Provision of authorization and other services

• US 20060179008A1
• Filed: 04/04/2006
• Published: 08/10/2006
• Est. Priority Date: 09/08/2000
• Status: Active Grant

• Current Assignee: IdenTrust, Inc. (Assa Abloy AB)
• Original Assignee: IdenTrust, Inc. (Assa Abloy AB)
• Inventors: Tallent, Guy S. Jr., Lee, Elizabeth, Donfried, Paul A., Hicks, George M. (Mack)
• Granted Patent: US 8,892,475 B2
• Time in Patent Office: Days
• US Class Current: 705/75
• CPC Class Codes: G06Q 20/0855 involving a third party
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 30/018 Certifying business or products
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

Methods, apparati, and computer-readable media for providing authorization and other services. In a preferred embodiment, an authorization service includes both a messaging specification and a set of rules that govern its use. A first customer wishing to use the authorization service prepares a request that complies with the service'"'"'s messaging specification and transmits it to a first participant. The first participant transmits the request to a second participant, which processes the request according to authorization information provided by a second customer and rules that have been specified for the service. The second participant then prepares a response that complies with the service'"'"'s messaging specification.

Claims

1. In a system comprising:

a root entity, the root entity maintaining a root certification authority adapted to issue a digital certificate to each of a first participant and a second participant;

the first participant maintaining a first certification authority adapted to issue a digital certificate to a first customer; and

the second participant maintaining a second certification authority adapted to issue a digital certificate to a second customer;

a method for providing authorization services, said method comprising the steps of;

generating by the second customer an authorization request to confirm the authority of an individual to act on behalf of the first customer, wherein the first customer has contacted the second customer but has not sent a digital signature to the second customer;

transmitting the authorization request from the second customer to the second participant;

transmitting the authorization request from the second participant to the first participant;

retrieving at the first participant information concerning the authority of the individual to act on behalf of the first customer and at least one rule for responding to the authorization request;

generating by the first participant an authorization response using the retrieved information and rules;

transmitting the response from the first participant to the second participant; and

transmitting the response from the second participant to the second customer.

2. The method of claim 1, wherein the authorization request is a dynamic request as to whether the individual is authorized to perform a certain act or undertake a particular transaction.

3. The method of claim 1, wherein the authorization request is a static request for an attribute of a role associated with the individual.

4. The method of claim 1, wherein the first participant responds to the authorization request with a positive response only if the authorization request includes a purchase order signed by the individual.

5. The method of claim 1, wherein access controls are implemented that limit the ability of the second customer to obtain a message format for the authorization request.

6. The method of claim 1, wherein information pertaining to definitions of attributes is used in preparing the authorization response.

7. The method of claim 1, wherein information pertaining to mapping terminology from the second customer to the first customer is used in preparing the authorization response.

8. The method of claim 7, wherein the mapping information comprises dynamic mapping information.

9. The method of claim 1, wherein the authorization request seeks confirmation that the individual is authorized to purchase goods on behalf of the first customer.

10. The method of claim 1, wherein the authorization request is bundled with a certificate validation request for a digital certificate of the first customer.

11. The method of claim 10, wherein the first participant checks the validity of the digital certificate of the first customer.

12. The method of claim 10, wherein the response indicates the status of the digital certificate of the first customer.

13. A method for establishing an authorization service, said method comprising:

defining a proposed authorization service for confirming the authority of individuals and/or computers to transact on behalf of customers;

presenting the proposed authorization service to a policy management authority by sending an electronic communication to the policy management authority, wherein the proposed authorization service is developed by a participant and approved by the policy management authority before being offered to customers;

receiving approval of the proposed authorization service from the policy management authority via an electronic communication, whereby the proposed authorization service becomes an approved authorization service; and

implementing the approved authorization service.

14. The method of claim 13, wherein the proposed authorization service comprises a messaging specification and implementation rules.

15. The method of claim 13, wherein the proposed authorization service is jointly developed by a customer and a participant of the customer.

16. The method of claim 13, wherein the proposed authorization service is developed by a participant and approved by the policy management authority before being offered to a customer.

17. The method of claim 13, wherein the policy management authority is associated with a root entity.

18. The method of claim 13, wherein the approved authorization service is implemented within the context of a four-corner model comprising a root entity, a first participant, a customer of the first participant, a second participant, and a customer of the second participant.

19. Apparatus for providing authorization services, said apparatus comprising:

a root entity, the root entity maintaining a root certification authority adapted to issue a digital certificate to each of a first participant and a second participant;

the first participant maintaining a first certification authority adapted to issue a digital certificate to a first customer; and

the second participant maintaining a second certification authority adapted to issue a digital certificate to a second customer;

said apparatus further comprising;

means for generating by the second customer an authorization request to confirm the authority of an individual to act on behalf of the first customer, wherein the first customer has contacted the second customer but has not sent a digital signature to the second customer;

means for transmitting the authorization request from the second customer to the second participant;

means for transmitting the authorization request from the second participant to the first participant;

means for retrieving at the first participant information concerning the authority of the individual to act on behalf of the first customer and at least one rule for responding to the authorization request;

means for generating by the first participant an authorization response using the retrieved information and rules;

means for transmitting the response from the first participant to the second participant; and

means for transmitting the response from the second participant to the second customer.

20. Apparatus for establishing an authorization service, said apparatus comprising:

means for defining a proposed authorization service for confirming the authority of individuals and/or computers to transact on behalf of customers;

means for presenting the proposed authorization service to a policy management authority by sending an electronic communication to the policy management authority, wherein the proposed authorization service is developed by a participant and approved by the policy management authority before being offered to customers;

means for receiving approval of the proposed authorization service from the policy management authority via an electronic communication, whereby the proposed authorization service becomes an approved authorization service; and

means for implementing the approved authorization service.