Access relationships in a computer system

Patent metadata

Field	Value
Publication number	US-11700258-B2
Application number	US-201615394871-A
Country	US
Kind code	B2
Filing date	Dec 30, 2016
Priority date	Dec 30, 2016
Publication date	Jul 11, 2023
Grant date	Jul 11, 2023

Abstract

The disclosure relates to methods and apparatuses for controlling access relationships between entities in a computerized system. A chain of access relationships from a first entity via at least one intermediate entity to a second entity is determined. At least one direct access relationship is then created between the first entity and the second entity based on information of the determined chain of access relationships.

First claim

I claim:

1. A method for controlling, by a network control apparatus of a computerised network system, trust relationships between entities capable of communicating with each other in the computerised network system, the method comprising:
determining, by the network control apparatus, an existing chain of trust relationships from a first entity via at least one intermediate entity to a second entity, wherein the first entity, the second entity, and the at least one intermediate entity each provide a separate node in the determined existing chain of trust relationships,
creating, by the network control apparatus and based on the determined existing chain of trust relationships from the first entity via the at least one intermediate entity to the second entity, at least one new secured direct trust relationship between the first entity and the second entity, wherein the created at least one new secured direct trust relationship between the first entity and the second entity provides a shorter chain of trust relationships via fewer intermediate entities than the determined existing chain of trust relationships from the first entity via the at least one intermediate entity to the second entity and wherein the created at least one new secured direct trust relationship is secured based on security credentials comprising at least one of a key or a certificate according to a security protocol, and
causing, by the network control apparatus, storing information of the created at least one new secured direct trust relationship between the first entity and the second entity in a database of trust relationships.

2. The method of claim 1 , comprising routing data between the first entity and the second entity according to the created at least one new secured direct trust relationship.

3. The method of claim 1 , comprising continuing storing information of the existing chain of trust relationships in the database after the creation of the at least one new secured direct trust relationship.

4. The method of claim 1 , comprising replacing information of the existing chain of trust relationships by the information of the created at least one new secured direct trust relationship.

5. The method of claim 1 , comprising displaying a graphical presentation comprising the created at least one new secured direct trust relationship.

6. The method of claim 1 , comprising determining whether at least a part of the existing chain of trust relationships can be replaced by a created new secured direct trust relationship.

7. The method of claim 1 , comprising determining that the existing chain of trust relationships violates a policy, a rule, or a setting, and in response thereto replacing at least a segment of the existing chain of trust relationships with a created new secured direct trust relationship between end nodes of the segment.

8. The method of claim 1 , comprising selectively creating a new secured direct trust relationship between the first entity and the second entity, the selectively creating comprising taking into account at least one of:
potential consequences of deletion of at least one trust relationship of the existing chain of trust relationships,
data traffic through at least one node associated with the existing chain of trust relationships,
a policy, a rule, or a setting relating to trust relationships,
input via a user interface,
encryption keys used in association with the existing chain of trust relationships,
one or more encryption algorithms used in association with the existing chain of trust relationships,
an approver of at least one trust relationship of the existing chain of trust relationships,
identities of users, hosts, hosts groups, and/or other nodes associated with the existing chain of trust relationships,
security credentials used for the existing chain of trust relationships,
validity of security credentials used for the existing chain of trust relationships,
a number of hops between nodes in the existing chain of trust relationships,
whether enumerated nodes are associated with the existing chain of trust relationships,
a maximum validity period of trust relationships in the existing chain of trust relationships,
a number of users of a node in the existing chain of trust relationships,
a number of incoming and/or outgoing trust relationships into and/or out from one or more nodes in the existing chain of trust relationships,
sameness of trust relationships in the existing chain of trust relationships,
a source of originating user identity information, or
software products used in nodes associated with the existing chain of trust relationships.

9. The method of claim 1 , comprising decrypting by an intermediate apparatus at least a part of communications between the first entity and the second entity.

10. The method of claim 1 , wherein each of the first entity, the at least one intermediate entity, and the second entity comprises a device that uses at least one of a key managed by a key manager or a certificate issued by a certificate authority.

11. The method of claim 1 , comprising using the created at least one new secured shorter direct trust relationship between the first entity and the second entity instead of the existing chain of trust relationships and the created at least one new secured shorter direct trust relationship between the first entity and the second entity is independent of the at least one intermediate entity.

12. A network apparatus for controlling trust relationships between entities communicating in a network, the network apparatus comprising at least one processor, and at least one memory including computer program code, wherein the at least one memory and the computer program code are configured, with the at least one processor, to cause the network apparatus to:
determine an existing chain of trust relationships from a first entity via at least one intermediate entity to a second entity, wherein the first entity, the second entity, and the at least one intermediate entity each provide a separate node in the determined existing chain of trust relationships,
create, based on the determined existing chain of trust relationships from the first entity via the at least one intermediate entity to the second entity, at least one new secured direct trust relationship between the first entity and the second entity, wherein the created at least one new secured direct trust relationship between the first entity and the second entity provides a shorter chain of trust relationships via fewer intermediate entities than the determined existing chain of trust relationships from the first entity via the at least one intermediate entity to the second entity and wherein the created at least one new secured direct trust relationship is secured based on security credentials comprising at least one of a key or a certificate according to a security protocol, and
store in the at least one memory information of the created at least one new secured direct trust relationship.

13. The network apparatus of claim 12 , configured to cause routing of data between the first entity and the second entity according to the created at least one new secured direct trust relationship.

14. The network apparatus of claim 12 , configured to also store information of the existing chain of trust relationships after the creation of the at least one new secured direct trust relationship.

15. The network apparatus of claim 12 , configured to cause replacement of the existing chain of trust relationships by the created at least one new secured direct trust relationship.

16. The network

Assignees

• Ssh Communications Security Oyj

Inventors

• Luukkala Vesa

Classifications

• H04L63/102

  Entity profiles · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L63/0823 Primary

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L63/06

  for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08) · CPC title

• H04L63/0281

  Proxies · CPC title