REMOTE MANAGEMENT OF RESOURCE LICENSE

• US 20080083025A1
• Filed: 12/20/2006
• Published: 04/03/2008
• Est. Priority Date: 09/29/2006
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Cheng, Lili, Meijer, Henricus Johannes Maria, Zaner-Godsey, Melora, Glasser, Daniel S., Snyder, Ira L., Bergstraesser, Thomas F., Dani, Nishant V., Gates, William H.
• Granted Patent: US 8,474,027 B2
• Time in Patent Office: Days
• US Class Current: 726/9
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A user-centric or identity-centric resource licensing system that manages access to ‘cloud-based’ resources (e.g., applications and services) is provided. A ‘cloud’ refers to a collection of resources (e.g., hardware and/or software) provided and maintained by an off-site or off-premise party (e.g., third party), wherein the collection of resources can be accessed by an identified user via a network. In accordance with the user-centric licensing model, the resource license (and subscription) rights can migrate with a user without regard to physical location, device used, or other contextual factors (e.g., activity engaged). Effectively, the rights are mapped (and tracked) as a function of a user identity, which can be a core identity or an identity based upon activity engaged, role, capacity, etc.

Claims

1. A system that facilitates user-centric licensing of a plurality of resources, comprising:

an interface component that receives an access request that corresponds to a subset of the resources; and

an aggregated resource license component that establishes identity of the requester and generates a token which includes the identity and can be used to grant or deny access to the subset of resources.

2. The system of claim 1, the aggregated license component encrypts the token using a public key associated with the requester.

3. The system of claim 1, further comprising an access management component that decrypts the token and authorizes access to the subset of resources.

4. The system of claim 3, further comprising an identity determination component that establishes a current identity and compares the current identity to the identity encrypted within the token.

5. The system of claim 1, at least one of the subset of resources is an off-premise resource.

6. The system of claim 1, at least one of the subset of the resources is an on-premise resource.

7. The system of claim 1, the aggregated license component comprises:

an identity analysis component that determines a current identity of the requester; and

an access management component that grants or denies access to the subset of resources as a function of the current identity in view of the token.

8. The system of claim 7, further comprising a tracking component that monitors the use of each of the subset of resources and modifies a license right based at least in part upon the use.

9. The system of claim 8, further comprising a mapping component that maps the current identity to the license right.

10. The system of claim 1, further comprising an information gathering component that establishes information that relates to the identity of the user.

11. The system of claim 10, further comprising an identity analysis component that evaluates the information to determine the identity.

12. The system of claim 10, the information gathering component employs at least one of a physiological and an environmental sensor to establish the information.

13. A computer-implemented method of controlling access to a plurality of resources, comprising:

receiving a request for access to a subset of the resources;

establishing an identity of the requester;

generating an object that identifies the requestor in view of the subset of the resources; and

transferring the object to the requestor.

14. The method of claim 13, further comprising:

providing the object to a source of one of the resources; and

analyzing the object to authenticate the requester and to grant or deny access to the one of the resources.

15. The method of claim 14, further comprising encrypting the object using a public key of the requester.

16. The method of claim 15, further comprising:

decrypting the object; and

granting or denying access to the subset of the resources as a function of the decrypted object.

17. The method of claim 14, further comprising:

mapping the object to an aggregated persistent license; and

authorizing access based upon scope of the aggregated persistent license.

18. A computer-executable protocol that facilitates managing a license associated with a plurality of resources, comprising:

means for receiving a request from a user for access to a subset of the resources, the subset of the resources are located on-premise or off-premise;

means for establishing an identity;

means for generating an object that represents an identity of the user;

means for transmitting the object to the user, the object enables access to the subset of the resources from a plurality of disparate sources.

19. The computer-executable protocol of claim 18, further comprising means for encrypting the object using a public key of the user.

20. The computer-executable protocol of claim 19, further comprising:

means for decrypting the object;

means for authenticating the user as a function of the decrypted object; and

means for authorizing access to the subset of resources as a function of the decrypted object.