World-driven access control using trusted certificates

Patent metadata

Field	Value
Publication number	US-9697365-B2
Application number	US-201414166774-A
Country	US
Kind code	B2
Filing date	Jan 28, 2014
Priority date	Sep 6, 2013
Publication date	Jul 4, 2017
Grant date	Jul 4, 2017

Abstract

Functionality is described herein for receiving events which characterize features in an environment, and for identifying at least one policy based on the events. The functionality consults a certificate, associated with the policy, to determine whether the policy is valid. If valid, the functionality uses the policy to govern the behavior of at least one application, such as by controlling the application's consumption of events. A trusted passport authority may be employed to generate the certificates. Each certificate may: (1) identify that it originated from the trusted passport authority; (2) contain context information which describes a context in which the policy is intended to be applied within an environment; and/or (3) contain machine-readable content that, when executed, carries out at least one aspect of the policy.

First claim

What is claimed is:

1. A method comprising:
by one or more computing devices:
receiving audio, image, or video events that characterize a physical environment sensed by the one or more computing devices, the audio, image, or video events including individual audio, image, or video events characterizing a person that is present in the sensed physical environment;
identifying a triggering cue in the audio, image, or video events that characterize the sensed physical environment;
responsive to identifying the triggering cue in the audio, image, or video events that characterize the sensed physical environment, obtaining a policy associated with the person that is present in the sensed physical environment;
obtaining a certificate associated with the policy and a public key associated with a certificate-originating entity;
determining whether the policy is valid based at least on whether the certificate is decrypted using the public key associated with the certificate-originating entity; and
when the policy is determined to be valid, governing behavior of one or more applications with respect to the individual audio, image, or video information characterizing the person that is present in the sensed physical environment, the behavior being governed by filtering or modifying the individual audio, image, or video events characterizing the person that is present in the sensed physical environment.

2. The method of claim 1 , further comprising:
obtaining the certificate from the certificate-originating entity, wherein the certificate-originating entity is a trusted passport authority entity.

3. The method of claim 1 , the certificate conferring a right to an individual application with respect to the individual audio, image, or video events characterizing the person that is present in the sensed physical environment.

4. The method of claim 1 , further comprising:
successfully decrypting the certificate with the public key associated with the certificate-originating entity; and
determining that the policy is valid responsive to successful decryption of the certificate.

5. The method of claim 1 , wherein the determining of whether the policy is valid includes determining whether the audio, image, or video events indicate that the sensed physical environment matches context information identified by the certificate.

6. The method of claim 5 , wherein the context information specifies a physical region in which the policy is intended to be applied.

7. The method of claim 1 , wherein the one or more applications include an augmented reality application that combines the audio, image, or video events with other information to produce an output presentation representing the sensed physical environment as modified by the other information.

8. The method of claim 1 ,
wherein the certificate provides executable instructions that, when executed, perform at least one function associated with the policy, and
wherein the method further comprises configuring said one or more computing devices based at least on the executable instructions provided by the certificate.

9. The method of claim 8 , wherein the executable instructions, when executed, detect the triggering cue in the audio, image, or video events that characterize the sensed physical environment.

10. The method of claim 1 , the triggering cue being present in the individual image, audio, or video information characterizing the person that is present in the sensed physical environment.

11. The method of claim 10 , the triggering cue being a badge worn by the person.

12. The method of claim 1 , wherein the triggering cue is a sound that identifies the policy.

13. The method of claim 12 , wherein the sound is a spoken message sensed by the one or more computing devices, the spoken message identifying the policy.

14. The method of claim 1 ,
wherein said identifying comprises applying a confidence level to determine whether the triggering cue is present within the sensed physical environment,
the confidence level accommodating a degree of jitter in detection of the triggering cue.

15. The method of claim 1 , wherein said identifying comprises detecting the triggering cue and another triggering cue that identifies another policy, using at least two respective recognizers.

16. The method of claim 15 , further comprising:
resolving a conflict between the policy and the another policy.

17. One or more computing devices comprising:
one or more storage resources storing instructions; and
one or more processing devices configured to execute the instructions,
the instructions, when executed by the one or more processing devices, causing the one or more processing devices to:
obtain audio, image, or video events that characterize a sensed physical environment using sensor information obtained by at least one sensing mechanism, the audio, image, or video events including audio, image, or video information characterizing an inanimate object that is present in the sensed physical environment;
process the audio, image, or video events to identify a triggering cue in the sensed physical environment that identifies a policy relating to the inanimate object that is present in the sensed physical environment;
receive a certificate associated with the policy;
determine whether the policy is valid based at least on whether the certificate is decrypted using a public key associated with a certificate-originating entity;
responsive to a determination that the certificate is valid, set application permission information based at least on the policy; and
govern behavior of one or more applications based at least on the application permission information by filtering or modifying the audio, image, or video information characterizing the inanimate object that is present in the sensed physical environment before providing the audio, image, or video information characterizing the inanimate object to the one or more applications.

18. The one or more computing devices of claim 17 , the instructions, when executed by the one or more processing devices, causing the one or more processing devices to:
provide the audio, image, or video information characterizing the inanimate object to a first application, as specified by the policy; and
prevent a second application from receiving the audio, image, or video information characterizing the inanimate object, as specified by the policy.

19. One or more computing devices comprising:
one or more storage resources storing instructions; and
one or more processing devices configured to execute the instructions,
the instructions, when executed by the one or more processing devices, causing the one or more processing devices to:
obtain audio, image, or video events that characterize a sensed physical environment using sensor information obtained by at least one sensing mechanism;
process the audio, image, or video events to identify a triggering cue that is present in the sensed physical environment and a target feature that is present in the sensed physical environment;
obtain a policy identified by the triggering cue, the policy restricting application access to individual audio, image, or video events that characterize the target feature that is present in the sensed physical environment;
obtain a certificate associated with the policy and determine whether the policy is valid based at least on whether the certificate is decrypted using a public key associated with a certificate-originating entity;
responsive to a determination that the certificate i

Assignees

• Microsoft Corp
• Microsoft Technology Licensing Llc

Inventors

• Kohno Tadayoshi
• Molnar David A
• Moshchuk Alexander N
• Roesner Franziska
• Wang Jiahe Helen

Classifications

• H04L63/102

  Entity profiles · CPC title

• G06F21/6245 Primary

  Protecting personal data, e.g. for financial or medical purposes · CPC title

• H04L63/107

  wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• G06F21/60 Primary

  Protecting data · CPC title