US20170134354A1 - Hardware-Based Credential Distribution - Google Patents
Hardware-Based Credential Distribution Download PDFInfo
- Publication number
- US20170134354A1 US20170134354A1 US15/412,931 US201715412931A US2017134354A1 US 20170134354 A1 US20170134354 A1 US 20170134354A1 US 201715412931 A US201715412931 A US 201715412931A US 2017134354 A1 US2017134354 A1 US 2017134354A1
- Authority
- US
- United States
- Prior art keywords
- computing device
- unique identifier
- hardware profile
- resource
- credential
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
- 238000000034 method Methods 0.000 claims abstract description 52
- 230000008569 process Effects 0.000 claims description 20
- 238000004891 communication Methods 0.000 description 13
- 238000012795 verification Methods 0.000 description 7
- 238000010586 diagram Methods 0.000 description 6
- 238000010200 validation analysis Methods 0.000 description 5
- 230000004044 response Effects 0.000 description 3
- 230000004075 alteration Effects 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 230000001419 dependent effect Effects 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 230000000977 initiatory effect Effects 0.000 description 1
- 238000012545 processing Methods 0.000 description 1
- 230000008439 repair process Effects 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
- 238000012360 testing method Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
- H04L63/062—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key distribution, e.g. centrally by trusted party
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/102—Entity profiles
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/2866—Architectures; Arrangements
- H04L67/30—Profiles
- H04L67/303—Terminal profiles
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/31—User authentication
Definitions
- Credentials allow a service to authenticate a client before providing resources or sharing data with the client. Services usually distribute verifiable credentials to clients to allow the client to access the resources or data over a network. Credentials are not infinite, however, and should only be distributed to actual users of the service. Arbitrary distribution of credentials can result in exploitation or interruptions of services, such as denial of service attacks by malicious entities.
- This document describes various techniques for distributing credentials based on hardware profiles. These techniques may validate a request for a resource by matching a hardware profile of the requesting entity to a previous hardware profile associated with that requesting entity. Once validated, the techniques distribute a credential for accessing the resource. By so doing, the techniques protect the resource from exploitation or attack without compromising a user's computing experience.
- FIG. 1 illustrates an example environment in which these techniques may be performed.
- FIG. 2 illustrates an example computing device of FIG. 1 in more detail.
- FIG. 3 is a flow diagram depicting an example process for accessing a resource with a credential distributed based on a hardware profile.
- FIG. 4 is a flow diagram depicting an example process for distributing a credential based on a hardware profile.
- FIG. 5 is a flow diagram depicting an example process for granting access to a resource based on an indication of a validity of a request.
- This document describes various techniques for distributing credentials based on hardware profiles. These techniques can improve a user's computing experience by forgoing a login, password, and/or response challenge, though these techniques can be used in conjunction with human-verification methods for additional security.
- FIG. 1 is an illustration of an example environment 100 having a computing device 102 , server 104 , and communication network 106 , through which computing device 102 and server 104 may communicate.
- computing device 102 requests access to a resource of server 104 through communication network 106 .
- a secure communication channel is established between computing device 102 and server 104 over communication network 106 for providing resources and/or exchanging trusted data.
- Computing device 102 can be any device capable of communicating over a network (e.g., communication network 106 ), accessing resources of a service, and exchanging trusted data.
- Computing device 102 is illustrated, by way of example and not limitation, as one of a smartphone 108 , a laptop computer 110 , set-top box 112 , desktop computer 114 , or tablet computer 116 .
- Communication network 106 may include any suitable network such as the Internet, a local-area network, a wide-area network, a wireless-network, a personal-area network, a dial-up network, and/or a USB bus, to name a few.
- Server 104 can be any computing device having resources and/or hosting a service for managing the resources, such as objects, data, functionalities, and the like.
- the service of server 104 requires authentication of a client before sharing a resource with the client requesting access to the resource. In some cases, authentication may be direct with computing device 102 or brokered through a third party associated with both server 104 and computing device 102 (not shown).
- a resource of server 104 is typically referenced by a Uniform Resource Locator (URL) or Universal Resource Identifier (URI).
- URL or URI is used by a client, such as computing device 102 , for initiating access of the resource.
- a resource may be referenced by an abstract domain in extensible markup language (XML) such as a namespace.
- XML extensible markup language
- FIG. 2 illustrates an example computing device 102 of FIG. 1 in more detail.
- Computing device 102 includes processor(s) 202 , computer-readable media (CRM) 204 , and network interface 206 .
- Network interface 206 allows computing device 102 to communicate over communication network 106 and may include a unique media access control (MAC) address (not shown).
- Computer-readable media 204 contains memory media 208 , storage media 210 , and resource access manager 212 , which is described as part of the processes discussed below.
- Memory media 208 can include dynamic random access memory (DRAM) 214 , static random access memory (SRAM) 216 , read-only memory (ROM) 218 , or any combination thereof.
- Memory media 208 may be fixed or modular (flexibly configured) providing various configurations and/or capacities of memory for computing device 102 .
- DRAM 214 may be user accessible, allowing a user to increase an amount of DRAM 214 present in computing device 102 .
- memory media 208 may include information relating a manufacturer, data rate, and/or capacity of memory device(s) of computing device 102 .
- DRAM 214 includes a serial presence detect integrated circuit (not shown) presenting information relating to a data rate and capacity of DRAM 214 .
- Storage media 210 can include hard disk drive (HDD) 220 and/or flash 222 .
- Storage media 210 is internal and/or external (but local) computer-readable storage media and is capable of storing data.
- Hard disk drive 220 or flash 222 can be configured as individual storage volumes or as multiple drives of a redundant array of independent disks (RAID) volume.
- storage media 210 can include information relating to a manufacturer, model number, serial number, and/or a capacity of a particular storage media device.
- hard disk drive 220 may include a model number, serial number, and capacity information detectable by a host device or a component of a host device.
- any of the techniques and abilities described herein can be implemented using software, firmware, hardware (e.g., fixed-logic circuitry), manual processing, or any suitable combination of these implementations.
- the example computing device 102 generally represents software, firmware, hardware, or any combination thereof.
- resource access manager 212 represents computer-executable instructions (e.g., program code) that perform specific tasks when executed on a processor (e.g., CPU or CPUs).
- the program code can be stored in one or more computer-readable media devices, such as memory media 208 and/or storage media 210 .
- the features and techniques described herein are platform-independent, meaning that they may be implemented on a variety of commercial computing platforms having a variety of processors.
- computing device 102 transmits a resource access request including a unique identifier and a current hardware profile to server 104 over communication network 106 .
- Server 104 receives the unique identifier and hardware profile, determines whether or not the hardware profile matches at least a portion of a stored hardware profile associated with the unique identifier, and, if it matches, sends a credential useful to access a resource to computing device 102 .
- FIG. 3 is a flow diagram depicting an example process 300 for accessing a resource with a credential distributed based on hardware profiles.
- Block 302 transmits a resource access request including a unique identifier and a current hardware profile to a remote entity.
- the resource access request is just the unique identifier and the current hardware profile.
- the remote entity has access (locally, remotely, or via proxy) to a previous hardware profile associated with the unique identifier.
- the unique identifier is associated with the previous hardware profile during a past attempt to access a resource or during a secure registration process.
- the current hardware profile includes information relating to hardware components or a hardware configuration of a computing device.
- This profile can be generated by an application programming interface (API) based on information relating to hardware of a computing device, such as serial numbers, model numbers, and/or parameters of hardware components of the computing device.
- API application programming interface
- the unique identifier is any certificate, token, identification data, or combination thereof that uniquely identifies a computing device.
- the unique identifier is digitally signed or encrypted with a private key and/or shared key to ensure authenticity.
- This unique identifier may be received during a secure registration process that associates the unique identifier with a hardware profile.
- the unique identifier may be a software license validation (SLV) certificate received during secure registration with an SLV server. During this secure registration, a hardware profile sent to the SLV server is associated with the SLV certificate.
- SLV software license validation
- Resource access manager 212 generates a current hardware profile of laptop computer 110 based on information relating to DRAM 214 , HDD 220 , and Network Interface 206 .
- This current hardware profile includes information relating to a manufacturer and a capacity (or amount) of DRAM 214 , a serial number and model number of HDD 220 , and a MAC address of network interface 206 .
- resource access manager 212 is attempting to access a software update of server 104 . To do so, resource access manager 212 transmits a resource access request including a unique identifier and the current hardware profile to server 104 over communication network 106 .
- Block 304 receives a credential useful to access a resource from the remote entity if the current hardware profile matches at least a portion of the previous hardware profile.
- the credential is useful to access a resource directly or access a service managing resources, functionalities, and/or data.
- the manufacturer and capacity (or amount) of DRAM 214 and the MAC address of network interface 206 of the current hardware profile match corresponding information of a previous hardware profile associated with the certificate.
- Resource access manager 212 receives, from server 104 , a credential useful to access the software update resource responsive to a portion of the current hardware profile matches the previous hardware profile.
- a resource is accessed using the received credential.
- the resource may be accessed directly or through a service managing the resource and/or data.
- the resource is a functionality provided by the service, such as messaging, synchronizing data, or trusted data exchange.
- resource access manager 212 accesses the software update resource of server 104 using the received credential and downloads a software update over communication network 106 .
- FIG. 4 is a flow diagram depicting an example process 400 for distributing a credential useful to access a resource based on hardware profiles.
- Block 402 receives a resource access request including a unique identifier and a hardware profile.
- the unique identifier may be any of those noted above, such as a certificate, token, or identification data or combination thereof that uniquely identifies a remote entity.
- the unique identifier is digitally signed or encrypted with a private key unknown to the remote entity to prevent tampering and/or alteration of the unique identifier.
- the unique identifier may be an SLV certificate encrypted with a private key known to an SLV server which issued the certificate.
- the hardware profile contains information relating to the remote entity's hardware, such as a collection of serial numbers, model numbers, and/or parameters of hardware components.
- the hardware profile can include information about a manufacturer, model number, serial number and a capacity of a hard disk drive.
- server 104 receives a resource access request from resource access manager 212 of laptop computer 110 through data communication network 106 .
- the resource access request includes a hardware profile of laptop computer 110 and a unique identifier in the form of certificate encrypted with a private key known to server 104 .
- the hardware profile of laptop computer 110 includes information relating to a manufacturer and a capacity (or amount) of DRAM 214 , a serial number and model number of HDD 220 , and a MAC address of network interface 206 .
- Block 404 determines that the hardware profile matches at least a portion of a stored hardware profile associated with the unique identifier.
- the stored hardware profile may be stored during a secure registration or license validation process. For instance, a hardware profile received during an SLV process may be stored and associated with an SLV certificate.
- all of the information contained in the hardware profile matches the information contained in the stored hardware profile associated with the unique identifier.
- fuzzy-logic may be employed to determine that the hardware profile sufficiently, but not entirely, matches the stored hardware profile.
- a match can be determined using fuzzy-logic even though information relating to a HDD of the hardware profile does not match information relating to a HDD of the stored hardware profile.
- a matching algorithm employing fuzzy-logic provides flexible matching, allowing a match to be determined for a computing device that has new and/or different hardware components due to repairs and/or upgrades.
- This matching algorithm may determine that the hardware profile is sufficiently similar when two of three hardware component parameters match.
- the matching algorithm may determine a sufficient match based on various criteria, such as serial numbers that are unlikely to change, while other non-matching serial numbers are acceptable for hardware often altered or replaced, such as external hard drives or non-integrated displays, but not motherboards or processors.
- server 104 decrypts the certificate using a private key to identify laptop computer 110 .
- Server 104 determines that at least a portion of the hardware profile of laptop computer 110 matches a stored profile that is associated with the certificate included in the resource access request.
- a user of laptop computer 110 has replaced HDD 220 of laptop computer 110 due to a failure of a previous HDD.
- a matching algorithm of server 104 employing fuzzy-logic determines that the hardware profile of laptop computer 110 sufficiently matches the stored hardware profile based on the information relating to the manufacturer and the capacity (or amount) of DRAM 214 and the MAC address of network interface 206 .
- Block 406 transmits a credential to the remote entity useful to access a resource.
- the credential may be useful to access a resource directly or access a service managing the resource and/or providing functionality related to the resource.
- a credential distribution limit or rule is consulted prior to transmitting the credential limiting distribution of credentials.
- the credential distribution limit is associated with the unique identifier to limit credential distribution to an entity (or entities claiming to be) associated with the unique identifier.
- Credential distribution can be limited to a total number of credentials distributed, a rate of credential distribution, or a frequency of credential distribution or any combination thereof. For instance, credential limits associated with a unique identifier may only allow one credential to be distributed every 10 seconds with a total limit of 50 distributed credentials.
- server 104 has a credential distribution limit of 50 total credentials per unique identifier. Also assume that one credential has been previously issued in association to the certificate included in the resource access request received from laptop computer 110 . Here, server 104 consults the credential distribution limit and determines that a credential can be issued to laptop computer 110 . Concluding the present example, server 104 increments a credential distribution count associated with the unique identifier and transmits a credential useful to access a software update to laptop computer 110 over communication network 106 . This is but one way in which the techniques may limit credential distribution to computing devices of actual users of a service.
- FIG. 5 is a flow diagram depicting an example process 500 for granting access to a resource.
- Block 502 receives a request for resource access including a unique identifier and a hardware profile, such as those unique identifiers and hardware profiles mentioned above.
- server 104 receives a resource access request from resource access manager 212 of laptop computer 110 over communication network 106 .
- the resource access request includes a certificate encrypted with a private key and a hardware profile of laptop computer 110 .
- server 104 is hosting a software update service, and that resource access manager 212 of laptop computer 110 is attempting to access the software update service.
- server 104 does not have a private key for decrypting the certificate included in the resource access request.
- Block 504 forwards the unique identifier and hardware profile to a request-validating entity having access to a historical hardware profile associated with the unique identifier.
- the historical hardware profile includes information previously collected relating to hardware components or a hardware configuration of a computing device.
- the historical hardware profile is received from a computing device during a secure registration process.
- the unique identifier may have been issued to the computing device and associated with the received hardware profile.
- the unique identifier and hardware profile may be forwarded to an SLV server having a stored historical profile associated with an SLV ticket encrypted with a private key.
- the request-validating entity may also have access to a private and/or shared key useful to decrypt an encrypted unique identifier.
- the request-validating entity decrypts a certificate, token, or digital signature to expose information uniquely identifying a computing device, such as an SLV server having a private key decrypting and verifying an SLV ticket included in the request.
- server 104 forwards the certificate encrypted with the private key and the hardware profile of laptop 110 to a remote request-validation server (not shown).
- request-validation server has a private key capable of decrypting the certificate and a historical hardware profile associated with the certificate.
- Block 506 receives an indication of a validity of the request if the request-validating entity determines that the hardware profile of the remote entity matches at least a portion of the historical hardware profile.
- This indication of validity may include identification information relating to the remote entity, such as information identifying the remote entity as an owner of a software product or as a subscriber to a service.
- an indication of the validity of the request can be received from an SLV server when at least a portion of the hardware profile of the remote entity matches a historical hardware profile associated with an SLV ticket.
- server 104 receives an indication of the validity of the request when the request-validation server determines that the hardware profile of laptop computer 110 matches at least a portion of the historical hardware profile associated with the certificate.
- the indication of the validity of the request also includes identification information that identifies laptop computer 110 as a subscriber of the software update service of server 104 .
- Block 508 grants access of the resource to the remote entity based on the indication of the validity of the request.
- a credential useful to access the resource is transmitted to the remote entity.
- the credential is useful to access a resource directly or access a service managing the resource and/or providing functionality related to the resource.
- access to the resource may be limited or denied based on identification information relating to the remote entity. For example, access may be limited to updates of a particular software product based on information that identifies the remote entity as an owner of that software product.
- server 104 grants access of the software update service to laptop computer 110 based on the validity of the request.
- the access granted is limited by server 104 based on the identification information that identifies laptop computer 110 as a subscriber to that service.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computer Security & Cryptography (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Storage Device Security (AREA)
- Information Transfer Between Computers (AREA)
Abstract
Description
- Credentials allow a service to authenticate a client before providing resources or sharing data with the client. Services usually distribute verifiable credentials to clients to allow the client to access the resources or data over a network. Credentials are not infinite, however, and should only be distributed to actual users of the service. Arbitrary distribution of credentials can result in exploitation or interruptions of services, such as denial of service attacks by malicious entities.
- To limit distribution of credentials many services rely on human-verification methods. These human-verification methods use logins, passwords, and/or challenge response tests to verify the client's identity when a service is accessed. While these human-verification methods help to limit credential distribution to clients associated with human users, they compromise a user's computing experience.
- This document describes various techniques for distributing credentials based on hardware profiles. These techniques may validate a request for a resource by matching a hardware profile of the requesting entity to a previous hardware profile associated with that requesting entity. Once validated, the techniques distribute a credential for accessing the resource. By so doing, the techniques protect the resource from exploitation or attack without compromising a user's computing experience.
- This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter.
- The detailed description is described with reference to the accompanying figures. In the figures, the left-most digit of a reference number identifies the figure in which the reference number first appears. The use of the same reference number in different instances in the description and the figures may indicate similar or identical items.
-
FIG. 1 illustrates an example environment in which these techniques may be performed. -
FIG. 2 illustrates an example computing device ofFIG. 1 in more detail. -
FIG. 3 is a flow diagram depicting an example process for accessing a resource with a credential distributed based on a hardware profile. -
FIG. 4 is a flow diagram depicting an example process for distributing a credential based on a hardware profile. -
FIG. 5 is a flow diagram depicting an example process for granting access to a resource based on an indication of a validity of a request. - Overview
- This document describes various techniques for distributing credentials based on hardware profiles. These techniques can improve a user's computing experience by forgoing a login, password, and/or response challenge, though these techniques can be used in conjunction with human-verification methods for additional security.
- Example Environment
-
FIG. 1 is an illustration of anexample environment 100 having acomputing device 102,server 104, andcommunication network 106, through whichcomputing device 102 andserver 104 may communicate. Generally,computing device 102 requests access to a resource ofserver 104 throughcommunication network 106. In some embodiments, a secure communication channel is established betweencomputing device 102 andserver 104 overcommunication network 106 for providing resources and/or exchanging trusted data. -
Computing device 102 can be any device capable of communicating over a network (e.g., communication network 106), accessing resources of a service, and exchanging trusted data.Computing device 102 is illustrated, by way of example and not limitation, as one of asmartphone 108, alaptop computer 110, set-top box 112,desktop computer 114, ortablet computer 116.Communication network 106 may include any suitable network such as the Internet, a local-area network, a wide-area network, a wireless-network, a personal-area network, a dial-up network, and/or a USB bus, to name a few. -
Server 104 can be any computing device having resources and/or hosting a service for managing the resources, such as objects, data, functionalities, and the like. The service ofserver 104 requires authentication of a client before sharing a resource with the client requesting access to the resource. In some cases, authentication may be direct withcomputing device 102 or brokered through a third party associated with bothserver 104 and computing device 102 (not shown). A resource ofserver 104 is typically referenced by a Uniform Resource Locator (URL) or Universal Resource Identifier (URI). A URL or URI is used by a client, such ascomputing device 102, for initiating access of the resource. In other cases, a resource may be referenced by an abstract domain in extensible markup language (XML) such as a namespace. -
FIG. 2 illustrates anexample computing device 102 ofFIG. 1 in more detail.Computing device 102 includes processor(s) 202, computer-readable media (CRM) 204, andnetwork interface 206.Network interface 206 allowscomputing device 102 to communicate overcommunication network 106 and may include a unique media access control (MAC) address (not shown). Computer-readable media 204 containsmemory media 208,storage media 210, andresource access manager 212, which is described as part of the processes discussed below. -
Memory media 208 can include dynamic random access memory (DRAM) 214, static random access memory (SRAM) 216, read-only memory (ROM) 218, or any combination thereof.Memory media 208 may be fixed or modular (flexibly configured) providing various configurations and/or capacities of memory forcomputing device 102. For instance,DRAM 214 may be user accessible, allowing a user to increase an amount ofDRAM 214 present incomputing device 102. Alternately or additionally,memory media 208 may include information relating a manufacturer, data rate, and/or capacity of memory device(s) ofcomputing device 102. In some instances,DRAM 214 includes a serial presence detect integrated circuit (not shown) presenting information relating to a data rate and capacity ofDRAM 214. -
Storage media 210 can include hard disk drive (HDD) 220 and/orflash 222.Storage media 210 is internal and/or external (but local) computer-readable storage media and is capable of storing data.Hard disk drive 220 orflash 222 can be configured as individual storage volumes or as multiple drives of a redundant array of independent disks (RAID) volume. Alternately or additionally,storage media 210 can include information relating to a manufacturer, model number, serial number, and/or a capacity of a particular storage media device. For instance,hard disk drive 220 may include a model number, serial number, and capacity information detectable by a host device or a component of a host device. - Generally, any of the techniques and abilities described herein can be implemented using software, firmware, hardware (e.g., fixed-logic circuitry), manual processing, or any suitable combination of these implementations. The
example computing device 102 generally represents software, firmware, hardware, or any combination thereof. In the case of a software implementation, for instance,resource access manager 212 represents computer-executable instructions (e.g., program code) that perform specific tasks when executed on a processor (e.g., CPU or CPUs). The program code can be stored in one or more computer-readable media devices, such asmemory media 208 and/orstorage media 210. The features and techniques described herein are platform-independent, meaning that they may be implemented on a variety of commercial computing platforms having a variety of processors. - Example Processes
- The following discussion describes techniques for distributing credentials based on hardware profiles. These techniques can be used instead of or in addition to human-verification methods. When used in addition to human-verification methods, these techniques provide additional security for credential distribution. When used instead of human-verification methods, these techniques forgo often-annoying or time-consuming user-dependent activities.
- By way of example, assume
computing device 102 transmits a resource access request including a unique identifier and a current hardware profile toserver 104 overcommunication network 106.Server 104 receives the unique identifier and hardware profile, determines whether or not the hardware profile matches at least a portion of a stored hardware profile associated with the unique identifier, and, if it matches, sends a credential useful to access a resource tocomputing device 102. - Aspects of these processes may be implemented in hardware, firmware, software, or a combination thereof. These processes are shown as sets of blocks that specify operations performed, such as through one or more entities or devices, and are not necessarily limited to the order shown for performing the operations by the respective blocks. In portions of the following discussion reference may be made to
environment 100 ofFIG. 1 as well as entities ofenvironment 100 illustrated inFIG. 2 . -
FIG. 3 is a flow diagram depicting anexample process 300 for accessing a resource with a credential distributed based on hardware profiles.Block 302 transmits a resource access request including a unique identifier and a current hardware profile to a remote entity. In some cases, the resource access request is just the unique identifier and the current hardware profile. The remote entity has access (locally, remotely, or via proxy) to a previous hardware profile associated with the unique identifier. In some instances, the unique identifier is associated with the previous hardware profile during a past attempt to access a resource or during a secure registration process. - The current hardware profile includes information relating to hardware components or a hardware configuration of a computing device. This profile can be generated by an application programming interface (API) based on information relating to hardware of a computing device, such as serial numbers, model numbers, and/or parameters of hardware components of the computing device.
- The unique identifier is any certificate, token, identification data, or combination thereof that uniquely identifies a computing device. In some cases, the unique identifier is digitally signed or encrypted with a private key and/or shared key to ensure authenticity. This unique identifier may be received during a secure registration process that associates the unique identifier with a hardware profile. For instance, the unique identifier may be a software license validation (SLV) certificate received during secure registration with an SLV server. During this secure registration, a hardware profile sent to the SLV server is associated with the SLV certificate.
- By way of example, consider
process 300 in the context ofenvironment 100.Resource access manager 212 generates a current hardware profile oflaptop computer 110 based on information relating toDRAM 214,HDD 220, andNetwork Interface 206. This current hardware profile includes information relating to a manufacturer and a capacity (or amount) ofDRAM 214, a serial number and model number ofHDD 220, and a MAC address ofnetwork interface 206. - Here assume that
resource access manager 212 is attempting to access a software update ofserver 104. To do so,resource access manager 212 transmits a resource access request including a unique identifier and the current hardware profile toserver 104 overcommunication network 106. -
Block 304 receives a credential useful to access a resource from the remote entity if the current hardware profile matches at least a portion of the previous hardware profile. The credential is useful to access a resource directly or access a service managing resources, functionalities, and/or data. In the context of the present example, assume that the manufacturer and capacity (or amount) ofDRAM 214 and the MAC address ofnetwork interface 206 of the current hardware profile match corresponding information of a previous hardware profile associated with the certificate.Resource access manager 212 receives, fromserver 104, a credential useful to access the software update resource responsive to a portion of the current hardware profile matches the previous hardware profile. - Optionally, at
block 306, a resource is accessed using the received credential. The resource may be accessed directly or through a service managing the resource and/or data. In some cases, the resource is a functionality provided by the service, such as messaging, synchronizing data, or trusted data exchange. Concluding the present example,resource access manager 212 accesses the software update resource ofserver 104 using the received credential and downloads a software update overcommunication network 106. -
FIG. 4 is a flow diagram depicting anexample process 400 for distributing a credential useful to access a resource based on hardware profiles.Block 402 receives a resource access request including a unique identifier and a hardware profile. The unique identifier may be any of those noted above, such as a certificate, token, or identification data or combination thereof that uniquely identifies a remote entity. In some cases, the unique identifier is digitally signed or encrypted with a private key unknown to the remote entity to prevent tampering and/or alteration of the unique identifier. For instance, the unique identifier may be an SLV certificate encrypted with a private key known to an SLV server which issued the certificate. - The hardware profile contains information relating to the remote entity's hardware, such as a collection of serial numbers, model numbers, and/or parameters of hardware components. For instance, the hardware profile can include information about a manufacturer, model number, serial number and a capacity of a hard disk drive.
- Consider
process 400 in the context of the above-mentioned example. Hereserver 104 receives a resource access request fromresource access manager 212 oflaptop computer 110 throughdata communication network 106. The resource access request includes a hardware profile oflaptop computer 110 and a unique identifier in the form of certificate encrypted with a private key known toserver 104. The hardware profile oflaptop computer 110 includes information relating to a manufacturer and a capacity (or amount) ofDRAM 214, a serial number and model number ofHDD 220, and a MAC address ofnetwork interface 206. -
Block 404 determines that the hardware profile matches at least a portion of a stored hardware profile associated with the unique identifier. The stored hardware profile may be stored during a secure registration or license validation process. For instance, a hardware profile received during an SLV process may be stored and associated with an SLV certificate. - In some cases, all of the information contained in the hardware profile matches the information contained in the stored hardware profile associated with the unique identifier. In other cases, where only a portion of the hardware profile matches the stored hardware profile, fuzzy-logic may be employed to determine that the hardware profile sufficiently, but not entirely, matches the stored hardware profile.
- A match can be determined using fuzzy-logic even though information relating to a HDD of the hardware profile does not match information relating to a HDD of the stored hardware profile. A matching algorithm employing fuzzy-logic provides flexible matching, allowing a match to be determined for a computing device that has new and/or different hardware components due to repairs and/or upgrades.
- This matching algorithm, for example, may determine that the hardware profile is sufficiently similar when two of three hardware component parameters match. The matching algorithm may determine a sufficient match based on various criteria, such as serial numbers that are unlikely to change, while other non-matching serial numbers are acceptable for hardware often altered or replaced, such as external hard drives or non-integrated displays, but not motherboards or processors.
- Continuing the ongoing example,
server 104 decrypts the certificate using a private key to identifylaptop computer 110.Server 104 then determines that at least a portion of the hardware profile oflaptop computer 110 matches a stored profile that is associated with the certificate included in the resource access request. Here assume that a user oflaptop computer 110 has replacedHDD 220 oflaptop computer 110 due to a failure of a previous HDD. - In the context of the present example, a matching algorithm of
server 104 employing fuzzy-logic determines that the hardware profile oflaptop computer 110 sufficiently matches the stored hardware profile based on the information relating to the manufacturer and the capacity (or amount) ofDRAM 214 and the MAC address ofnetwork interface 206. -
Block 406 transmits a credential to the remote entity useful to access a resource. The credential may be useful to access a resource directly or access a service managing the resource and/or providing functionality related to the resource. In some cases, a credential distribution limit or rule is consulted prior to transmitting the credential limiting distribution of credentials. In some instances, the credential distribution limit is associated with the unique identifier to limit credential distribution to an entity (or entities claiming to be) associated with the unique identifier. - Credential distribution can be limited to a total number of credentials distributed, a rate of credential distribution, or a frequency of credential distribution or any combination thereof. For instance, credential limits associated with a unique identifier may only allow one credential to be distributed every 10 seconds with a total limit of 50 distributed credentials.
- Continuing the present example, assume that
server 104 has a credential distribution limit of 50 total credentials per unique identifier. Also assume that one credential has been previously issued in association to the certificate included in the resource access request received fromlaptop computer 110. Here,server 104 consults the credential distribution limit and determines that a credential can be issued tolaptop computer 110. Concluding the present example,server 104 increments a credential distribution count associated with the unique identifier and transmits a credential useful to access a software update tolaptop computer 110 overcommunication network 106. This is but one way in which the techniques may limit credential distribution to computing devices of actual users of a service. -
FIG. 5 is a flow diagram depicting anexample process 500 for granting access to a resource.Block 502 receives a request for resource access including a unique identifier and a hardware profile, such as those unique identifiers and hardware profiles mentioned above. - Consider
process 500 in the context ofenvironment 100. Hereserver 104 receives a resource access request fromresource access manager 212 oflaptop computer 110 overcommunication network 106. Assume that the resource access request includes a certificate encrypted with a private key and a hardware profile oflaptop computer 110. Also assume thatserver 104 is hosting a software update service, and thatresource access manager 212 oflaptop computer 110 is attempting to access the software update service. In the context of the present example,server 104 does not have a private key for decrypting the certificate included in the resource access request. -
Block 504 forwards the unique identifier and hardware profile to a request-validating entity having access to a historical hardware profile associated with the unique identifier. The historical hardware profile includes information previously collected relating to hardware components or a hardware configuration of a computing device. In some cases, the historical hardware profile is received from a computing device during a secure registration process. In such a case, the unique identifier may have been issued to the computing device and associated with the received hardware profile. For instance, the unique identifier and hardware profile may be forwarded to an SLV server having a stored historical profile associated with an SLV ticket encrypted with a private key. - The request-validating entity may also have access to a private and/or shared key useful to decrypt an encrypted unique identifier. In some cases, the request-validating entity decrypts a certificate, token, or digital signature to expose information uniquely identifying a computing device, such as an SLV server having a private key decrypting and verifying an SLV ticket included in the request.
- In the context of the
present example server 104 forwards the certificate encrypted with the private key and the hardware profile oflaptop 110 to a remote request-validation server (not shown). Here, assume that the request-validation server has a private key capable of decrypting the certificate and a historical hardware profile associated with the certificate. -
Block 506 receives an indication of a validity of the request if the request-validating entity determines that the hardware profile of the remote entity matches at least a portion of the historical hardware profile. This indication of validity may include identification information relating to the remote entity, such as information identifying the remote entity as an owner of a software product or as a subscriber to a service. For instance, an indication of the validity of the request can be received from an SLV server when at least a portion of the hardware profile of the remote entity matches a historical hardware profile associated with an SLV ticket. - Continuing the present example,
server 104 receives an indication of the validity of the request when the request-validation server determines that the hardware profile oflaptop computer 110 matches at least a portion of the historical hardware profile associated with the certificate. The indication of the validity of the request also includes identification information that identifieslaptop computer 110 as a subscriber of the software update service ofserver 104. -
Block 508 grants access of the resource to the remote entity based on the indication of the validity of the request. In some cases, a credential useful to access the resource is transmitted to the remote entity. The credential is useful to access a resource directly or access a service managing the resource and/or providing functionality related to the resource. Furthermore, access to the resource may be limited or denied based on identification information relating to the remote entity. For example, access may be limited to updates of a particular software product based on information that identifies the remote entity as an owner of that software product. - Concluding the present example,
server 104 grants access of the software update service tolaptop computer 110 based on the validity of the request. The access granted is limited byserver 104 based on the identification information that identifieslaptop computer 110 as a subscriber to that service. - This document describes various techniques for distributing credentials based on hardware profiles. By so doing, these techniques improve security and/or a computing experience of a user accessing a resource via a service. Credentials useful for accessing a resource can be provided to a user without querying the user for a login, password, and/or response challenge. Although the invention has been described in language specific to structural features and/or methodological acts, it is to be understood that the invention defined in the appended claims is not necessarily limited to the specific features or acts described. Rather, the specific features and acts are disclosed as example forms of implementing the claimed invention.
Claims (20)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US15/412,931 US20170134354A1 (en) | 2010-11-18 | 2017-01-23 | Hardware-Based Credential Distribution |
Applications Claiming Priority (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US12/949,589 US8572699B2 (en) | 2010-11-18 | 2010-11-18 | Hardware-based credential distribution |
US14/064,004 US9553858B2 (en) | 2010-11-18 | 2013-10-25 | Hardware-based credential distribution |
US15/412,931 US20170134354A1 (en) | 2010-11-18 | 2017-01-23 | Hardware-Based Credential Distribution |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US14/064,004 Continuation US9553858B2 (en) | 2010-11-18 | 2013-10-25 | Hardware-based credential distribution |
Publications (1)
Publication Number | Publication Date |
---|---|
US20170134354A1 true US20170134354A1 (en) | 2017-05-11 |
Family
ID=45985885
Family Applications (3)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US12/949,589 Active 2031-04-10 US8572699B2 (en) | 2010-11-18 | 2010-11-18 | Hardware-based credential distribution |
US14/064,004 Active US9553858B2 (en) | 2010-11-18 | 2013-10-25 | Hardware-based credential distribution |
US15/412,931 Abandoned US20170134354A1 (en) | 2010-11-18 | 2017-01-23 | Hardware-Based Credential Distribution |
Family Applications Before (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US12/949,589 Active 2031-04-10 US8572699B2 (en) | 2010-11-18 | 2010-11-18 | Hardware-based credential distribution |
US14/064,004 Active US9553858B2 (en) | 2010-11-18 | 2013-10-25 | Hardware-based credential distribution |
Country Status (2)
Country | Link |
---|---|
US (3) | US8572699B2 (en) |
CN (1) | CN102438013B (en) |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US11539524B1 (en) * | 2018-05-30 | 2022-12-27 | Architecture Technology Corporation | Software credential token process, software, and device |
Families Citing this family (21)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101909058B (en) * | 2010-07-30 | 2013-01-16 | 天维讯达无线电设备检测(北京)有限责任公司 | Platform authentication strategy management method and system suitable for credible connecting architecture |
US8572699B2 (en) | 2010-11-18 | 2013-10-29 | Microsoft Corporation | Hardware-based credential distribution |
JP5880401B2 (en) * | 2012-11-15 | 2016-03-09 | 富士ゼロックス株式会社 | Communication apparatus and program |
GB2527276B (en) * | 2014-04-25 | 2020-08-05 | Huawei Tech Co Ltd | Providing network credentials |
US9942237B2 (en) | 2015-08-28 | 2018-04-10 | Bank Of America Corporation | Determining access requirements for online accounts based on characteristics of user devices |
US10346710B2 (en) * | 2016-09-29 | 2019-07-09 | Datacolor Inc. | Multi-agent training of a color identification neural network |
US10609037B2 (en) * | 2017-03-28 | 2020-03-31 | Ca, Inc. | Consolidated multi-factor risk analysis |
US11917070B2 (en) | 2018-02-17 | 2024-02-27 | Carrier Corporation | Method and system for managing a multiplicity of credentials |
CN110677250B (en) * | 2018-07-02 | 2022-09-02 | 阿里巴巴集团控股有限公司 | Key and certificate distribution method, identity information processing method, device and medium |
CN110795742B (en) | 2018-08-02 | 2023-05-02 | 阿里巴巴集团控股有限公司 | Metric processing method, device, storage medium and processor for high-speed cryptographic operation |
CN110795774B (en) | 2018-08-02 | 2023-04-11 | 阿里巴巴集团控股有限公司 | Measurement method, device and system based on trusted high-speed encryption card |
CN110874478B (en) | 2018-08-29 | 2023-05-02 | 阿里巴巴集团控股有限公司 | Key processing method and device, storage medium and processor |
US11232209B2 (en) | 2019-01-18 | 2022-01-25 | International Business Machines Corporation | Trojan detection in cryptographic hardware adapters |
US11032381B2 (en) * | 2019-06-19 | 2021-06-08 | Servicenow, Inc. | Discovery and storage of resource tags |
CN116668032A (en) * | 2019-09-03 | 2023-08-29 | 谷歌有限责任公司 | System and method for authentication control of content delivery |
CN111259347A (en) * | 2020-01-19 | 2020-06-09 | 苏州浪潮智能科技有限公司 | Authorization method and device for judging machine uniqueness |
US11954181B2 (en) * | 2020-12-16 | 2024-04-09 | Dell Products L.P. | System and method for managing virtual hardware licenses of hardware resources accessed via application instances |
CN112511569B (en) * | 2021-02-07 | 2021-05-11 | 杭州筋斗腾云科技有限公司 | Method and system for processing network resource access request and computer equipment |
US11843707B2 (en) * | 2021-07-12 | 2023-12-12 | Dell Products, L.P. | Systems and methods for authenticating hardware of an information handling system |
EP4181462A1 (en) * | 2021-11-11 | 2023-05-17 | Siemens Aktiengesellschaft | Method for a certificate management for heterogeneous systems, computer system and computer program product |
CN114584318B (en) * | 2022-03-07 | 2023-08-11 | 亿咖通(湖北)技术有限公司 | Certificate and key access control method, electronic equipment and storage medium |
Citations (15)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US4020326A (en) * | 1974-01-21 | 1977-04-26 | Chubb Integrated Systems Limited | Token-control |
US5311513A (en) * | 1992-09-10 | 1994-05-10 | International Business Machines Corp. | Rate-based congestion control in packet communications networks |
US6748435B1 (en) * | 2000-04-28 | 2004-06-08 | Matsushita Electric Industrial Co., Ltd. | Random early demotion and promotion marker |
US20050174944A1 (en) * | 2004-02-10 | 2005-08-11 | Adc Broadband Access Systems, Inc. | Bandwidth regulation |
US20060212407A1 (en) * | 2005-03-17 | 2006-09-21 | Lyon Dennis B | User authentication and secure transaction system |
US20070101033A1 (en) * | 2005-10-27 | 2007-05-03 | Chen Wen-Tzer T | Priority control in resource allocation for low request rate, latency-sensitive units |
US20070115817A1 (en) * | 2005-10-26 | 2007-05-24 | Qualcomm Incorporated | Minimum rate guarantees on wireless channel using resource utilization messages |
US20070209052A1 (en) * | 2004-04-05 | 2007-09-06 | Comcast Cable Holdings, Llc | Method and System for Provisioning a Set-Box |
US20080008095A1 (en) * | 2006-07-10 | 2008-01-10 | International Business Machines Corporation | Method for Distributed Traffic Shaping across a Cluster |
US20080077721A1 (en) * | 2006-09-26 | 2008-03-27 | Sony Computer Entertainment Inc. | Methods And Apparatus For Dynamic Grouping Of Requestors Of Resources In A Multi-Processor System |
US7379982B2 (en) * | 2002-04-15 | 2008-05-27 | Bassam Tabbara | System and method for custom installation of an operating system on a remote client |
US20090010165A1 (en) * | 2007-07-06 | 2009-01-08 | Samsung Electronics Cp. Ltd. | Apparatus and method for limiting packet transmission rate in communication system |
US20090313337A1 (en) * | 2008-06-11 | 2009-12-17 | Linkool International, Inc. | Method for Generating Extended Information |
US20100070758A1 (en) * | 2008-09-18 | 2010-03-18 | Apple Inc. | Group Formation Using Anonymous Broadcast Information |
US20110113242A1 (en) * | 2009-06-09 | 2011-05-12 | Beyond Encryption Limited | Protecting mobile devices using data and device control |
Family Cites Families (48)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5560008A (en) * | 1989-05-15 | 1996-09-24 | International Business Machines Corporation | Remote authentication and authorization in a distributed data processing system |
EP0781068A1 (en) * | 1995-12-20 | 1997-06-25 | International Business Machines Corporation | Method and system for adaptive bandwidth allocation in a high speed data network |
US6226743B1 (en) * | 1998-01-22 | 2001-05-01 | Yeda Research And Development Co., Ltd. | Method for authentication item |
US6754820B1 (en) * | 2001-01-30 | 2004-06-22 | Tecsec, Inc. | Multiple level access system |
US6233341B1 (en) * | 1998-05-19 | 2001-05-15 | Visto Corporation | System and method for installing and using a temporary certificate at a remote site |
JP2000032048A (en) * | 1998-07-14 | 2000-01-28 | Fujitsu Ltd | Network system |
US7106756B1 (en) * | 1999-10-12 | 2006-09-12 | Mci, Inc. | Customer resources policy control for IP traffic delivery |
DE60023490T2 (en) * | 2000-08-18 | 2006-07-13 | Alcatel | Marking apparatus for creating and inserting a priority into a data packet |
US7028179B2 (en) | 2001-07-03 | 2006-04-11 | Intel Corporation | Apparatus and method for secure, automated response to distributed denial of service attacks |
US7571239B2 (en) * | 2002-01-08 | 2009-08-04 | Avaya Inc. | Credential management and network querying |
JP2006510328A (en) * | 2002-11-18 | 2006-03-23 | トラスティッド ネットワーク テクノロジーズ インコーポレイテッド | System and apparatus using identification information in network communication |
AU2003900413A0 (en) * | 2003-01-31 | 2003-02-13 | Mckeon, Brian Bernard | Regulated issuance of digital certificates |
US7590695B2 (en) * | 2003-05-09 | 2009-09-15 | Aol Llc | Managing electronic messages |
US7287076B2 (en) * | 2003-12-29 | 2007-10-23 | Microsoft Corporation | Performing threshold based connection status responses |
KR100666980B1 (en) * | 2004-01-19 | 2007-01-10 | 삼성전자주식회사 | Method for controlling traffic congestion and apparatus for implementing the same |
US20050181765A1 (en) * | 2004-02-13 | 2005-08-18 | Gerald Mark | System and method of controlling access and credentials for events |
US7363513B2 (en) | 2004-04-15 | 2008-04-22 | International Business Machines Corporation | Server denial of service shield |
US7653199B2 (en) * | 2004-07-29 | 2010-01-26 | Stc. Unm | Quantum key distribution |
JP2006139747A (en) * | 2004-08-30 | 2006-06-01 | Kddi Corp | Communication system, and security assurance device |
US8615653B2 (en) * | 2004-09-01 | 2013-12-24 | Go Daddy Operating Company, LLC | Methods and systems for dynamic updates of digital certificates via subscription |
US20060075042A1 (en) * | 2004-09-30 | 2006-04-06 | Nortel Networks Limited | Extensible resource messaging between user applications and network elements in a communication network |
US8006288B2 (en) * | 2004-11-05 | 2011-08-23 | International Business Machines Corporation | Method and apparatus for accessing a computer application program |
US7607164B2 (en) * | 2004-12-23 | 2009-10-20 | Microsoft Corporation | Systems and processes for managing policy change in a distributed enterprise |
US8700729B2 (en) * | 2005-01-21 | 2014-04-15 | Robin Dua | Method and apparatus for managing credentials through a wireless network |
US7706778B2 (en) * | 2005-04-05 | 2010-04-27 | Assa Abloy Ab | System and method for remotely assigning and revoking access credentials using a near field communication equipped mobile phone |
US8675876B2 (en) * | 2005-11-04 | 2014-03-18 | The Board Of Trustees Of The Leland Stanford Junior University | Differential phase shift keying quantum key distribution |
CN100419773C (en) * | 2006-03-02 | 2008-09-17 | 王清华 | Permission verification and verifying system for electronic file |
US8347376B2 (en) * | 2006-03-06 | 2013-01-01 | Cisco Technology, Inc. | Techniques for distributing a new communication key within a virtual private network |
US8949933B2 (en) * | 2006-08-15 | 2015-02-03 | International Business Machines Corporation | Centralized management of technical records across an enterprise |
US10671706B2 (en) * | 2006-09-21 | 2020-06-02 | Biomedical Synergies, Inc. | Tissue management system |
US8347378B2 (en) * | 2006-12-12 | 2013-01-01 | International Business Machines Corporation | Authentication for computer system management |
JP4953801B2 (en) * | 2006-12-25 | 2012-06-13 | パナソニック株式会社 | Password setting method, video receiving system, program, and recording medium |
JP2007164806A (en) * | 2007-01-23 | 2007-06-28 | Fujitsu Ltd | Method for distributing data resource |
US20090135817A1 (en) * | 2007-08-24 | 2009-05-28 | Assa Abloy Ab | Method for computing the entropic value of a dynamical memory system |
US7895463B2 (en) * | 2007-08-28 | 2011-02-22 | Cisco Technology, Inc. | Redundant application network appliances using a low latency lossless interconnect link |
US20090109941A1 (en) * | 2007-10-31 | 2009-04-30 | Connect Spot Ltd. | Wireless access systems |
US8024782B2 (en) * | 2008-04-09 | 2011-09-20 | Zscaler, Inc. | Cumulative login credit |
EP2144421A1 (en) * | 2008-07-08 | 2010-01-13 | Gemplus | Method for managing an access from a remote device to data accessible from a local device and corresponding system |
EP2157526B1 (en) * | 2008-08-14 | 2014-04-30 | Assa Abloy Ab | RFID reader with embedded attack detection heuristics |
US8504504B2 (en) | 2008-09-26 | 2013-08-06 | Oracle America, Inc. | System and method for distributed denial of service identification and prevention |
JP4650556B2 (en) * | 2008-10-31 | 2011-03-16 | ブラザー工業株式会社 | Network equipment |
US8364766B2 (en) * | 2008-12-04 | 2013-01-29 | Yahoo! Inc. | Spam filtering based on statistics and token frequency modeling |
US8255685B2 (en) * | 2009-03-17 | 2012-08-28 | Research In Motion Limited | System and method for validating certificate issuance notification messages |
US9742560B2 (en) * | 2009-06-11 | 2017-08-22 | Microsoft Technology Licensing, Llc | Key management in secure network enclaves |
US8578504B2 (en) * | 2009-10-07 | 2013-11-05 | Ca, Inc. | System and method for data leakage prevention |
US20110161663A1 (en) * | 2009-12-29 | 2011-06-30 | General Instrument Corporation | Intelligent caching for ocsp service optimization |
US8938509B2 (en) * | 2010-10-06 | 2015-01-20 | Qualcomm Incorporated | Methods and apparatus for supporting sharing of privileges in a peer to peer system |
US8572699B2 (en) | 2010-11-18 | 2013-10-29 | Microsoft Corporation | Hardware-based credential distribution |
-
2010
- 2010-11-18 US US12/949,589 patent/US8572699B2/en active Active
-
2011
- 2011-11-18 CN CN201110367796.0A patent/CN102438013B/en active Active
-
2013
- 2013-10-25 US US14/064,004 patent/US9553858B2/en active Active
-
2017
- 2017-01-23 US US15/412,931 patent/US20170134354A1/en not_active Abandoned
Patent Citations (15)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US4020326A (en) * | 1974-01-21 | 1977-04-26 | Chubb Integrated Systems Limited | Token-control |
US5311513A (en) * | 1992-09-10 | 1994-05-10 | International Business Machines Corp. | Rate-based congestion control in packet communications networks |
US6748435B1 (en) * | 2000-04-28 | 2004-06-08 | Matsushita Electric Industrial Co., Ltd. | Random early demotion and promotion marker |
US7379982B2 (en) * | 2002-04-15 | 2008-05-27 | Bassam Tabbara | System and method for custom installation of an operating system on a remote client |
US20050174944A1 (en) * | 2004-02-10 | 2005-08-11 | Adc Broadband Access Systems, Inc. | Bandwidth regulation |
US20070209052A1 (en) * | 2004-04-05 | 2007-09-06 | Comcast Cable Holdings, Llc | Method and System for Provisioning a Set-Box |
US20060212407A1 (en) * | 2005-03-17 | 2006-09-21 | Lyon Dennis B | User authentication and secure transaction system |
US20070115817A1 (en) * | 2005-10-26 | 2007-05-24 | Qualcomm Incorporated | Minimum rate guarantees on wireless channel using resource utilization messages |
US20070101033A1 (en) * | 2005-10-27 | 2007-05-03 | Chen Wen-Tzer T | Priority control in resource allocation for low request rate, latency-sensitive units |
US20080008095A1 (en) * | 2006-07-10 | 2008-01-10 | International Business Machines Corporation | Method for Distributed Traffic Shaping across a Cluster |
US20080077721A1 (en) * | 2006-09-26 | 2008-03-27 | Sony Computer Entertainment Inc. | Methods And Apparatus For Dynamic Grouping Of Requestors Of Resources In A Multi-Processor System |
US20090010165A1 (en) * | 2007-07-06 | 2009-01-08 | Samsung Electronics Cp. Ltd. | Apparatus and method for limiting packet transmission rate in communication system |
US20090313337A1 (en) * | 2008-06-11 | 2009-12-17 | Linkool International, Inc. | Method for Generating Extended Information |
US20100070758A1 (en) * | 2008-09-18 | 2010-03-18 | Apple Inc. | Group Formation Using Anonymous Broadcast Information |
US20110113242A1 (en) * | 2009-06-09 | 2011-05-12 | Beyond Encryption Limited | Protecting mobile devices using data and device control |
Non-Patent Citations (2)
Title |
---|
Fields, "Focusing Processor Policies via Critical-Path Prediction", IEEE, 2001, pp. 74-85. * |
Newman, "HomePlug AV Security Mechanisms", IEEE, 2007, pp. 366-371. * |
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US11539524B1 (en) * | 2018-05-30 | 2022-12-27 | Architecture Technology Corporation | Software credential token process, software, and device |
US12058262B2 (en) | 2018-05-30 | 2024-08-06 | Architecture Technology Corporation | Software credential token process, software, and device |
Also Published As
Publication number | Publication date |
---|---|
US8572699B2 (en) | 2013-10-29 |
CN102438013B (en) | 2017-11-21 |
CN102438013A (en) | 2012-05-02 |
US20140059664A1 (en) | 2014-02-27 |
US9553858B2 (en) | 2017-01-24 |
US20120131652A1 (en) | 2012-05-24 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US9553858B2 (en) | Hardware-based credential distribution | |
US9819491B2 (en) | System and method for secure release of secret information over a network | |
CN108370381B (en) | System and method for detecting advanced attackers using client-side honey marks | |
US10534920B2 (en) | Distributed data storage by means of authorisation token | |
US9398001B1 (en) | System for and method of providing single sign-on (SSO) capability in an application publishing environment | |
US9047458B2 (en) | Network access protection | |
US8424077B2 (en) | Simplified management of authentication credentials for unattended applications | |
US9547756B2 (en) | Registration of devices in a digital rights management environment | |
US20100077208A1 (en) | Certificate based authentication for online services | |
US20030208681A1 (en) | Enforcing file authorization access | |
WO2019239591A1 (en) | Authentication system, authentication method, application provision device, authentication device, and authentication program | |
US10021077B1 (en) | System and method for distributing and using signed send tokens | |
US20130019281A1 (en) | Server Based Remote Authentication for BIOS | |
US8977857B1 (en) | System and method for granting access to protected information on a remote server | |
AU2003223153A1 (en) | Secure object for convenient identification | |
US10764294B1 (en) | Data exfiltration control | |
US10389693B2 (en) | Keys for encrypted disk partitions | |
US20120311331A1 (en) | Logon verification apparatus, system and method for performing logon verification | |
US9954853B2 (en) | Network security | |
US20150328119A1 (en) | Method of treating hair | |
US20200052908A1 (en) | Method and system for managing public-key client certificates | |
CN111506915B (en) | Authorized access control method, device and system | |
KR101619928B1 (en) | Remote control system of mobile | |
US11177958B2 (en) | Protection of authentication tokens | |
Tiwari et al. | Design and Implementation of Enhanced Security Algorithm for Hybrid Cloud using Kerberos |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: MICROSOFT CORPORATION, WASHINGTON Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:ANAND, GAURAV S.;WOLEY, KEVIN MICHAEL;AYERS, MATTHEW R.;AND OTHERS;SIGNING DATES FROM 20101112 TO 20101115;REEL/FRAME:041050/0603 Owner name: MICROSOFT TECHNOLOGY LICENSING, LLC, WASHINGTON Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:MICROSOFT CORPORATION;REEL/FRAME:041050/0668 Effective date: 20141014 |
|
STCB | Information on status: application discontinuation |
Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION |
|
AS | Assignment |
Owner name: HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP, TEXAS Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:MICROSOFT TECHNOLOGY LICENSING, LLC;REEL/FRAME:067330/0176 Effective date: 20240425 |