Resource authorization

• US 20020169986A1
• Filed: 05/11/2001
• Published: 11/14/2002
• Est. Priority Date: 05/11/2001
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Lortz, Victor B.
• Granted Patent: US 7,107,610 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

Resource authorization includes receiving a resource request from a first requester. The resource request includes credentials and identifies an operation to be performed with respect to a resource. The resource request is mapped to a resource identifier, and the resource data structure is searched for a resource node based on the resource identifier. A determination is made whether the first requester is authorized to perform the operation with respect to the resource based on whether the credentials in the resource request match a resource authorization level associated with the resource node.

Claims

1. A method comprising:

receiving a resource request from a first requester, the resource request including credentials and identifying an operation to be performed with respect to a resource;

mapping the resource request to a resource identifier;

searching a resource data structure for a resource node based on the resource identifier; and

determining whether the first requester is authorized to perform the operation with respect to the resource based on whether the credentials in the resource request match a resource authorization parameter associated with the resource node.

2. The method of claim 1 wherein searching includes searching resource nodes each of which represents a resource and includes a resource identifier.

3. The method of claim 1 wherein searching includes searching a directed graph structure.

4. The method of claim 1 wherein receiving a resource request includes receiving a digital certificate conforming to a simplified public key infrastructure.

5. The method of claim 1 wherein mapping includes mapping the resource request to the resource identifier and a resource authorization parameter including an owner level authorizing complete access to the resource.

6. The method of claim 1 wherein mapping includes mapping the resource request to the resource identifier and a resource authorization parameter including an editor level authorizing read/write access to the resource.

7. The method of claim 1 wherein mapping includes mapping the resource request to the resource identifier and a resource authorization parameter including a reviewer level authorizing read only access to the resource.

8. The method of claim 1 wherein mapping includes mapping the resource request to the resource identifier and a resource authorization parameter including a none level denying all access to the resource.

9. The method of claim 1 including delegating the credentials of a child node to a parent node in the resource data structure.

10. The method of claim 9 in which the resource request is handled based on the delegated credentials.

11. The method of claim 1 wherein the resource request originates from a client computer directed to a server computer over a network.

13. The apparatus of claim 12 wherein the resource data structure comprises a directed graph structure.

14. The apparatus of claim 12 wherein the credentials include a digital certificate conforming to a simplified public key infrastructure.

15. The apparatus of claim 12 wherein the resource authorization level includes an owner level authorizing complete access to the resource.

16. The apparatus of claim 12 wherein the resource authorization level includes an editor level authorizing read/write access to the resource.

17. The apparatus of claim 12 wherein the resource authorization level includes a reviewer level authorizing read only access to the resource.

18. The apparatus of claim 12 wherein the resource authorization level includes a none level denying all access to the resource.

19. The apparatus of claim 12 wherein resource data structure includes the delegation of a resource authorization level from a child node to a parent node.

12. An apparatus comprising:

a memory for storing a resource data structure having resource nodes each of which represents a respective resource and which has a respective resource identifier and a resource authorization parameter; and

a processor configured to;

receive a resource request from a first requester, the resource request including credentials and identifying an operation to be performed with respect to a resource;

map the resource request to a resource identifier;

search the resource data structure for a resource node based on the resource identifier; and

determine whether the first requester is authorized to perform the operation with respect to the resource based on whether the credentials in the resource request match a resource authorization parameter associated with the resource node.

20. A system comprising:

a first computer associated with a first requester configured to generate resource requests with credentials;

a second computer including memory storing a resource data structure with resource nodes each of which represents a respective resource and which has a respective resource identifier and a resource authorization level, and the second computer configured to;

receive a resource request from a first requester, the resource request including credentials and identifying an operation to be performed with respect to a resource;

map the resource request to a resource identifier;

search the resource data structure for a resource node based on the resource identifier; and

determine whether the first requester is authorized to perform the operation with respect to the resource based on whether the credentials in the resource request match a resource authorization level associated with the resource node; and

a network over which the first and second computers communicate.

21. The system of claim 20 wherein the resource data structure comprises a directed graph data structure.

22. The system of claim 20 wherein the credentials include a digital certificate conforming to a simplified public key infrastructure.

23. The system of claim 20 wherein the resource authorization level includes a level from the group consisting of owner level, editor level, reviewer level, none level.

24. The system of claim 20 including the delegation of the credentials from a child node to a parent node.

25. The system of claim 20 including the delegation of credentials associated with the first requester to a second requester wherein the second requester can request resources using the credentials from the first requester as if it were the first requester.

27. The article of claim 26 including instructions for causing the computer system to have a directed graph data structure with resource nodes representing resources including a resource identifier and a resource authorization level.

28. The article of claim 26 including instructions for causing the computer system to have digital certificates conforming to a simplified public key infrastructure.

29. The article of claim 26 including instructions for causing the computer system to delegate the credentials of a child node to a parent node.

30. The article of claim 26 including instructions for causing the computer system to delegate the credentials associated with the first requester to a second requestor to allow the second requestor to request resources using the credentials from the first requestor as if it were the first requestor.

26. An article comprising a computer readable medium that stores computer executable instructions for causing a computer system to:

map a resource request to a resource identifier, in response to receiving the resource request from a first requester, the resource request including credentials and identifying an operation to be performed with respect to a resource;

search a resource data structure for a resource node based on the resource identifier; and

determine whether the first requester is authorized to perform the operation with respect to the resource based on whether the credentials in the resource request match a resource authorization level associated with the resource node.