Method and apparatus for issuing a credential for an incident area network

Patent metadata

Field	Value
Publication number	US-2017353451-A1
Application number	US-201615170683-A
Country	US
Kind code	A1
Filing date	Jun 1, 2016
Priority date	Jun 1, 2016
Publication date	Dec 7, 2017
Grant date	—

Abstract

A method and apparatus for issuing an incident-issued credential for an incident area network. One embodiment provides an identity server including an electronic processor configured to receive an agency-issued credential and retrieve a first set of attributes from the agency-issued credential. The electronic processor is also configured to map the first set of attributes to a scope of a service available through an incident area network. The electronic processor is further configured to generate the incident-issued credential for the incident area network including the scope and issue the incident-issued credential to a user device.

First claim

We claim:

1 . An identity server comprising:
an electronic processor configured to
receive an agency-issued credential,
retrieve a first set of attributes from the agency-issued credential,
map the first set of attributes to a scope of a service available through an incident area network,
generate an incident-issued credential for the incident area network including the scope, and
issue the incident-issued credential to a user device.

2 . The identity server of claim 1 , wherein the electronic processor is further configured to map the first set of attributes to a second set of attributes, wherein the incident-issued credential includes the second set of attributes.

3 . The identity server of claim 2 , wherein the second set of attributes includes an incident command system attribute.

4 . The identity server of claim 2 , wherein the electronic processor is configured to map the first set of attributes to the scope based on the second set of attributes.

5 . The identity server of claim 2 , wherein the electronic processor is configured to map the first set of attributes to the second set of attributes based on a context of an incident associated with the incident area network, the context including at least one selected from the group consisting of a type of the incident, a size of the incident, a condition of the incident, a location of the incident, a time of day, a number of resources at the incident, a type of resource at the incident, and a needed but missing resource at the incident.

6 . The identity server of claim 1 , wherein the electronic processor is configured to map the first set of attributes to the scope based on a context of an incident associated with the incident area network, the context including at least one selected from the group consisting of a type of the incident, a size of the incident, a condition of the incident, a location of the incident, a time of day, a number of resources at the incident, a type of resource at the incident, and a needed but missing resource at the incident.

7 . The identity server of claim 1 , wherein the agency-issued credential is associated with a user of the user device and wherein the electronic processor is further configured to prompt the user device for data identifying the user device and map the first set of attributes to the scope based on the data identifying the user device.

8 . The identity server of claim 1 , wherein the agency-issued credential is associated with a user of the user device and wherein the first set of attributes includes at least one selected from the group consisting of a level of capability of the user, a level of qualification of the user, and a level of training of the user.

9 . The identity server of claim 1 , wherein the agency-issued credential is a first agency-issued credential and is associated with a user of the user device and wherein the electronic processor is further configured to receive a second agency-issued credential associated with the user device and wherein the electronic processor is configured to map the first set of attributes to the scope based on the first agency-issued credential and the second agency-issued credential.

10 . The identity server of claim 9 , wherein the second agency-issued credential includes a third set of attributes, wherein the third set of attributes include at least one selected from the group consisting of a type of the user device, a model number of the user device, an assurance level of the user device, and a security capability of the user device.

11 . The identity server of claim 1 , wherein the electronic processor is further configured to update an attribute provider based on the scope.

12 . An identity server comprising:
an electronic processor configured to
receive an agency-issued credential,
retrieve a first set of attributes from the agency-issued credential,
map the first set of attributes to a second set of attributes based on a context of an incident associated with an incident area network, and
generate an incident-issued credential for the incident area network associated with the incident including the second set of attributes;
issue the incident-issued credential to a user device.

13 . The identity server of claim 12 , wherein the context includes at least one selected from the group consisting of a type of the incident, a size of the incident, a condition of the incident, a location of the incident, a time of day, number of resources at the incident, a type of resource at the incident, and a needed but missing resources at the incident.

14 . The identity server of claim 12 , wherein the agency-issued credential is associated with a user of the user device and wherein the electronic processor is further configured to prompt the user device for data identifying the user device and wherein the electronic processor is configured to map the first set of attributes to the second set of attributes based on the data identifying the user device.

15 . The identity server of claim 12 , wherein the agency-issued credential is associated with a user of the user device and wherein the first set of attributes includes at least one selected from the group consisting of a level of capability of the user, a level of qualification of the user, and a level of training of the user.

16 . The identity server of claim 12 , wherein the agency-issued credential is a first agency-issued credential and is associated with a user of the user device and wherein the electronic processor is further configured to receive a second agency-issued credential associated with the user device and wherein the electronic processor is configured to map the first set of attributes to the second set of attributes based on the first agency-issued credential and the second agency-issued credential.

17 . The identity server of claim 16 , wherein the second agency-issued credential includes a third set of attributes, wherein the third set of attributes include at least one selected from the group consisting of a type of the user device, a model number of the user device, an assurance level of the user device, and a security capability of the user device.

18 . The identity server of claim 12 , wherein the incident-issued credential includes a long term incident-issued credential and wherein the electronic processor is further configured to receive a request to access a service available through the incident area network, the request including the long term incident-issued credential, query an attribute provider for the second set of attributes, and generate a short term incident-issued credential in response to the request based on the second set of attributes.

19 . A method of issuing an incident-issued credential for an incident area network, the method comprising:
receiving, with an identity server, an agency-issued credential; retrieving, with the identity server, a first set of attributes from the agency-issued credential; mapping, with the identity server, the first set of attributes to a second set of attributes based a context of an incident associated with the incident area network; generating the incident-issued credential based on the second set of attributes; and issuing, with the identity server, the incident-issued credential to a user device.

20 . The method of claim 19 , wherein the context includes at least one selected from the group consisting of a type of the incident, a size of the incident, a condition of the incident, a location of the incident,

Assignees

• Motorola Solutions Inc

Inventors

• Metke Anthony R
• Lewis Adam C
• Thomas Shanthi E

Classifications

• H04W12/06

  Authentication · CPC title

• H04W4/90 Primary

  Services for handling of emergency or hazardous situations, e.g. earthquake and tsunami warning systems [ETWS] · CPC title

• H04L63/0876 Primary

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title