US6158007A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Security system for event based middleware
Assignee: MOREH JAHANSHAN
•
Filing: 1997-09-17
•
Granted: 2000-12-05
•
Expires: 2017-09-17
Abstract
Abstract A security system (10) for users (50) to employ applications (12) as either publishing applications (24) or subscribing applications (26), for communicating messages (16) on computer networks. Each application (12) includes a client (28) which obtains from the user (50) a user ID (52) and a password (54), for authentication to a broker (30). The messages (16) are each assigned a subject (18) having a security policy (20), which includes an access control list (70) and a quality of protection (72). The access control list (70) may specify who may publish, who may subscribe, and who may ask for guaranteed delivery of messages (16) on the associated subject (18). Similarly, the quality of protection (72) may specify whether such messages (16) are privacy, integrity, or nonrepudiation protected, and whether they are to be audited. The broker (30) then employs the security policy (20) to control publishing and subscribing of the messages (16) and to provide the requested security protections.
Inventors
- 👤 Jahanshah Moreh
- 👤 Terry M. Olkin
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-29 16:17
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/60; G06F21/62; G06F21/6218; G06F21/6227; H; H04; H04L; H04L12/00; H04L12/02; H04L12/16; H04L12/18; H04L12/1895; H04L51/00; H04L63/00; H04L63/04; H04L63/0428; H04L63/0442; H04L63/10; H04L63/105; H04L63/20; G06F2221/00; G06F2221/21; G06F2221/2141; H04L12/185; H04L63/101
Claims Analysis
Total Claims: 28
Claim 1
Independent Claim
72 words
A system for providing security for messages between users on a computer network, the system comprising: means for associating a security policy to any of a plurality of previously defined subjects, wherein said subjects are not the users; means for assigning said messages to said subjects; and a broker to identify and authorize said users and to enforce said security policies as said messages are communicated between said users in said network.
Claim 2
Independent Claim
72 words
A system for providing security for messages between users on a computer network, the system comprising: means for associating a security policy to any of a plurality of previously defined subjects, wherein said subjects are not the users; means for assigning said messages to said subjects; and a broker to identify and authorize said users and to enforce said security policies as said messages are communicated between said users in said network.
Claim 3
Dependent Claim
29 words
The system of claim 1, wherein: respective said security policies specify which said users may publish and which said users may receive said messages on associated respective said subjects.
Claim 4
Dependent Claim
105 words
The system of claim 1, wherein: specification in said security policy of at least one member of an attribute set consisting of a privacy attribute, an integrity attribute, a nonrepudiation attribute, and an audit attribute; said messages on said subjects having said privacy attribute set in their security policy are encrypted; said messages on said subjects having said integrity attribute set in their security policy are checksum protected; said messages on said subjects having said nonrepudiation attribute set in their security policy are digitally signed; and said messages on said subjects having said audit attribute set in their security policy are copied into an archive.
Claim 5
Dependent Claim
51 words
The system of claim 1, wherein: said users employ an application program to publish and receive said messages; said application program includes a client which solicits credentials from said user; and said client obtains access to publish and receive said messages on said network from said broker based upon said credentials.
Claim 6
Dependent Claim
15 words
The system of claim 4, wherein: said credentials include a user ID and a password.
Claim 7
Dependent Claim
45 words
The system of claim 4, wherein: said broker is authenticated to said client using digital certificate authentication; and said client is authenticated to said broker using a member of the authentication model set consisting of password authentication, digital certificate authentication, and third-party trusted host authentication.
Claim 8
Dependent Claim
22 words
The system of claim 1, further comprising: a security repository for securely storing said subjects, said security policies, and associations between them.
Claim 9
Dependent Claim
38 words
The system of claim 7, wherein: said plurality of previously defined subjects includes an administration subject; and said broker updates said security repository by receiving instances of said messages published on said administration subject, thereby administering the system.
Claim 10
Dependent Claim
46 words
The system of claim 8, wherein: said subjects are added to and deleted from said security repository by publication of specific said messages on said administration subject; and said security policies are added, modified, and deleted by publication of specific said messages on said administration subject.
Claim 11
Dependent Claim
49 words
The system of claim 8, wherein: said security policies include access control lists to specify which said users may publish and receive said messages on particular said subjects; and said users are added to and deleted from said access control lists by publication of messages on said administration subject.
Claim 12
Dependent Claim
40 words
The system of claim 8, wherein: said security policies include a plurality of settable security attributes for defining types of security to apply; and said security attributes are set and unset by publication of specific messages on said administration subject.
Claim 13
Dependent Claim
43 words
The system of claim 7, wherein: said subjects are ordered in a hierarchy; and said security policies assigned to higher ordered said subjects in said hierarchy apply also to lower ordered said subjects in said hierarchy, thereby permitting inheritance of said security policies.
Claim 14
Dependent Claim
45 words
The system of claim 12, wherein: said security policies assigned to higher ordered said subjects in said hierarchy are overridden by any said security policies assigned to lower ordered said subjects in said hierarchy, thereby permitting more flexible administration of inheritance by said security policies.
Claim 15
Independent Claim
64 words
A method of providing security for messages between users of a computer network, the steps comprising: defining subjects for said messages, wherein said subjects are not the users; associating a security policy with each said subject; identifying and authenticating said users to a broker; and enforcing said security policy with said broker automatically as said messages are communicated between said users in said network.
Claim 16
Independent Claim
64 words
A method of providing security for messages between users of a computer network, the steps comprising: defining subjects for said messages, wherein said subjects are not the users; associating a security policy with each said subject; identifying and authenticating said users to a broker; and enforcing said security policy with said broker automatically as said messages are communicated between said users in said network.
Claim 17
Dependent Claim
40 words
The method of claim 14, further comprising: specifying in each said security policy which of said users may publish said messages on the associated said subject and which of said users may receive said messages on the associated said subject.
Claim 18
Dependent Claim
106 words
The method of claim 14, further comprising: specifying in each said security policy at least one member of an attribute set consisting of a privacy attribute, an integrity attribute, a nonrepudiation attribute, and an audit attribute; encrypting instances of said messages on said subjects in which said security policy specifies said privacy attribute; checksumming instances of said messages on said subjects in which said security policy specifies said integrity attribute; origin vouching instances of said messages on said subjects in which said security policy specifies said nonrepudiation attribute; and auditing instances of said messages on said subjects in which said security policy specifies said audit attribute.
Claim 19
Dependent Claim
32 words
The method of claim 16, wherein: said step of encrypting uses Data Encryption Standard; said step of checksumming uses Message Digest 5; and said step of origin vouching uses Digital Signature Algorithm.
Claim 20
Dependent Claim
71 words
The method of claim 15, wherein: said users employ an application program to publish and receive said messages; and said application program includes a client which performs said step of identifying and authenticating said users to said broker; and the method further comprising: soliciting credentials from said user with said client; and controlling access of particular said users to publish and receive said messages on said network based upon said credentials.
Claim 21
Dependent Claim
29 words
The method of claim 18, further comprising: authenticating said client to said broker; and authenticating said broker to said client, thereby controlling access by said users to said network.
Claim 22
Dependent Claim
21 words
The method of claim 15, further comprising: storing said subjects, said security policies, and associations between them in a security repository.
Claim 23
Dependent Claim
39 words
The method of claim 20, further comprising: publishing administration messages on a previously defined administration subject; receiving said administration messages with said broker; and updating said security repository based upon said administration messages, thereby administering security of said network.
Claim 24
Dependent Claim
39 words
The method of claim 21, further comprising: controlling access of particular said users to publish and receive said messages on said network based upon adding to and deleting from said security repository by publication of specific said administration messages.
Claim 25
Dependent Claim
47 words
The method of claim 22, further comprising: defining at least one said user as an administration user; and publishing at least one specific said administration message requesting that only said administration users have access to publish on said administration subject, thereby controlling security over said administration subject.
Claim 26
Dependent Claim
23 words
The method of claim 23, further comprising: controlling types of security applied for specific said subjects by publication of specific said administration messages.
Claim 27
Dependent Claim
43 words
The method of claim 15, further comprising: ordering said subjects into a hierarchy; and applying said security policies assigned to higher ordered said subjects in said hierarchy also to lower ordered said subjects in said hierarchy, thereby permitting inheritance of said security policies.
Claim 28
Dependent Claim
48 words
The method of claim 25, further comprising: overriding selectively any said security policies assigned to higher ordered said subjects in said hierarchy by specifically assigning different said security policies to lower ordered said subjects in said hierarchy, thereby permitting more flexible administration of inheritance by said security policies.
References Cited (Backward Citations)
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2003-12-05 | 2004-06-05 | 2004-12-05 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2007-12-05 | 2008-06-05 | 2008-12-05 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2011-12-05 | 2012-06-05 | 2012-12-05 | $7700.00 | Window Closed / Lapsed |