-
1.发明授权公开(公告)号：US09560036B2
公开(公告)日：2017-01-31
申请号：US12832307
申请日：2010-07-08
申请人： Heather M. Hinton , Steven A. Bade , Jeb Linton , Peter Rodriguez
发明人： Heather M. Hinton , Steven A. Bade , Jeb Linton , Peter Rodriguez
CPC分类号： H04L63/0815 , H04L9/3228
摘要： A method to enable access to resources hosted in a compute cloud begins upon receiving a registration request to initiate a user's registration to use resources hosted in the compute cloud. During a registration process initiated by receipt of the registration request, a federated single sign-on (F-SSO) request is received. The F-SSO request includes an assertion (e.g., an HTTP-based SAML assertion) having authentication data (e.g., an SSH public key, a CIFS username, etc.) for use to enable direct user access to a resource hosted in the compute cloud. Upon validation of the assertion, the authentication data is deployed within the cloud to enable direct user access to the compute cloud resource using the authentication data. In this manner, the cloud provider provides authentication, single sign-on and lifecycle management for the user, despite the “air gap” between the HTTP protocol used for F-SSO and the non-HTTP protocol used for the user's direct access to the cloud resource.
摘要翻译： 能够访问计算云中托管的资源的方法从接收到注册请求开始，以启动用户的注册以使用计算云中托管的资源。 在通过接收注册请求发起的注册过程中，接收到联合单点登录（F-SSO）请求。 F-SSO请求包括具有认证数据（例如，SSH公钥，CIFS用户名等）的断言（例如，基于HTTP的SAML断言），用于使直接用户能够访问计算机中托管的资源 云。 在确认断言之后，将认证数据部署在云中，以使用身份验证数据可以直接访问计算云资源。 以这种方式，云提供商为用户提供身份验证，单点登录和生命周期管理，尽管用于F-SSO的HTTP协议与用于用户直接访问的非HTTP协议之间存在“空白” 云资源。
-
2.发明申请公开(公告)号：US20120011578A1
公开(公告)日：2012-01-12
申请号：US12832307
申请日：2010-07-08
申请人： Heather M. Hinton , Steven A. Bade , Jeb Linton , Peter Rodriguez
发明人： Heather M. Hinton , Steven A. Bade , Jeb Linton , Peter Rodriguez
CPC分类号： H04L63/0815 , H04L9/3228
摘要： A method to enable access to resources hosted in a compute cloud begins upon receiving a registration request to initiate a user's registration to use resources hosted in the compute cloud. During a registration process initiated by receipt of the registration request, a federated single sign-on (F-SSO) request is received. The F-SSO request includes an assertion (e.g., an HTTP-based SAML assertion) having authentication data (e.g., an SSH public key, a CIFS username, etc.) for use to enable direct user access to a resource hosted in the compute cloud. Upon validation of the assertion, the authentication data is deployed within the cloud to enable direct user access to the compute cloud resource using the authentication data. In this manner, the cloud provider provides authentication, single sign-on and lifecycle management for the user, despite the “air gap” between the HTTP protocol used for F-SSO and the non-HTTP protocol used for the user's direct access to the cloud resource.
摘要翻译： 能够访问计算云中托管的资源的方法从接收到注册请求开始，以启动用户的注册以使用计算云中托管的资源。 在通过接收注册请求发起的注册过程中，接收到联合单点登录（F-SSO）请求。 F-SSO请求包括具有认证数据（例如，SSH公钥，CIFS用户名等）的断言（例如，基于HTTP的SAML断言），用于使直接用户能够访问计算机中托管的资源 云。 在确认断言之后，将认证数据部署在云中，以使用身份验证数据可以直接访问计算云资源。 以这种方式，云提供商为用户提供身份验证，单点登录和生命周期管理，尽管用于F-SSO的HTTP协议与用于用户直接访问的非HTTP协议之间存在“空白” 云资源。
-
公开(公告)号：US08707383B2
公开(公告)日：2014-04-22
申请号：US11464929
申请日：2006-08-16
IPC分类号： H04L29/00
CPC分类号： G06F9/4856 , G06F9/5027 , G06F21/53
摘要： A computer implemented method, data processing system, and computer program product for managing computer workloads with security policy enforcement. When a determination is made that a component in a data processing system has failed to meet processing requirements, a candidate host to where the component may be migrated based on performance considerations is identified. A first security policy associated with the component is compared to a second security policy associated with the candidate host to determine if the first security policy is equivalent to or stronger than the second security policy. Responsive to a determination that the first security policy is equivalent to or stronger than the second security policy, the component is migrated to the candidate host.
摘要翻译： 一种计算机实现的方法，数据处理系统和用于通过安全策略实施管理计算机工作负载的计算机程序产品。 当确定数据处理系统中的组件不能满足处理要求时，识别基于性能考虑可以迁移组件的候选主机。 将与组件相关联的第一安全策略与与候选主机相关联的第二安全策略进行比较，以确定第一安全策略是否等于或强于第二安全策略。 响应于确定第一安全策略等于或强于第二安全策略，组件将迁移到候选主机。
-
4.发明授权Establishing virtual endorsement credentials for dynamically generated endorsement keys in a trusted computing platform 有权在可信计算平台中为动态生成的认可密钥建立虚拟认可凭据公开(公告)号：US08549592B2
公开(公告)日：2013-10-01
申请号：US11179238
申请日：2005-07-12
IPC分类号： H04L29/06
CPC分类号： G06F21/57 , H04L9/0877 , H04L9/321 , H04L9/3234 , H04L9/3263
摘要： A method and apparatus are disclosed in a data processing system for establishing virtual endorsement credentials. The data processing system includes a hardware trusted platform module (TPM). Logical partitions are generated in the system. A different virtual TPM is generated for each one of the logical partitions. For each one of the logical partitions, the virtual TPM that was generated for the logical partition then dynamically generates a virtual endorsement key, which is stored only within a corresponding virtual TPM. Using the virtual endorsement key, each virtual TPM also generates a virtual endorsement credential for use by the logical partition that includes the virtual TPM. The virtual endorsement credential is generated within the data processing system without the data processing system or its devices accessing a trusted third party that is external to the data processing system.
摘要翻译： 在用于建立虚拟背书凭证的数据处理系统中公开了一种方法和装置。 数据处理系统包括硬件可信平台模块（TPM）。 逻辑分区在系统中生成。 为每个逻辑分区生成不同的虚拟TPM。 对于逻辑分区中的每一个，为逻辑分区生成的虚拟TPM然后动态地生成仅存储在相应虚拟TPM内的虚拟签名密钥。 使用虚拟认可密钥，每个虚拟TPM还生成供包括虚拟TPM的逻辑分区使用的虚拟签注凭证。 在数据处理系统内生成虚拟签注凭证，而数据处理系统或其设备访问数据处理系统外部的受信任的第三方。
-
5.发明授权Method and system for bootstrapping a trusted server having redundant trusted platform modules 有权用于引导具有冗余可信平台模块的可信服务器的方法和系统公开(公告)号：US08055912B2
公开(公告)日：2011-11-08
申请号：US12621524
申请日：2009-11-19
申请人： Steven A. Bade , Linda Nancy Betz , Andrew Gregory Kegel , David R. Safford , Leendert Peter Van Doorn
发明人： Steven A. Bade , Linda Nancy Betz , Andrew Gregory Kegel , David R. Safford , Leendert Peter Van Doorn
IPC分类号： G06F11/30
CPC分类号： G06F21/575
摘要： Multiple trusted platform modules within a data processing system are used in a redundant manner that provides a reliable mechanism for securely storing secret data at rest that is used to bootstrap a system trusted platform module. A hypervisor requests each trusted platform module to encrypt a copy of the secret data, thereby generating multiple versions of encrypted secret data values, which are then stored within a non-volatile memory within the trusted platform. At some later point in time, the encrypted secret data values are retrieved, decrypted by the trusted platform module that performed the previous encryption, and then compared to each other. If any of the decrypted values do not match a quorum of values from the comparison operation, then a corresponding trusted platform module for a non-matching decrypted value is designated as defective because it has not been able to correctly decrypt a value that it previously encrypted.
摘要翻译： 以冗余的方式使用数据处理系统内的多个可信任的平台模块，其提供用于安全地存储用于引导系统可信平台模块的休息处的秘密数据的可靠机制。 管理程序请求每个可信平台模块加密秘密数据的副本，从而生成加密的秘密数据值的多个版本，然后存储在可信平台内的非易失性存储器中。 在稍后的时间点，加密的秘密数据值由执行先前加密的可信任平台模块进行解密，然后进行比较。 如果解密值中的任何一个与比较操作中的值的数量不匹配，则用于非匹配解密值的相应的可信平台模块被指定为有缺陷的，因为它不能正确解密之前加密的值 。
-
公开(公告)号：US20090063857A1
公开(公告)日：2009-03-05
申请号：US12261060
申请日：2008-10-30
申请人： Steven A. Bade , Ryan Charles Catherman , James Patrick Hoff , Nia Letise Kelley , Emily Jane Ratliff
发明人： Steven A. Bade , Ryan Charles Catherman , James Patrick Hoff , Nia Letise Kelley , Emily Jane Ratliff
IPC分类号： G06F21/00
CPC分类号： G06F21/53
摘要： A method is presented for implementing a trusted computing environment within a data processing system. A hypervisor is initialized within the data processing system, and the hypervisor supervises a plurality of logical, partitionable, runtime environments within the data processing system. The hypervisor reserves a logical partition for a hypervisor-based trusted platform module (TPM) and presents the hypervisor-based trusted platform module to other logical partitions as a virtual device via a device interface. Each time that the hypervisor creates a logical partition within the data processing system, the hypervisor also instantiates a logical TPM within the reserved partition such that the logical TPM is anchored to the hypervisor-based TPM. The hypervisor manages multiple logical TPM's within the reserved partition such that each logical TPM is uniquely associated with a logical partition.
-
7.发明授权System and method for providing access to mobile devices based on positional data 有权基于位置数据提供对移动设备的访问的系统和方法公开(公告)号：US06778837B2
公开(公告)日：2004-08-17
申请号：US09815542
申请日：2001-03-22
IPC分类号： H04Q720
摘要： The present invention includes as one embodiment a method for automatically controlling access to a mobile computing device with pertinent data. The method includes predefining access parameters of the mobile computing device, determining an actual location of the mobile computing device and using the actual location of the mobile computing device to automatically control access to the mobile computing device based on the predefined access parameters. Also, the method includes storing the predefined access parameters in a private Internet networked location, accessing and updating the predefined access parameters and sending the updated access parameters to the mobile computing device.
摘要翻译： 本发明包括作为一个实施例的用于使用相关数据自动控制对移动计算设备的访问的方法。 该方法包括预定义移动计算设备的接入参数，确定移动计算设备的实际位置并使用移动计算设备的实际位置来基于预定义的接入参数来自动控制对移动计算设备的接入。 此外，该方法包括将预定义的访问参数存储在专用因特网联网位置，访问和更新预定义的访问参数并将更新的访问参数发送到移动计算设备。
-
8.发明授权公开(公告)号：US08549288B2
公开(公告)日：2013-10-01
申请号：US12128952
申请日：2008-05-29
申请人： Steven A. Bade , Stefan Berger , Kenneth Alan Goldman , Ronald Perez , Reiner Sailer , Leendert Peter Van Doorn
发明人： Steven A. Bade , Stefan Berger , Kenneth Alan Goldman , Ronald Perez , Reiner Sailer , Leendert Peter Van Doorn
IPC分类号： H04L29/06
CPC分类号： G06F21/57
摘要： A trusted platform module is presented that is capable of creating, dynamically, multiple virtual trusted platform modules in a hierarchical organization. A trusted platform module domain is created. The trusted platform module creates virtual trusted platform modules, as needed, in the trusted platform module domain. The virtual trusted platform modules can inherit the permissions of a parent trusted platform module to have the ability to create virtual trusted platform modules themselves. Each virtual trusted platform module is associated with a specific partition. Each partition is associated with an individual operating system. The hierarchy of created operating systems and their privilege of spawning new operating systems is reflected in the hierarchy of trusted platform modules and the privileges each of the trusted platform modules has.
摘要翻译： 提出了一种可信任的平台模块，能够在层次结构中动态创建多个虚拟可信平台模块。 创建可信平台模块域。 可信平台模块根据需要在可信平台模块域中创建虚拟可信平台模块。 虚拟可信平台模块可以继承父信任平台模块的权限，以便能够自己创建虚拟可信平台模块。 每个虚拟可信平台模块与特定分区关联。 每个分区与单个操作系统相关联。 创建的操作系统的层次结构及其产生新操作系统的特权体现在可信平台模块的层次结构和每个可信平台模块所具有的特权上。
-
公开(公告)号：US08065522B2
公开(公告)日：2011-11-22
申请号：US12125871
申请日：2008-05-22
申请人： Steven A. Bade , Linda Nancy Betz , Andrew Gregory Kegel , Michael J. Kelly , William Lee Terrell
发明人： Steven A. Bade , Linda Nancy Betz , Andrew Gregory Kegel , Michael J. Kelly , William Lee Terrell
CPC分类号： G06F21/57 , G06F21/53 , H04L9/0897
摘要： A method, an apparatus, a system, and a computer program product is presented for virtualizing trusted platform modules within a data processing system. A virtual trusted platform module along with a virtual endorsement key is created within a physical trusted platform module within the data processing system using a platform signing key of the physical trusted platform module, thereby providing a transitive trust relationship between the virtual trusted platform module and the core root of trust for the trusted platform. The virtual trusted platform module can be uniquely associated with a partition in a partitionable runtime environment within the data processing system.
摘要翻译： 提出了一种方法，装置，系统和计算机程序产品，用于虚拟化数据处理系统内的可信平台模块。 使用物理可信平台模块的平台签名密钥在数据处理系统内的物理可信平台模块内创建虚拟可信平台模块以及虚拟认证密钥，从而在虚拟可信平台模块和虚拟可信平台模块之间提供传递信任关系 信任平台的核心信任根源。 虚拟可信平台模块可以与数据处理系统内的可分区运行时环境中的分区唯一关联。
-
公开(公告)号：US07809821B2
公开(公告)日：2010-10-05
申请号：US11913193
申请日：2007-02-16
IPC分类号： G06F15/173 , G06F15/16 , G06F11/30 , G21C17/00
CPC分类号： G06F21/577 , G06F11/3409 , G06F2201/81
摘要： A solution for evaluating trust in a computer infrastructure is provided. In particular, a plurality of computing devices in the computer infrastructure evaluate one or more other computing devices in the computer infrastructure based on a set of device measurements for the other computing device(s) and a set of reference measurements. To this extent, each of the plurality of computing devices also provides a set of device measurements for processing by the other computing device(s) in the computer infrastructure.
摘要翻译： 提供了一种评估计算机基础设施信任的解决方案。 特别地，计算机基础设施中的多个计算设备基于用于其他计算设备的一组设备测量值和一组参考测量结果来评估计算机基础结构中的一个或多个其他计算设备。 在这种程度上，多个计算设备中的每一个还提供一组设备测量值以供计算机基础设施中的其他计算设备处理。
-
-
-
-
-
-
-
-
-
搜索结果
51 条记录 (耗时 0.039 秒)
