Method and system for using a web service license

• US 20040034770A1
• Filed: 08/15/2002
• Published: 02/19/2004
• Est. Priority Date: 08/15/2002
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Shewchuk, John P., Kaler, Christopher G., Atkinson, Robert George, Della-Libera, Giovanni Moises
• Granted Patent: US 7,512,782 B2
• Time in Patent Office: Days
• US Class Current: 713/155
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06Q 30/02 Marketing; Price estimation or determination; Fundraising

Abstract

A method and system are provided such that a universal license may be used for authentication and authorization purposes and may include one or more cryptographic keys as well as assertions and related indications of authenticity. In an aspect of the invention, a license may be presented that includes access information, such that authentication and authorization decisions may be made based only on the access information. In other aspects of the invention, rights may be delegated and a trusted party may assert that another party can be trusted.

Claims

1. A computer-implemented method for implementing a multipurpose license, the method comprising:

using the license for authentication purposes; and

using the license for authorization purposes, wherein the license is used for a service.

2. The method of claim 1, wherein the license includes a cryptographic key.

3. The method of claim 2, wherein the cryptographic key is a symmetric key.

4. The method of claim 3, wherein the symmetric key is encrypted.

5. The method of claim 2, wherein the license includes a plurality of cryptographic keys.

6. The method of claim 5, wherein each of the plurality of cryptographic keys is targeted at different recipients.

7. The method of claim 1, further comprising including in the multipurpose license a plurality of signatures from a plurality of authorities and, corresponding to each of the signatures, a reason why each of the signatures is provided.

8. The method of claim 7, wherein at least one of the signatures is included for all of the reasons included in the license.

9. The method of claim 7, wherein at least one of the signatures is included for some of the reasons included in the license.

10. The method of claim 7, wherein at least two of the signatures are each included for a plurality of different reasons and the reasons corresponding to one of the at least two signatures differ from the reasons corresponding to other(s) of the signatures.

11. The method of claim 7, wherein at least two of the signatures are each included for a plurality of same reasons

12. The method of claim 7, wherein at least two of the signatures are each included for a plurality of reasons and some of the reasons corresponding to one of the at least two signatures are identical to the reasons corresponding to other(s) of the signatures.

13. The method of claim 7, further comprising extending the license without affecting existing ones of the signatures and the corresponding reasons.

14. The method of claim 7, further comprising adding at least one signature and a corresponding reason why each of the at least one signature is provided without affecting already existing ones of the signatures and the corresponding ones of the reasons.

15. The method of claim 1, further comprising including in the multipurpose license a statement indicating at least one right that can be delegated.

16. The method of claim 15, further comprising including in the multipurpose license at least one restriction regarding any of the delegated right(s).

17. The method of claim 16, wherein at least some of the restriction(s) are specified using one of a compiled language, an interpreted language, a script language and an intermediate language.

18. The method of claim 16, wherein at least some of the restriction(s) are specified using a computer processing language.

19. The method of claim 16, wherein one of the restriction(s) pertain to a number of allowed sub-delegations

20. The method of claim 16, wherein one of the restriction(s) pertain to a delegation target.

21. The method of claim 16, wherein one of the restriction(s) pertain to a delegation right that a delegation target must have for a sub-delegation to be valid.

22. The method of claim 16, wherein one of the restriction(s) pertain to a delegation right that a delegation target must not have for a sub-delegation to be valid.

23. The method of claim 15, wherein cryptographic keys are used to introduce delegates.

24. The method of claim 1, wherein the multipurpose license is free of identification information.

25. The method of claim 1, further comprising including identification information in the multipurpose license, wherein the identification information includes only an identifier that cannot be used by a third party device to identify a true holder of the multipurpose license.

26. The method of claim 1, further comprising including in the multipurpose license at least one encrypted element.

27. The method of claim 26, wherein the multipurpose license includes a plurality of elements encrypted with keys for different recipient devices.

28. The method of claim 27, wherein at least two of the elements are encrypted for one of the recipient devices.

29. The method of claim 27, wherein each of the elements is encrypted for a different one of the recipient devices.

30. The method of claim 1, further comprising including in the multipurpose license an indication by a signing authority that a named subject is to be trusted.

31. The method of claim 30, wherein the indication indicates conditions under which the named subject is to be trusted.

32. The method of claim 1, wherein the license includes one or more addressable parts.

33. The method of claim 32, wherein each of the addressable part(s) includes one of an assertion and an authentication.

56. The system of claim 31, wherein the multipurpose license is arranged to be free of identification information.

34. A computer-implemented method for using prefetched information to access a service, the method comprising:

sending a request to use the service;

receiving, responsive to the request, a response including access rights to use the service;

saving the access rights to use the service; and

sending an access request to use the service, the access request including the saved access rights to use the service.

35. The method of claim 34, wherein the saving of the access rights to use the service comprises saving a license to use the service, the license including access rights information, the method further comprising sending the license to a user who requested access to the service.

36. The method of claim 34, wherein:

the receiving of the response includes an indication that that the response includes information from a verifiable source, and

the sending of the access request to use the service includes a second license, the second license including the access rights to use the service and an indication that the access rights are from a verifiable source.

37. The method of claim 34, further comprising the service making an authentication/authorization decision based only on information included in the access request.

38. A system for using a multipurpose license comprising:

a plurality of elements arranged to communicate with one another, each of the elements belonging to at least one of a plurality of groups and, wherein;

the elements communicate by passing a multipurpose license, the multipurpose license including a plurality of assertions and indications of authenticity,

the plurality of groups comprises;

a first group for providing a service,

a second group for presenting a multipurpose license to use the service,

a third group for authenticating a holder of the multipurpose license, and

a fourth group for authorizing the holder of the multipurpose license to use the service according to the license.

39. The system of claim 38, wherein when there is an element in the second group, the element in the second group is arranged to include a cryptographic key in the multipurpose license.

40. The system of claim 39, wherein the cryptographic key is a symmetric key.

41. The system of claim 40, wherein the symmetric key is encrypted.

42. The system of claim 40, wherein the multipurpose license includes a plurality of cryptographic keys.

43. The system of claim 42, wherein each of the plurality of cryptographic keys is targeted at different recipients.

44. The system of claim 38, wherein at least some of the elements are arranged to include in the multipurpose license an indication of authentication from an authority and a corresponding reason indicating why the indication is added.

45. The system of claim 44, wherein the at least some of the elements are arranged to extend the multipurpose license without affecting existing ones of the indications and the corresponding reasons included in the multipurpose license.

46. The system of claim 44, wherein at least some of the elements are arranged to add at least one indication of authentication and a corresponding reason why each of the additional indication of authentication(s) is added without affecting exiting ones of the indication of authentication(s) and the corresponding ones of the reasons included in the multipurpose license.

47. The system of claim 38, wherein when any of the elements are in the second group, the element(s) in the second group are arranged to include at least one delegated right within the multipurpose license.

48. The system of claim 47, wherein when any of the elements are in the second group, the element(s) in the second group are arranged to include at least one restriction regarding any of the delegated right(s).

49. The system of claim 48, wherein at least some of the restrictions(s) are specified using one of a compiled language, an interpreted language, a script language and an intermediate language.

50. The system of claim 48, wherein at least some of the restriction(s) are specified using a computer processing language.

51. The system of claim 48, wherein one of the restriction(s) pertain to a number of allowed sub-delegations

52. The system of claim 48, wherein one of the restriction(s) pertain to a delegation target.

53. The system of claim 48, wherein one of the restriction(s) pertain to a delegation right that a delegation target must have for a sub-delegation to be valid.

54. The system of claim 48, wherein one of the restriction(s) pertain to a delegation right that a delegation target must not have for a sub-delegation to be valid.

55. The system of claim 47, wherein cryptographic keys are used to introduce delegates.

57. The system of claim 38, wherein when the multipurpose license includes identification information, the identification information includes only an identifier that cannot be used by a third party device to identify a true holder of the multipurpose license.

58. The system of claim 38, wherein the multipurpose license includes at least one encrypted element.

59. The system of claim 58, wherein the multipurpose license includes a plurality of elements encrypted with keys for different recipient devices.

60. The system of claim 38, wherein the multipurpose license is arranged to include an indication by a signing authority that a named subject is to be trusted.

61. The system of claim 60, wherein the indication indicates at least one condition under which the named subject is to be trusted.

62. The system of claim 60, wherein the indication indicates at least one condition under which the named subject is not to be trusted.

63. A processing device arranged to communicate with a service, the processing device comprising:

a service requester for requesting use of a service;

a response receiver for receiving a response regarding requesting use of the service, the response including access rights to use the service; and

a storage component for storing the received access rights to use the service,

wherein the service requester is arranged to send an access request to use the service, the access request including a copy of the saved access rights.

64. The processing device of claim 63, wherein:

the response includes an authentication from an issuer, and

when the service requester sends the access request to use the service, the access request includes a second license, the second license including the access rights to use the service and the authentication of the issuer of the second license.

65. A processing device arranged to communicate with a service, the processing device comprising:

a license receiver for receiving a license; and

an authenticator for authenticating a user based only on information included in the license.

66. The processing device of claim 65, wherein the information included in the license comprises access control information and an indication of authenticity from an authorized source.

67. A processing device arranged to communicate with a service, the processing device comprising:

a license receiver for receiving a license; and

an authorizer for authorizing access to a service based only on information included in the license.

68. The processing device of claim 67, wherein the information included in the license comprises access control information and an indication of authenticity from an authorized source.