SECURE DYNAMIC AUTHORITY DELEGATION

• US 20110225643A1
• Filed: 03/12/2010
• Published: 09/15/2011
• Est. Priority Date: 03/12/2010
• Status: Active Grant

• Current Assignee: Alcatel-Lucent SA (Nokia Corporation)
• Original Assignee: Alcatel-Lucent SA (Nokia Corporation)
• Inventors: Faynberg, Igor, Lu, Hui-Lan
• Granted Patent: US 8,776,204 B2
• Time in Patent Office: Days
• US Class Current: 726/10
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity

Abstract

In a communication network wherein a first computing device represents a resource owner and a second computing device represents a resource requestor, the resource owner detects an occurrence of an event, wherein the event occurrence represents a request to access one or more resources of the resource owner stored in a resource residence. The resource owner sends an authorization token to the resource requestor in response to the event occurrence, the authorization token serving as a proof of authorization delegated by the resource owner to be presented by the resource requestor to the resource residence so as to permit the resource requestor to access the one or more requested resources stored in the resource residence.

Claims

1. A method, comprising:

in a communication network wherein a first computing device represents a resource owner and a second computing device represents a resource requestor, the resource owner detecting an occurrence of an event, wherein the event occurrence represents a request to access one or more resources of the resource owner stored in a resource residence;

the resource owner sending an authorization token to the resource requestor in response to the event occurrence, the authorization token serving as a proof of authorization delegated by the resource owner to be presented by the resource requestor to the resource residence so as to permit the resource requestor to access the one or more requested resources stored in the resource residence.

2. The method of claim 1, wherein the event occurrence is receipt of a resource request by the resource owner from the resource requestor such that the resource requestor and the resource owner exchange a request and a response via a pull communication method.

3. The method of claim 1, wherein the event occurrence is an occurrence of a triggering event associated with an application program such that a communication method between the resource requestor and the resource owner is a push communication method.

4. The method of claim 1, wherein the resource residence resides in a third computing device.

5. The method of claim 1, wherein obtaining the authorization token and presentation of the authorization token to gain access to the one or more requested resources is bound to an existing application protocol.

6. The method of claim 1, wherein the authorization token has a verifiable structure.

7. The method of claim 6, wherein the verifiable structure comprises a digital signature of the resource owner.

8. The method of claim 1, wherein the authorization token has a limited lifetime.

9. The method of claim 1, wherein the authorization token specifies a method for authenticating the resource requestor or a level of assurance for authenticating the resource requestor.

10. The method of claim 1, wherein the authorization token specifies one or more actions that are permitted to be performed in accordance with the one or more requested resources.

11. The method of claim 1, wherein the resource requestor obtains the authorization token from the resource owner in one round trip.

12. The method of claim 1, wherein the proof of authorization delegated by the resource owner is transferable from the resource requestor to at least another resource requestor such that the other resource requestor can present another authorization token to the resource residence so as to permit the other resource requestor to access the one or more requested resources stored in the resource residence.

13. The method of claim 12, wherein the other authorization token obtained by the other resource requestor specifies an action permission scope that is a subset of an action permission scope specified in the authorization token obtained directly from the resource owner by the resource requestor.

14. The method of claim 12, wherein the other authorization token obtained by the other resource requestor does not change the method for authenticating the resource requestor or a level of assurance for authenticating the resource requestor.

15. The method of claim 12, wherein the other authorization token obtained by the other resource requestor comprises a signature of the previous resource requestor.

16. The method of claim 12, wherein the other authorization token is a modified form of the authorization token originally received and wherein the previous resource requestor performs the modification prior to sending the modified form of the authorization token to the other resource requestor.

17. The method of claim 1, further comprising the resource owner authenticating the resource requestor before sending the authorization token to the resource requestor.

18. An article of manufacture comprising a processor-readable storage medium storing one or more software programs which when executed by a processor associated with the resource owner perform one or more steps of the method of claim 1.

19. A method, comprising:

in a communication network wherein a first computing device represents a resource owner and a second computing device represents a resource requestor, and wherein the resource owner detects an occurrence of an event and the event occurrence represents a request to access one or more resources of the resource owner stored in a resource residence;

the resource requestor receiving an authorization token sent by the resource owner in response to the event occurrence, the authorization token serving as a proof of authorization delegated by the resource owner to be presented by the resource requestor to the resource residence so as to permit the resource requestor to access the one or more requested resources stored in the resource residence.

20. The method of claim 19, further comprising the resource residence authenticating the resource requestor prior to the resource requestor presenting the authorization token to the resource residence.

21. The method of claim 19, further comprising the resource residence verifying the authorization token presented by the resource requestor prior to acting on the one or more requested resources.

22. The method of claim 19, further comprising the resource residence authenticating the resource requestor after the resource requestor presents the authorization token to the resource residence.

23. The method of claim 19, further comprising the resource requestor transferring the proof of authorization delegated by the resource owner to at least another resource requestor.

24. The method of claim 23, wherein the transferring step further comprises the resource requestor sending another authorization token to the other resource requestor such that the other resource requestor can present the other authorization token to the resource residence so as to permit the other resource requestor to access the one or more requested resources stored in the resource residence.

25. An article of manufacture comprising a processor-readable storage medium storing one or more software programs which when executed by a processor associated with the resource requestor perform one or more steps of the method of claim 19.

26. A method, comprising:

in a communication network wherein a first computing device represents a resource owner and a second computing device represents a resource requestor, and wherein the resource owner detects an occurrence of an event and the event occurrence represents a request to access one or more resources of the resource owner stored in a resource residence, and wherein the resource requestor receives an authorization token sent by the resource owner in response to the event occurrence;

the resource residence receiving the authorization token, the authorization token serving as a proof of authorization delegated by the resource owner to the resource requestor to permit the resource requestor to access the one or more requested resources stored in the resource residence.

27. An article of manufacture comprising a processor-readable storage medium storing one or more software programs which when executed by a processor associated with the resource residence perform one or more steps of the method of claim 26.

28. Apparatus, comprising:

a computing device in a communication network representing a resource owner, wherein the communication network also includes a resource requestor and a resource residence, the computing device comprising a memory and a processor coupled to the memory and configured to;

detect an occurrence of an event, wherein the event occurrence represents a request to access one or more resources of the resource owner stored in the resource residence; and

send an authorization token to the resource requestor in response to the event occurrence, the authorization token serving as a proof of authorization delegated by the resource owner to be presented by the resource requestor to the resource residence so as to permit the resource requestor to access the one or more requested resources stored in the resource residence.

29. Apparatus, comprising:

a computing device in a communication network representing a resource requestor, wherein the communication network also includes a resource owner and a resource residence wherein the resource owner detects an occurrence of an event and the event occurrence represents a request to access one or more resources of the resource owner stored in the resource residence, the computing device comprising a memory and a processor coupled to the memory and configured to receive an authorization token sent by the resource owner in response to the event occurrence, the authorization token serving as a proof of authorization delegated by the resource owner to be presented by the resource requestor to the resource residence so as to permit the resource requestor to access the one or more requested resources stored in the resource residence.

30. Apparatus, comprising:

a computing device in a communication network representing a resource residence, wherein the communication network also includes a resource owner and a resource requestor wherein the resource owner detects an occurrence of an event and the event occurrence represents a request to access one or more resources of the resource owner stored in the resource residence, and wherein the resource requestor receives an authorization token sent by the resource owner in response to the event occurrence, the computing device comprising a memory and a processor coupled to the memory and configured to receive the authorization token, the authorization token serving as a proof of authorization delegated by the resource owner to the resource requestor to permit the resource requestor to access the one or more requested resources stored in the resource residence.