Method and system for maintaining secure access to web server services using server-delegated permissions

• US 20030172298A1
• Filed: 03/05/2002
• Published: 09/11/2003
• Est. Priority Date: 03/05/2002
• Status: Abandoned Application

• Current Assignee: Probaris Technologies, Inc.
• Original Assignee: Probaris Technologies, Inc.
• Inventors: Berry, Michael C., Levas, Robert, Gunter, Carl A.
• Application Number:
  US10/090,681
• Publication Number:
  US 20030172298A1
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A method and system for manipulating permissions are disclosed. A first permission, including a label related to a service accessible via a service web server, is maintained at a permission web server. A second user is provided access to the first permission upon his authenticating to the permission web server and is provided a permission to access the service. The second user will be given access to the service, upon his requesting access to the service and supplying the permission, if the digital signatures in the permission are positively verified. The second user may, instead of seeking access to the service himself, delegate permission to do so to a subsequent user.

Claims

1. A method of providing secure access to a service on a service web server comprising:

(a) maintaining at a permission web server a first permission, wherein the first permission comprises a label related to the service and a digital signature of a first user;

(b) providing access to the first permission to a second user upon said second user authenticating to said permission web server;

(c) providing the second user a permission comprising the first permission and a permission link comprising the label and a digital signature of the permission web server;

(d) receiving at the service web server from said second user a request to access the service;

(e) receiving the permission from the second user at the service web server;

(f) verifying the digital signature of the permission web server and the digital signature of the first user in the permission; and

(g) providing the second user access to the service if step (f) produces a positive result.

2. The method of claim 1 wherein the first and second user are the same.

3. The method of claim 1 wherein the label comprises a URL for identifying the service.

4. A system for providing secure access to a service on a service web server comprising:

a permission web server that maintains a first permission, wherein the first permission comprises a label related to the service and a digital signature of a first user;

that provides a second user access to the first permission upon the second user authenticating to the permission web server; and

that provides the second user a permission comprising the first permission and a permission link comprising the label and a digital signature of the permission web server; and

the service web server that receives from the second user a request to access the service and the permission;

that verifies the digital signature of the permission web server and the digital signature of the first user in the permission; and

that provides the second user access to the service if the verification produces a positive result.

5. A method of providing secure access to a service on a service web server comprising:

(a) maintaining at a permission web server a first permission, wherein the first permission comprises a label related to the service and a digital signature of a first user;

(b) providing access to the first permission to a second user upon said second user authenticating to said permission web server;

(c) providing the second user a permission comprising the first permission and a permission link comprising the label and a digital signature of the permission web server;

(d) receiving at the service web server from a subsequent user a request to access the service, the subsequent user having been delegated a subsequent permission comprising the permission;

(e) receiving the subsequent permission from the subsequent user at the service web server;

(f) verifying at least the digital signature of the permission web server and the digital signature of the first user in the permission; and

(g) providing the subsequent user access to the service if step (f) produces a positive result.

6. The method of claim 5 wherein the subsequent permission is delegated to the subsequent user via electronic mail.

7. The method of claim 5 wherein the subsequent permission is delegated to the subsequent user by a subsequent web server.

8. A system for providing secure access to a service on a service web server comprising:

a permission web server that maintains a first permission, wherein the first permission comprises a label related to the service and a digital signature of a first user;

that provides a second user access to the first permission upon the second user authenticating to the permission web server; and

that provides to the second user a permission comprising the first permission and a permission link comprising the label and a digital signature of the permission web server; and

the service web server that receives from a subsequent user a request to access the service and a subsequent permission, comprising the permission, the subsequent user having been delegated the subsequent permission;

that verifies at least the digital signature of the permission web server and the digital signature of the first user in the permission; and

that provides the subsequent user access to the service if the verification produces a positive result.