CN1960255A - Distributed access control method in multistage securities - Google Patents
Distributed access control method in multistage securities Download PDFInfo
- Publication number
- CN1960255A CN1960255A CN 200610116301 CN200610116301A CN1960255A CN 1960255 A CN1960255 A CN 1960255A CN 200610116301 CN200610116301 CN 200610116301 CN 200610116301 A CN200610116301 A CN 200610116301A CN 1960255 A CN1960255 A CN 1960255A
- Authority
- CN
- China
- Prior art keywords
- user
- role
- territory
- certificate
- resource
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Landscapes
- Storage Device Security (AREA)
Abstract
PKI technique offers corresponding ID verification and info encryption mechanism. The resource description sign restricts the resource access under relative separate condition. The log module records the related user access info and system security info. The user uses his own ID card to log in the trust domain and gains the authentication server's trust. The user and the authentication server reach a bidirectional authentication connection. After verifying ID, the user may ask an access request against a certain resource. The final judgment corresponding to this request is depended on the judgment function of the user role attribution certification (AC), the domain strategy AC and the inter-domain strategy AC. At the same time, the related important system log records are stored into the database for future review. In this invention, the access situation in the system is log-recorded in real time. Thus the system security can be well analyzed.
Description
Technical field
What the present invention relates to is the control method in a kind of network security technology field, specifically is a kind of distributed access control method in multistage securities.
Background technology
Increasing distributed system has appearred in develop rapidly and widespread usage along with Internet and distributed object technology.Owing to the promotion of technology such as ecommerce and supply chain, working in coordination with between system also becomes very general simultaneously, and this also impels the scale of distributed system to become increasing, and complexity is more and more stronger.Whom entity in the distributed system allows use, and allows how to use and who defines service regeulations, the access control problem in the distributed system that Here it is.Make distributed system fully and safely bring into play its effect, cooperate safely between system, a kind of access control method is efficiently realized the first step of its application.
Access control is meant the different granted access that some control strategy of main body basis or authority are carried out object itself or its resource.Traditional access control model, as autonomous access control DAC (Discretionary AccessControl) model, the visit system RBAC model based on the role of forcing access control MAC (Mandatory Access Control) model and proposing recently operates mainly in the system of centralized security control.
Corresponding problem in distributed:
What time following distributed multi-stage safe access control technology must be considered in conjunction with the basis of original central access control:
(1) how to carry out the checking of identity and the interoperability of safety between multiple domain
(2) how to realize the exchanging visit of resource effectively
Through retrieval, do not find identical with theme of the present invention or similar bibliographical information as yet to prior art.The control method in network security technology field
Summary of the invention
The objective of the invention is to overcome deficiency of the prior art, a kind of distributed access control method in multistage securities is provided.Make it make full use of method in the centralized safe access control system, consider the difference between the same trust domain of distributed environment and different trust domain, the framework of whole distributed security access control has been proposed, and provide and provide concrete implementation step under this framework, and the role who is applied to therein is privately owned, the conversion of inheriting and shining upon, the model of the foundation of corresponding security log.
The present invention is achieved by the following technical solutions, the present invention provides corresponding authentication and information encryption mechanism by the PKI technology, the relation the between-authority by RBAC technology and PMI technological constraint user--role--, retrain resource access under the relative dispersion condition by resource descriptor, note down corresponding user access information and system safety information by log pattern.The present invention is for a plurality of trust domain in the practical application, the user lands this trust domain by the letter of identity that uses oneself, after obtaining the trust of certificate server, playing two-way authentication with certificate server is connected: the user can propose the access request to a certain resource after determining one's identity: the pairing final judging result of this access request is by three kinds of attribute certificate (user role Attribute certificates, the domain policy Attribute certificate, policy attribute certificate between the territory) decision function decides, into database is noted down in simultaneously corresponding important system daily record, convenient inspection in the future.
Comprise following concrete steps:
1. the system bidirectional authentication mechanism allows requesting party and response side all determine the other side's identity, and whether authentication server will be verified the signature and the term of validity of user certificate and be cancelled.If certificate is legal, can information extraction from certificate, as certificate serial number, user name etc. enter next step, connect otherwise disconnect.No matter whether checking is passed through, and the system journal module all will write database with access request and court verdict.The information that checking back both sides transmit is effectively encrypted.
2. the user creates user object as visiting the resource in this territory according to the sequence number of public key certificate, generates a session id, and the inquiry ldap server by retrieval user role-certificate storehouse, obtains all roles of this user.Enter next step user as visiting the resource in other territories, the user role Attribute certificate of oneself should be provided, territory safety management person checks whether Attribute certificate is effective, the request of invalid then refusal.To obtain " tactful certificate between the territory " between territory, user place and the access domain with time domain safety management person, if do not have interoperation relation between two territories, refusing user's request then, on the contrary carry out role's mapping, with this territory role-map role that is other territories.
3. territory safety management person checks user object, and the role that this user is assigned with returns to the user, creates a session object for the user simultaneously.
4. the user selects the role of own needs according to oneself requirement from some roles that territory safety management person returns, and selected role is sent back to territory safety management person.
5. territory safety management person access domain policy attribute certificate obtains all sub-roles of role that the user requires, structure character object.System checks character object, see and whether satisfy role's constraints, session object is checked, after guaranteeing that the role added session object, can not activate the role of two mutual exclusions simultaneously, if there is no the mutual exclusion role then adds session object with the role, carry out next step, otherwise the request of refusing user's.
6. territory safety management person makes up permission object.Can obtain all authorities of user in conjunction with character object and permission object.System carries out binding character inspection to permission object, obtains all lawful authorities of this user.
7. lawful authority collection that this user is authorized to and desired authority set compare, if the former comprises the latter, then allow its visit to resource, otherwise refuse its access resources.Visit is closed session free system resources after finishing.
Whole access control step still corresponding to the relation of the role-map between the territory, should add certain authority restriction as shown above, and the role-security that is mapped to this territory in other territories is limited within certain scope.That is: Privilege (being mapped to this territory role)<Privilege (this territory user uses this role).This is applied among the improved RBAC too, is not whole authorities of inheriting father role fully this model system neutron role, but herids partially, allows father role to have the privately owned authority of oneself like this.Correspond to equally in the distributed access control, be not the authority of inheriting mapping role in this accessed territory fully by the role of shining upon between the territory, but herid partially, can well protect the safety of resource information in the accessed territory like this.
Effect of the present invention is significant, make in this way the distributed security access control system of design merge the PKI of current trend, PMI, RBAC technology, high performance ldap servers etc. have been showed a kind of access process of distributed security access control system to the user.Simultaneously, by increasing " domain policy Attribute certificate, policy attribute certificate between the territory ", original safety access control method well is applied in the distributed access control system from concentrate the territory by role-map.
Description of drawings
Fig. 1 is an improved RBAC model structure schematic diagram in the system of the present invention.
Fig. 2 is a mapping constraint process schematic diagram between the territory of RBAC+PMI in the system of the present invention.
Embodiment
Present embodiment is implemented the hardware environment of employing: server: Tomcat is more than 5.0, and the JAVA environment is supported JAAS, and client hardware requires: Windows 2000/XP, and more than the Pentium 2400Mhz, 256 MB of memory is connected with the network of server; Client software: IE browser.
Dispose:
1., in each trust domain, build the authentication server of this trust domain, be deployed on the Tomcat, in each trust domain, dispose ldap server, comprising following database:
A. subscriber identity information database (PKI certificate information table, etc.)
B. Attribute certificate database (PMI certificate information table, policy mappings table in the territory, policy mappings table between the territory, role-certificate table, role-map table etc.)
C. resource information database (the configurable resource information in this trust domain and the corresponding authority that provides)
2., be authentication server configuration two-way authentication trusting relationship, dispose the trust management module of each trust domain, comprise the mapping relations constraint in this trust domain tied mechanism and the different trust domain.Prepare the letter of identity in each trust domain, the application of Attribute certificate and administration module and corresponding strategy customization, administration module.In building the process of each trust domain, all there are each self-defining role and their corresponding authority.There are role's inheritances such as sub-role in complicated system entails, consider the principle of sound accounting of distributed multi-stage safe access control, this programme has proposed to use the conception of improved RBAC model here, for father role adds corresponding privately owned authority, this part authority does not allow sub-role succession to this model on original RBAC model based.This method also is applied in the role-map between different trust domain, and promptly the authority of Ying She role in the territory should be less than the authority of directly using this role in this territory.The benefit of doing like this is that the resource of well having protected this trust domain is not destroyed by outer trust domain entity or unauthorized anti-asking, allows overseas trusted entity to visit resource in this trust domain equally to a certain extent.Improved RBAC model, as shown in Figure 1:
3., start LDAP and Tomcat server, the user in each trust domain is by load the legal identity certificate of oneself in IE, with connecting of this trust domain certificate server.
Mode: IE-〉instrument-internet option-content-certificate adds X.509 certificate.
After the trust through this trust domain certificate server, trust server provides session id for the user, and the user has the right to visit this trust domain resource or visits the resource of other trust domain by role-map.Main body when the role that visit this overseas resource and selecting can be shone upon, the result of this selection be subjected to this trust domain and and the mapping trust domain in the common judgement of strategy, can not select the role of mutual exclusion, as shown in Figure 2.
With respect to the safety label scheme of using in the small distributed system, the present invention can well be applied in the large-scale distributed system, and the identity that described bidirectional authentication mechanism can fine definite user is guaranteed not to be forged, for interactive information provides encryption, guarantee not eavesdropped simultaneously.The widely-used authority that makes of Attribute certificate and RBAC is better separated with identity, is convenient to the Policy Administrator and better manages.The both convenient distributed visit of mapping mechanism is given and certain role-map constrained again between the territory, guarantees access security.
Adopt above method to can be good at providing the distributed resource access control, be convenient to domain administrator and manage and dispose, can satisfy the concurrent use of large-scale and multiple users safely and efficiently, effect is fine.
Claims (8)
1, a kind of distributed access control method in multistage securities, it is characterized in that, provide corresponding authentication and information encryption mechanism by the PKI technology, by the relation between RBAC technology and the PMI technological constraint user-role-authority, retrain resource access under the relative dispersion condition by resource descriptor, note down corresponding user access information and system safety information by log pattern; For a plurality of trust domain in the practical application, the user lands this trust domain by the letter of identity that uses oneself, after obtaining the trust of certificate server, playing two-way authentication with certificate server is connected, the user can propose the access request to a certain resource after determining one's identity, the pairing final judging result of this access request is by the user role Attribute certificate, the domain policy Attribute certificate, the decision function of three kinds of attribute certificates of policy attribute certificate decides between the territory, into database is noted down in simultaneously corresponding important system daily record, convenient inspection in the future.
2, distributed access control method in multistage securities according to claim 1 is characterized in that, comprises following concrete steps:
1. the system bidirectional authentication mechanism allows requesting party and response side all determine the other side's identity, and whether authentication server will be verified the signature and the term of validity of user certificate and be cancelled;
2. user access resources comprises resource in this territory of user capture and the resource in other territories of user capture;
3. territory safety management person checks user object, and the role that this user is assigned with returns to the user, creates a session object for the user simultaneously;
4. the user selects the role of own needs according to oneself requirement from some roles that territory safety management person returns, and selected role is sent back to territory safety management person;
5. territory safety management person access domain policy attribute certificate obtains all sub-roles of role that the user requires, structure character object;
6. territory safety management person makes up permission object;
7. lawful authority collection that this user is authorized to and desired authority set compare, if the former comprises the latter, then allow its visit to resource, otherwise refuse its access resources.
3, distributed access control method in multistage securities according to claim 2, it is characterized in that, described authentication if certificate is legal, can be extracted certificate serial number from certificate, username information, enter next step, otherwise disconnect to connect, no matter verify by whether, the system journal module all will write database with access request and court verdict, and the information that checking back both sides transmit is effectively encrypted.
4, distributed access control method in multistage securities according to claim 2, it is characterized in that, resource in this territory of described user capture, sequence number according to public key certificate is created user object, generate a session id, the inquiry ldap server by retrieval user role-certificate storehouse, obtains all roles of this user.
5, distributed access control method in multistage securities according to claim 2, it is characterized in that the resource in other territories of described user capture should provide oneself user role Attribute certificate, territory safety management person checks whether Attribute certificate is effective, the request of invalid then refusal.
6, distributed access control method in multistage securities according to claim 2, it is characterized in that, described territory safety management person, obtain " tactful certificate between the territory " between territory, user place and the access domain, if do not have interoperation relation between two territories, refusing user's request then, on the contrary carry out role's mapping, with this territory role-map role that is other territories.
7, distributed access control method in multistage securities according to claim 2, it is characterized in that, described character object, system checks character object, see and whether satisfy role's constraints, session object is checked, after guaranteeing that the role added session object, can not activated the role of two mutual exclusions simultaneously, if there is no mutual exclusion role, then the role is added session object, carry out next step, otherwise the request of refusing user's.
8, distributed access control method in multistage securities according to claim 2, it is characterized in that, described structure permission object, be meant: can obtain all authorities of user in conjunction with character object and permission object, system carries out binding character inspection to permission object, obtains all lawful authorities of this user.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CNB2006101163016A CN100542092C (en) | 2006-09-21 | 2006-09-21 | Distributed access control method in multistage securities |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CNB2006101163016A CN100542092C (en) | 2006-09-21 | 2006-09-21 | Distributed access control method in multistage securities |
Publications (2)
Publication Number | Publication Date |
---|---|
CN1960255A true CN1960255A (en) | 2007-05-09 |
CN100542092C CN100542092C (en) | 2009-09-16 |
Family
ID=38071760
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CNB2006101163016A Expired - Fee Related CN100542092C (en) | 2006-09-21 | 2006-09-21 | Distributed access control method in multistage securities |
Country Status (1)
Country | Link |
---|---|
CN (1) | CN100542092C (en) |
Cited By (22)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101232424B (en) * | 2008-03-04 | 2010-06-30 | ***通信集团设计院有限公司 | Access method, access system, trust service center, network trust platform |
CN101039186B (en) * | 2007-05-08 | 2010-08-04 | 中国科学院软件研究所 | Method for auditing safely system log |
CN101453388B (en) * | 2008-12-30 | 2011-02-09 | 公安部第三研究所 | Inspection method for Internet service operation field terminal safety |
CN101997876A (en) * | 2010-11-05 | 2011-03-30 | 重庆大学 | Attribute-based access control model and cross domain access method thereof |
CN101296230B (en) * | 2008-06-17 | 2011-05-11 | 浙江大学 | Web service security control mechanism based on PKI and PMI |
CN101335626B (en) * | 2008-08-06 | 2011-05-18 | ***集团宽带业务应用国家工程实验室有限公司 | Multi-stage authentication method and multi-stage authentication system |
CN102316152A (en) * | 2010-06-03 | 2012-01-11 | 微软公司 | The Distributed Services empowerment management |
WO2012009877A1 (en) * | 2010-07-20 | 2012-01-26 | 上海交通大学 | Access method based on computable credibility in distributed multi-trust domain environment |
CN102654864A (en) * | 2011-03-02 | 2012-09-05 | 华北计算机***工程研究所 | Independent transparent security audit protection method facing real-time database |
CN102857488A (en) * | 2012-05-10 | 2013-01-02 | 中国人民解放军理工大学 | Network access control model as well as method and terminal thereof |
CN103699828A (en) * | 2013-12-25 | 2014-04-02 | 柳州市欧博科技有限公司 | Information security management method |
CN104506480A (en) * | 2014-06-27 | 2015-04-08 | 深圳市永达电子股份有限公司 | Cross-domain access control method and system based on marking and auditing combination |
CN105743885A (en) * | 2016-01-22 | 2016-07-06 | 山东大学(威海) | Data file transmitting and receiving method and device based on multi-level server client mode |
CN107204978A (en) * | 2017-05-24 | 2017-09-26 | 北京邮电大学 | A kind of access control method and device based on multi-tenant cloud environment |
CN108475309A (en) * | 2015-08-21 | 2018-08-31 | 维尔蒂姆知识产权有限公司 | System and method for biological characteristic consensus standard |
CN110414257A (en) * | 2018-04-26 | 2019-11-05 | 中移(苏州)软件技术有限公司 | A kind of data access method and server |
CN110753044A (en) * | 2019-10-12 | 2020-02-04 | 山东英信计算机技术有限公司 | Identity authentication method, system, electronic equipment and storage medium |
CN111241519A (en) * | 2020-01-19 | 2020-06-05 | 北京工业大学 | Certificate-based access control system and method |
CN112532591A (en) * | 2020-11-06 | 2021-03-19 | 西安电子科技大学 | Cross-domain access control method, system, storage medium, computer equipment and terminal |
CN112953920A (en) * | 2021-02-01 | 2021-06-11 | 福建多多云科技有限公司 | Monitoring management method based on cloud mobile phone |
US11329980B2 (en) | 2015-08-21 | 2022-05-10 | Veridium Ip Limited | System and method for biometric protocol standards |
CN117648362A (en) * | 2024-01-29 | 2024-03-05 | 北京谷器数据科技有限公司 | Method and system for linking third party databases |
-
2006
- 2006-09-21 CN CNB2006101163016A patent/CN100542092C/en not_active Expired - Fee Related
Cited By (32)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101039186B (en) * | 2007-05-08 | 2010-08-04 | 中国科学院软件研究所 | Method for auditing safely system log |
CN101232424B (en) * | 2008-03-04 | 2010-06-30 | ***通信集团设计院有限公司 | Access method, access system, trust service center, network trust platform |
CN101296230B (en) * | 2008-06-17 | 2011-05-11 | 浙江大学 | Web service security control mechanism based on PKI and PMI |
CN101335626B (en) * | 2008-08-06 | 2011-05-18 | ***集团宽带业务应用国家工程实验室有限公司 | Multi-stage authentication method and multi-stage authentication system |
CN101453388B (en) * | 2008-12-30 | 2011-02-09 | 公安部第三研究所 | Inspection method for Internet service operation field terminal safety |
CN102316152B (en) * | 2010-06-03 | 2016-06-15 | 微软技术许可有限责任公司 | Distributed Services empowerment management |
CN102316152A (en) * | 2010-06-03 | 2012-01-11 | 微软公司 | The Distributed Services empowerment management |
WO2012009877A1 (en) * | 2010-07-20 | 2012-01-26 | 上海交通大学 | Access method based on computable credibility in distributed multi-trust domain environment |
CN101997876A (en) * | 2010-11-05 | 2011-03-30 | 重庆大学 | Attribute-based access control model and cross domain access method thereof |
CN101997876B (en) * | 2010-11-05 | 2014-08-27 | 重庆大学 | Attribute-based access control model and cross domain access method thereof |
CN102654864A (en) * | 2011-03-02 | 2012-09-05 | 华北计算机***工程研究所 | Independent transparent security audit protection method facing real-time database |
CN102857488A (en) * | 2012-05-10 | 2013-01-02 | 中国人民解放军理工大学 | Network access control model as well as method and terminal thereof |
CN102857488B (en) * | 2012-05-10 | 2015-06-10 | 中国人民解放军理工大学 | Network access control model as well as method and terminal thereof |
CN103699828A (en) * | 2013-12-25 | 2014-04-02 | 柳州市欧博科技有限公司 | Information security management method |
CN104506480A (en) * | 2014-06-27 | 2015-04-08 | 深圳市永达电子股份有限公司 | Cross-domain access control method and system based on marking and auditing combination |
CN104506480B (en) * | 2014-06-27 | 2018-11-23 | 深圳市永达电子信息股份有限公司 | The cross-domain access control method and system combined based on label with audit |
US11329980B2 (en) | 2015-08-21 | 2022-05-10 | Veridium Ip Limited | System and method for biometric protocol standards |
CN108475309A (en) * | 2015-08-21 | 2018-08-31 | 维尔蒂姆知识产权有限公司 | System and method for biological characteristic consensus standard |
CN105743885A (en) * | 2016-01-22 | 2016-07-06 | 山东大学(威海) | Data file transmitting and receiving method and device based on multi-level server client mode |
CN105743885B (en) * | 2016-01-22 | 2019-09-27 | 山东大学(威海) | Data file receiving/transmission method and device based on multistage server client mode |
CN107204978A (en) * | 2017-05-24 | 2017-09-26 | 北京邮电大学 | A kind of access control method and device based on multi-tenant cloud environment |
CN107204978B (en) * | 2017-05-24 | 2019-10-15 | 北京邮电大学 | A kind of access control method and device based on multi-tenant cloud environment |
CN110414257A (en) * | 2018-04-26 | 2019-11-05 | 中移(苏州)软件技术有限公司 | A kind of data access method and server |
CN110753044A (en) * | 2019-10-12 | 2020-02-04 | 山东英信计算机技术有限公司 | Identity authentication method, system, electronic equipment and storage medium |
CN111241519A (en) * | 2020-01-19 | 2020-06-05 | 北京工业大学 | Certificate-based access control system and method |
CN111241519B (en) * | 2020-01-19 | 2022-07-26 | 北京工业大学 | Certificate-based access control system and method |
CN112532591A (en) * | 2020-11-06 | 2021-03-19 | 西安电子科技大学 | Cross-domain access control method, system, storage medium, computer equipment and terminal |
CN112532591B (en) * | 2020-11-06 | 2022-03-11 | 西安电子科技大学 | Cross-domain access control method, system, storage medium, computer equipment and terminal |
CN112953920A (en) * | 2021-02-01 | 2021-06-11 | 福建多多云科技有限公司 | Monitoring management method based on cloud mobile phone |
CN112953920B (en) * | 2021-02-01 | 2022-07-01 | 福建多多云科技有限公司 | Monitoring management method based on cloud mobile phone |
CN117648362A (en) * | 2024-01-29 | 2024-03-05 | 北京谷器数据科技有限公司 | Method and system for linking third party databases |
CN117648362B (en) * | 2024-01-29 | 2024-06-04 | 北京谷器数据科技有限公司 | Method and system for linking third party databases |
Also Published As
Publication number | Publication date |
---|---|
CN100542092C (en) | 2009-09-16 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
CN100542092C (en) | Distributed access control method in multistage securities | |
CN102597981B (en) | Modular device authentication framework | |
US9825938B2 (en) | System and method for managing certificate based secure network access with a certificate having a buffer period prior to expiration | |
WO2018170341A1 (en) | Methods and systems for universal storage and access to user-owned credentials for trans-institutional digital authentication | |
US20030182573A1 (en) | Content filtering and management | |
CN1731723A (en) | Electron/handset token dynamic password identification system | |
CN103152179A (en) | Uniform identity authentication method suitable for multiple application systems | |
CN1274105C (en) | Dynamic password authentication method based on digital certificate implement | |
CN1631001A (en) | System and method for creating a secure network using identity credentials of batches of devices | |
CN101064717A (en) | Safety protection system of information system or equipment and its working method | |
JP2002064485A (en) | System and method for safe legacy enclave in public key infrastructure | |
CN101399671A (en) | Cross-domain authentication method and system thereof | |
CN101321064A (en) | Information system access control method and apparatus based on digital certificate technique | |
CN109962890A (en) | A kind of the authentication service device and node access, user authen method of block chain | |
CN101741860A (en) | Computer remote security control method | |
US7849326B2 (en) | Method and system for protecting master secrets using smart key devices | |
CN109728903A (en) | A kind of block chain weak center password authorization method using properties secret | |
US7877791B2 (en) | System, method and program for authentication and access control | |
CN105518689A (en) | Method and system related to authentication of users for accessing data networks | |
CN102404112A (en) | Access authentication method for credible terminal | |
CN2891503Y (en) | Security protection system for information system or equipment | |
CN1194498C (en) | Content safe monitoring system based on digital label and its method | |
CN111163069A (en) | Block chain-based Internet of things user privacy protection method | |
Chandersekaran et al. | Information sharing and federation | |
Shoeb et al. | Authentication and authorization: Security issues for institutional digital repositories |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
C06 | Publication | ||
PB01 | Publication | ||
C10 | Entry into substantive examination | ||
SE01 | Entry into force of request for substantive examination | ||
C14 | Grant of patent or utility model | ||
GR01 | Patent grant | ||
CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20090916 Termination date: 20180921 |
|
CF01 | Termination of patent right due to non-payment of annual fee |