/18/2003
Est. Priority Date: 06/14/2002
Status: Active Grant

First Claim

Patent Images

1. A system for supporting a distributed network of private resources, comprising:

a plurality of servers;

means permitting data communication between a user and each of the servers;

a plurality of user accounts hosted on each server;

a plurality of private resources stored on each server within each user account;

a plurality of realm names used to classify the private resources, the realm names spanning any number of user accounts;

means for a first user account to grant a second user account hosted on any of the servers a permission to access all private resources classified by a realm name, if the realm name was created by the first user account, or if the first user account had the right to grant such permission delegated to it.

View all claims

4 Assignments

Timeline View

Assignment View

0 Petitions

Accused Products

Abstract

A network of secure servers, requiring no central entity to administer user identities or access permissions. Each autonomous server hosts a set of user accounts. Users may link to and access the accounts of all other users in the network. Resources in accounts are private, but users may grant each other partial permissions to them. Links and permissions are independent of the location of accounts, and are cryptographically authenticated. Users may migrate their account between servers without loosing accumulated permissions, or breaking links that others have to their account. The ability to grant permissions may be delegated to reflect complex organizational structures. A permission may be configured to unlock data in a multitude of accounts. The system will support applications that require secure information sharing across multiple organizational boundaries, and provides a distributed security model which is feasible to deploy as it is wholly administered by its users.

164 Citations

30 Claims

1. A system for supporting a distributed network of private resources, comprising:
- a plurality of servers;
  
  means permitting data communication between a user and each of the servers;
  
  a plurality of user accounts hosted on each server;
  
  a plurality of private resources stored on each server within each user account;
  
  a plurality of realm names used to classify the private resources, the realm names spanning any number of user accounts;
  
  means for a first user account to grant a second user account hosted on any of the servers a permission to access all private resources classified by a realm name, if the realm name was created by the first user account, or if the first user account had the right to grant such permission delegated to it.
- View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13)
- - 2. The system of claim 1, wherein the user accounts are allocated a globally unique account identity, the account identity comprising a globally unique number and a public key from an asymmetric cryptographic key pair.
  - 3. The system of claim 2, wherein the network identities are generated autonomously by the servers, without involvement of any naming authority.
  - 4. The system of claim 2, wherein a temporary association is made between an account identity and the URL of the server that hosts it, such that the associations are communicable to the servers and verifiable by the servers.
  - 5. The system of claim 2, wherein the user accounts may migrate between the servers without relinquishing their account identity.
  - 6. The system of claim 1, wherein the permission is specified regardless of which server currently hosts the user accounts of the issuer and recipient of the permission.
  - 7. The system of claim 2, wherein the realm names are globally unique, being extensions of the globally unique name of the user account that creates the realm name.
  - 8. The system of claim 7, wherein the permission enables access to all the private resources classified by the realm name specified in the permission, irrespective of which user account uses the realm name to classify the private resources.
  - 9. The system of claim 1, wherein a right to grant the permission to the realm name may be delegated to other user accounts, the other user accounts exploiting this right by appending new permissions to their own permissions, to form a chain whose validity may be verified.
  - 10. The system of claim 9, wherein some or all permission grants have an expiration date and must be renewed to continue in effect, and a request for a copy of a renewed permission may be made to the servers hosting either the user account that issued the permission, or the user account that received the permission.
  - 11. The system of claim 10, wherein the request will fail if the user account that issued the permission has revoked the permission.
  - 12. The system of claim 11, wherein the request may be made anonymously, such that the validity of any chain of permissions may be confirmed by any server at any time.
  - 13. The system of claim 12, wherein the ongoing renewal of permissions is effected by an automated background process operating on each server.

14. A system for supporting a distributed network of private resources, comprising:
- a plurality of server software applications running on a plurality of first computers functioning as servers;
  
  a plurality of client software applications running on a plurality of second computers functioning as clients which may be the same as or different from the first computers, which client software applications can be used by users to establish sessions to send and receive data from server software applications;
  
  means permitting data communication between client software applications and each of the server software applications;
  
  a plurality of user accounts hosted on each server;
  
  a plurality of private resources stored on each server within each user account;
  
  a plurality of realm names used to classify the private resources, the realm names spanning any number of user accounts; and
  
  means for a first user account to grant a second user account hosted on any of the servers a permission to access all private resources classified by a realm name, if the realm name was created by the first user account, or if the first user account had the right to grant such permission delegated to it.

15. A system for supporting a network, comprising:
- a plurality of servers;
  
  means permitting data communication between a user and each of the servers;
  
  a plurality of user accounts hosted on each server;
  
  means for automatically generating for each user an account identifier that is globally unique in the network, which means constructs the globally unique account identifier without reference to existing global account identifiers already in use on the network;
  
  means for associating each account identifier with a location on one of the servers; and
  
  means for permitting transfer of a user account from one server to another while maintaining the same globally unique account identifier.
- View Dependent Claims (16)
- - 16. The system of claim 15, wherein the account identifier comprises a globally unique number and a public key from an asymmetric cryptographic key pair.

17. A system for maintaining contact information, comprising:
- a server;
  
  a network permitting data communication between the server and a number of electronic devices that maintain or use contact information; and
  
  a plurality of user accounts hosted on the server, each account containing a contact information listing current contact information for the associated user, and a contact list of identifiers for other users also having accounts on the server, which that user has selected.
- View Dependent Claims (18, 19, 20, 21)
- - 18. The system of claim 17, further comprising means for a first user account to grant a second user account permission to access the first user'"'"'s contact information.
  - 19. The system of claim 17, wherein the user controlled electronic devices are portable telephones enabled with client functionality.
  - 20. The system of claim 17, wherein the user controlled electronic devices are personal computers enabled with client functionality.
  - 21. The system of claim 17, wherein the system includes a plurality of servers, the network permits data communication between a client electronic device and each server, and user accounts are hosted on each server.

22. A method for supporting a distributed network of private resources, which comprises a server, means for transmitting data between the server and user controlled electronic devices, a plurality of user accounts hosted on each server, and a plurality of private resources stored on each server within each user account, comprising the steps of:
- designating a plurality of realm names used to classify the private resources, the realm names spanning one or more user accounts; and
  
  permitting a user account to grant another user account hosted on the server a permission to access all private resources classified by a realm name, if the realm name was created by the first user account.
- View Dependent Claims (23, 24)
- - 23. The method of claim 22, wherein the network comprises a plurality of servers having user accounts stored thereon and means for transmitting data to each of the servers, and the designating and permitting steps may be carried out on all of the servers.
  - 24. The method of claim 22, further comprising permitting a user account to grant another user account hosted on any of the servers a permission to access all private resources classified by a realm name if the first user account had the right to grant such permission delegated to it.

25. A method for maintaining user accounts in a network, which network includes a plurality of servers, means permitting data communication between a user and each of the servers, and a plurality of user accounts hosted on each server, which method comprises:
- automatically generating to each user an account identifier that is globally unique in the network by constructing the globally unique account identifier without reference to existing global identifiers already in use on the network;
  
  associating each account identifier with a location on one of the servers; and
  
  permitting transfer of a user account from one server to another while maintaining the same globally unique account identifier.
- View Dependent Claims (26)
- - 26. The method of claim 25, wherein the account identifier comprises a globally unique number and a public key from an asymmetric cryptographic key pair.

27. A method for maintaining contact information for a number of users having accounts on a network, the network comprising a number of client electronic devices that use contact information, a server on which the user accounts are hosted, and means permitting data communication between the server and the electronic devices, comprising the steps of:
- maintaining for each user account a listing of current contact information for the associated user; and
  
  maintaining a contact list of identifiers for persons also having accounts on the server which that user has selected, which contact list can be accessed by the electronic device used by that user.
- View Dependent Claims (28, 29, 30)
- - 28. The method of claim 27, further comprising permitting a user account to grant another user account permission to access that user'"'"'s contact information.
  - 29. The method of claim 27, wherein the electronic devices are telephones enabled with client functionality, and the contact information includes user telephone numbers.
  - 30. The method of claim 27, wherein the electronic devices are computers enabled with client functionality, and the contact information includes user telephone number and address information.

Specification

Resources

Litigation Campaign Assessment

Current Assignee
Secarta Limited
Original Assignee
Secarta Limited
Inventors
Rodgers, James, Green, Colin, Fowler, Stephan

Granted Patent

US 7,367,044 B2
Time in Patent Office

Days
Field of Search
US Class Current

713/155
CPC Class Codes

H04L 63/0442   wherein the sending and rec...

H04L 63/0823   using certificates cryptogr...

H04L 63/166   at the transport layer

H04L 9/3265   using certificate chains, t...

System and method for network operation

First Claim

4 Assignments

0 Petitions

Accused Products

Abstract

164 Citations

30 Claims

Specification

Solutions

Use Cases

Quick Links

System and method for network operation

First Claim

4 Assignments

Subscription Required

Subscription Required

0 Petitions

Subscription Required

Accused Products

Subscription Required

Abstract

164 Citations

30 Claims

Specification

Subscription Required

Solutions

Use Cases

Quick Links