Granted Patent B2

US 12,580,740 · App. 18/045,335 · Granted Mar 17, 2026

Inventors: Ramarathnam Venkatesan (Redmond, WA); Nishanth Chandran (Bangalore, IN); Ganesh Ananthanarayanan (Sammamish, WA); Panagiotis Antonopoulos (Redmond, WA); Srinath T. V. Setty (Redmond, WA); Daniel John Carroll, Jr. (Columbia, MD); Kiran Muthabatulla (Sammamish, WA); Yuanchao Shu (Kirkland, WA); Sanjeev Mehrotra (Kirkland, WA)

Assignee: MICROSOFT TECHNOLOGY LICENSING, LLC

H04L9/0825H04L9/085H04L9/0866

Abstract

Claims (51)

1 . An access control system, comprising:

a processor circuit; and

a memory that stores program code configured to be executed by the processor circuit, the program code, when executed by the processor circuit, causes the system to:

receive a request originating from a computing device to access an encrypted resource;

access a resource policy that indicates a set of requirements for accessing the encrypted resource, the set of requirements including a static attribute requirement and a dynamic attribute requirement;

receive a proof of a static attribute from the computing device, the proof indicating that a user of the computing device possesses the static attribute, the static attribute being associated with a first shared secret stored on the computing device;

validate the proof of the static attribute based at least on information in a trusted ledger associated with the user of the device;

determine that the validated proof satisfies the static attribute requirement;

in response to the determination that the validated proof satisfies the static attribute requirement, provide a certificate validating the dynamic attribute requirement to a decryption algorithm, the certificate including a second shared secret corresponding to a dynamic attribute; and

provide the first shared secret to the decryption algorithm, wherein the first shared secret and the second shared secret in the certificate are used by the decryption algorithm to compute a decryption key for the encrypted resource.

2 . The system of claim 1 , wherein the proof indicating that the user of the computing device possesses the static attribute is a cryptographic proof that comprises a value generated based at least on the first shared secret corresponding to the static attribute, a public key corresponding to the static attribute, and an encryption algorithm.

3 . The system of claim 2 , wherein the first shared secret corresponding to the static attribute cannot be reconstructed from the value in the cryptographic proof.

4 . The system of claim 1 , wherein the dynamic attribute requirement is a location requirement that requires that the user device be physically located within a proximity of a predetermined location at a time the request is received.

5 . The system of claim 1 , wherein the resource policy further indicates a purpose requirement that defines a predetermined purpose required to access the encrypted resource, and

wherein the program code further verifies that the purpose requirement is satisfied prior to providing the certificate validating the dynamic attribute requirement.

6 . The system of claim 1 , wherein information contained in the trusted ledger comprises a user identifier, a public key corresponding to the static attribute, and an encrypted version of the first shared secret corresponding to the static attribute.

7 . The system of claim 6 , wherein the program code further validates the proof of the static attribute by comparing a first value determined from the encrypted version of the first shared secret and the public key corresponding to the static attribute with a second value based on the proof of the static attribute received from the computing device.

8 . The system of claim 1 , wherein the decryption algorithm further:

provides, to the computing device, the decryption key for decrypting the encrypted resource.

9 . The system of claim 1 , wherein the program code further:

receives identification information from the computing device; and

identifies the information in the trusted ledger based on the identification information.

10 . An access control method, comprising:

receiving a request originating from a computing device to access an encrypted resource;

accessing a resource policy that indicates a set of requirements for accessing the encrypted resource, the set of requirements including a static attribute requirement and a dynamic attribute requirement;

receiving a proof of a static attribute from the computing device, the proof indicating that a user of the computing device possesses the static attribute, the static attribute being associated with a first shared secret stored on the computing device;

validating the proof of the static attribute based at least on information in a trusted ledger associated with the user of the device;

determining that the validated proof satisfies the static attribute requirement;

in response to the determination that the validated proof satisfies the static attribute requirement, providing a certificate validating the dynamic attribute requirement to a decryption algorithm, the certificate including a second shared secret corresponding to a dynamic attribute; and

providing the first shared secret to the decryption algorithm, wherein the first shared secret and the second shared secret in the certificate are used by the decryption algorithm to compute a decryption key for the encrypted resource.

11 . The method of claim 10 , wherein the proof indicating that the user of the computing device possesses the static attribute is a cryptographic proof that comprises a value generated based at least on the first shared secret corresponding to the static attribute, a public key corresponding to the static attribute, and an encryption algorithm.

12 . The method of claim 11 , wherein the first shared secret corresponding to the static attribute cannot be reconstructed from the value in the cryptographic proof.

13 . The method of claim 10 , wherein the dynamic attribute requirement is a location requirement that requires that the user device be physically located within a proximity of a predetermined location at a time the request is received.

14 . The method of claim 10 , wherein the resource policy further indicates a purpose requirement that defines a predetermined purpose required to access the encrypted resource, and

wherein the method further comprises verifying that the purpose requirement is satisfied prior to providing the certificate validating the dynamic attribute requirement.

15 . The method of claim 10 , wherein information contained in the trusted ledger comprises a user identifier, a public key corresponding to the static attribute, and an encrypted version of the first shared secret corresponding to the static attribute.

16 . The method of claim 15 , wherein the method further comprises validating the proof of the static attribute by comparing a first value determined from the encrypted version of the first shared secret and the public key corresponding to the static attribute with a second value based on the proof of the static attribute received from the computing device.

17 . The method of claim 10 , wherein the decryption algorithm further:

provides, to the computing device, the decryption key for decrypting the encrypted resource.

18 . The method of claim 10 , further comprising:

receiving identification information from the computing device; and

identifying the information in the trusted ledger based on the identification information.

19 . A computer-readable storage medium having computer program code recorded thereon that when executed by at least one processor causes the at least one processor to perform a method comprising:

receiving a request originating from a computing device to access an encrypted resource;

accessing a resource policy that indicates a set of requirements for accessing the encrypted resource, the set of requirements including a static attribute requirement and a dynamic attribute requirement;

receiving a proof of a static attribute from the computing device, the proof indicating that a user of the computing device possesses the static attribute, the static attribute being associated with a first shared secret stored on the computing device;

validating the proof of the static attribute based at least on information in a trusted ledger associated with the user of the device;

determining that the validated proof satisfies the static attribute requirement;

in response to the determination that the validated proof satisfies the static attribute requirement, providing a certificate validating the dynamic attribute requirement to a decryption algorithm, the certificate including a second shared secret corresponding to a dynamic attribute; and

providing the first shared secret to the decryption algorithm, wherein the first shared secret and the second shared secret in the certificate are used by the decryption algorithm to compute a decryption key for the encrypted resource.

20 . The computer-readable storage medium of claim 19 , wherein the proof indicating that the user of the computing device possesses the static attribute is a cryptographic proof that comprises a value generated based at least on the first shared secret corresponding to the static attribute, a public key corresponding to the static attribute, and an encryption algorithm.

Assignments (1)

Continuity (1)

References Cited (87)

Cited By (1)

US 12,701,008