Anne Christina Anderson

US Patent:

6801998, Oct 5, 2004

Filed:

Nov 12, 1999

Appl. No.:

09/439246

Inventors:

Stephen R. Hanna - Bedford MA
Anne H. Anderson - Acton MA
Yassir K. Elley - Waltham MA
Radia J. Perlman - Acton MA
Sean J. Mullan - Sandymount Dublin-4, IE

Assignee:

Sun Microsystems, Inc. - Palo Alto CA

International Classification:

H04L 900

US Classification:

713155, 713158, 713175, 713184, 713201

Abstract:

A method and system for granting an applicant associated with a client computer in a client-server system access to a requested service without providing the applicant with intelligible information regarding group membership. The applicant transmits a request for service to an application server over a computer network. In response, the application server prepares an encrypted message which includes the identification of the group or groups having access privileges and transmits the encrypted message to the client along with a request that the client prove membership in at least one of the groups. The message is encrypted with an encryption key which can be decrypted by a group membership server.

US Patent:

6883100, Apr 19, 2005

Filed:

May 10, 1999

Appl. No.:

09/309045

Inventors:

Yassir K. Elley - Cambridge MA, US
Anne H. Anderson - Acton MA, US
Stephen R. Hanna - Bedford MA, US
Sean J. Mullan - Watertown MA, US
Radia J. Perlman - Acton MA, US

Assignee:

Sun Microsystems, Inc. - Santa Clara CA

International Classification:

G06F009/00

US Classification:

713201, 713202

Abstract:

In accordance with the invention, on-line group servers issue group membership or group non-membership certificates upon request. Furthermore, when a requester requests a group certificate for a particular entity, the associated group server makes a dynamic decision regarding the entity's membership in the group rather than simply referring to a membership list. These capabilities provide for, among other things, the implementation of “nested” groups, wherein an entity may indirectly prove membership in a first, or nested, group by proving membership in a second group which is a member of the first group. In the nested group situation, the dynamic decision may involve the group server of the nested group obtaining proof of the entity's membership or non-membership in the second group. Proof of membership or non-membership may include a group certificate and/or a group membership list.

US Patent:

6973569, Dec 6, 2005

Filed:

Jun 30, 2000

Appl. No.:

09/608264

Inventors:

Anne H. Anderson - Acton MA, US
Stephen R. Hanna - Bedford MA, US

Assignee:

Sun Microsystems, Inc. - Santa Clara CA

International Classification:

H04L009/00

US Classification:

713156, 713200

Abstract:

A certification authority generates certificates in response to respective certification requests. The certification authority generally includes a computer that is bootable from a removable medium and a removable medium. The removable medium includes a machine readable medium having encoded thereon an operating system module configured to enable the computer to boot from the removable medium and a certificate generation module configured to, after the computer has been booted, control the computer to facilitate the generation of at least one certificate in response to an associated certificate request, the certification authority module being configured to provide that the computer not be remotely controlled during a certificate generation session.

US Patent:

7010690, Mar 7, 2006

Filed:

Jul 7, 2000

Appl. No.:

09/612057

Inventors:

Stephen R. Hanna - Bedford MA, US
Anne H. Anderson - Acton MA, US
Yassir K. Elley - Waltham MA, US

Assignee:

Sun Microsystems, Inc. - Santa Clara CA

International Classification:

H04L 9/00

US Classification:

713170, 713186

Abstract:

A method and apparatus for authenticating and authorizing a user of a device connected to a network. In one embodiment, a set of credential descriptors is generated that describes credentials that must be built for authenticating the user. The set of credential descriptors is provided to a first device, which includes a first master credential builder for building credentials corresponding to at least one of the credential descriptors. In the event that the first master credential builder does not build all of the credentials corresponding to the set of credential descriptors, another set of credential descriptors is provided to a second device, which includes a second master credential builder for building at least one credential remaining to be built. This process continues until all credentials have been built or a determination is made that they cannot be built. After all credentials have been built, the credentials are provided to a master credential evaluator, which may be included in the first device, the second device, or another device.

US Patent:

7054905, May 30, 2006

Filed:

Mar 30, 2000

Appl. No.:

09/539269

Inventors:

Stephen R. Hanna - Bedford MA, US
David C. Douglas - Concord MA, US
Yassir K. Elley - Waltham MA, US
Radia J. Perlman - Acton MA, US
Sean J. Mullan - Dublin, IE
Anne H. Anderson - Acton MA, US

Assignee:

Sun Microsystems, Inc. - Santa Clara CA

International Classification:

G06F 15/16
H04L 9/00

US Classification:

709206, 709229, 713168

Abstract:

One embodiment of the present invention provides a system that replaces an attachment to an email message with a reference to a location where the attachment is stored. Upon receiving the email message, the system examines the email message to determine if the email message includes an attachment. If the email message includes the attachment, the system stores the attachment at a location on a communication network from which the attachment can be retrieved. The system also modifies the email message by replacing the attachment with a reference specifying the location of the attachment, and sends the modified email message to a recipient of the email message. In one embodiment of the present invention, the recipient receives the modified email message and uses the reference specifying the location of the attachment to retrieve the attachment across the communication network.

US Patent:

7058798, Jun 6, 2006

Filed:

Apr 11, 2000

Appl. No.:

09/547183

Inventors:

Yassir K. Elley - Waltham MA, US
Anne H. Anderson - Acton MA, US
Stephen R. Hanna - Bedford MA, US
Sean J. Mullan - Dublin, IE
Radia Joy Perlman - Acton MA, US

Assignee:

Sun Microsystems, Inc. - Santa Clara CA

International Classification:

G06F 7/04

US Classification:

713 26, 726 30, 726 7

Abstract:

The basic concept is that before a resource is accessed, the entity that has the burden of gathering the credentials, pro-actively refreshes the credentials and keeps them current. In one instance, a presenter of credentials, for example, a client, pro-actively refreshes the credentials such that at the time of presentation, the credentials meet the resource-specific constraints of a recipient of credentials, for example, a resource server. For each resource that it protects, a resource server typically establishes various constraints such as a recency requirement, which specifies how recently a credential has to have been issued to be accepted as an adequate credential. Other constraints may include maximum certificate chain length, trust level and so forth. In another instance, a recipient of credentials pro-actively gathers and refreshes credentials to prevent un-authorized access to the various resources it is protecting.

US Patent:

7085925, Aug 1, 2006

Filed:

Apr 3, 2001

Appl. No.:

09/825100

Inventors:

Stephen R. Hanna - Bedford MA, US
Anne H. Anderson - Acton MA, US
Yassir K. Elley - Waltham MA, US
Radia J. Perlman - Acton MA, US
Sean J. Mullan - Dublin, IE

Assignee:

Sun Microsystems, Inc. - Santa Clara CA

International Classification:

H04L 9/00
H04L 9/32

US Classification:

713157, 726 10, 713155, 713175

Abstract:

A method and system for evaluating a set of credentials that includes at least one group credential and that may include one or more additional credentials. A trust rating is provided in association with the at least one group credential within the set of credentials and trust ratings may also be provided in other credentials within the set of credentials. Each trust rating provides an indication of the level of confidence in the information being certified in the respective credential. In response to a request for access to a resource or service, an evaluation of the group credentials is performed by an access control program to determine whether access to the requested resource or service should be provided. In one embodiment, within any given certification path a composite trust rating for the respective path is determined. An overall trust rating for the set of credentials is determined based upon the composite trust ratings.

US Patent:

7213262, May 1, 2007

Filed:

May 10, 1999

Appl. No.:

09/310165

Inventors:

Yassir K. Elley - Cambridge MA, US
Anne H. Anderson - Acton MA, US
Stephen R. Hanna - Bedford MA, US
Sean J. Mullan - Watertown MA, US
Radia J. Perlman - Acton MA, US

Assignee:

Sun Microsystems, Inc. - Santa Clara CA

International Classification:

H04L 9/32
G06F 15/16
G06F 17/30

US Classification:

726 10, 713157, 713175, 709229

Abstract:

In accordance with the invention, a presenter of credentials presents to a recipient of credentials one or more chains of group credentials to prove entity membership or non-membership in a nested group in a computer network. The ability to present a chain of credentials is particularly important when a client is attempting the prove membership or non-membership in a nested group and one or more of the group servers in the family tree are off-line. A chain of group credentials includes two or more proofs of group membership and/or proofs of group non-membership Furthermore, the proofs of group membership may include one or more group membership certificates and/or one or more group membership lists; and proofs of group non-membership may include one or more group non-membership certificates and/or one or more group membership lists.