Granting privileges and sharing resources in a telecommunications system

• US 20070073880A1
• Filed: 09/29/2005
• Published: 03/29/2007
• Est. Priority Date: 09/29/2005
• Status: Active Grant

• Current Assignee: Avaya Incorporated
• Original Assignee: Avaya Technology Corporation Miami Lakes FLA US
• Inventors: Krishnaswamy, Venkatesh, Krishnan, P., Krishnakumar, Anjur
• Granted Patent: US 8,775,586 B2
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A method and an apparatus are disclosed that provide a privilege-granting technique for enabling a service-providing domain to grant a privilege to a requesting user in a service-requesting domain. A request handler in the service-providing domain, which comprises one or more service-associated resources, receives a user request to use a service and requests a token from a privilege-granting server, in accordance with the illustrative embodiment of the present invention. Upon receiving the token that specifies a granted privilege from the privilege-granting server, the request handler extends the privilege to the requesting user. Alternatively, the request handler can request a plurality of tokens in advance from the privilege-granting server; after receiving the tokens, the request handler extends a privilege to each requesting user as the handler receives requests to use one or more services.

Claims

1. A method comprising:

receiving, in a service-providing domain, a request to use a service in said service-providing domain that is made by a first data-processing system in a service-requesting domain;

transmitting a request for a token to a second data-processing system in said service-providing domain, wherein said second data-processing system is unaware of the identity of said first data-processing system; and

receiving said token wherein said token specifies a granted privilege.

2. The method of claim 1 wherein said granted privilege is for a time-limited use of at least one resource that is associated with said service.

3. The method of claim 2 wherein said time-limited use is a single use of said at least one resource.

4. The method of claim 1 further comprising determining, based on the reception of said request to use said service, at least one resource that is associated with said service, wherein said request for said token specifies said at least one resource.

5. The method of claim 1 further comprising receiving, from said second data-processing system, a message that is related to an authentication, wherein said authentication involves said service-providing domain, but not said service-requesting domain.

6. The method of claim 1 wherein a trust relationship is nonexistent between said service-requesting domain and said service-providing domain at the time of the reception, in said service-providing domain, of said request to use said service.

7. The method of claim 6 wherein said service-providing domain withholds, from said first data-processing system, the identity of said second data-processing system.

8. The method of claim 6 wherein said service-providing domain withholds, from said first data-processing system, the identity of at least one resource that is associated with said service.

9. The method of claim 1 further comprising extending said granted privilege to said first data-processing system.

10. The method of claim 9 further comprising informing said first data-processing system how to access at least one resource that is associated with said service.

11. The method of claim 9 wherein the extending of granted privilege to said first data-processing system is accomplished by transmitting at least one encrypted message.

12. The method of claim 9 wherein said request to use said service is received and said granted privilege is extended in accordance with the Session Initiation Protocol.

13. The method of claim 1 wherein said service comprises the receiving of a facsimile transmission from said first data-processing system.

14. A method comprising:

receiving, in a service-providing domain, a request to use a service in said service-providing domain that is made by a first data-processing system in a service-requesting domain;

transmitting a request for a token to a second data-processing system in said service-providing domain; and

receiving said token, wherein said token specifies a granted privilege that is for a time-limited use of at least one resource that is associated with said service;

wherein a trust relationship is nonexistent between said service-requesting domain and said service-providing domain at the time of the reception, in said service-providing domain, of said request to use said service.

15. The method of claim 14 wherein said time-limited use is a single use of said at least one resource.

16. The method of claim 14 further comprising determining, based on the reception of said request to use said service, at least one resource that is associated with said service, wherein said request for said token specifies said at least one resource.

17. The method of claim 14 further comprising receiving, from said second data-processing system, a message that is related to an authentication, wherein said authentication involves said service-providing domain, but not said service-requesting domain.

18. The method of claim 14 wherein said service-providing domain withholds, from said first data-processing system, the identity of at least one resource that is associated with said service.

19. The method of claim 14 further comprising extending said granted privilege to said first data-processing system.

20. The method of claim 19 further comprising informing said first data-processing system how to access at least one resource that is associated with said service.

21. The method of claim 19 wherein said request to use said service is received and said granted privilege is extended in accordance with the Session Initiation Protocol.

22. A method comprising:

transmitting, to a second data-processing system in a service-providing domain, a request for a plurality of tokens, wherein said second data-processing system is unaware of the identity of a first data-processing system in a service-requesting domain, and wherein said first data-processing system is capable of using a first service in said service-providing domain;

receiving said plurality of tokens, wherein a first token of said plurality of tokens specifies a first granted privilege; and

extending, to said first data-processing system, said first granted privilege that is associated with said first service.

23. The method of claim 22 wherein said first granted privilege is for a time-limited use of at least one resource that is associated with said first service.

24. The method of claim 23 wherein said time-limited use is a single use of said at least one resource.

25. The method of claim 22 wherein a trust relationship is nonexistent between said service-requesting domain and said service-providing domain at the time of the transmission of said request for said plurality of tokens.

26. The method of claim 22 further comprising determining at least one resource that is associated with said first service, wherein said request for said plurality of tokens specifies said at least one resource.

27. The method of claim 22 further comprising extending, to a third data-processing system in said service-requesting domain, a second granted privilege that is associated with a second service;

wherein a second token of said plurality of tokens specifies said second granted privilege; and

wherein said second data-processing system is unaware of the identity of said third data-processing system.

28. The method of claim 27 wherein said first granted service and said second granted service are the same.

29. The method of claim 22 wherein said first service comprises the receiving of a facsimile transmission from said first data-processing system.

30. The method of claim 22 wherein said first granted privilege is extended in accordance with the Session Initiation Protocol.