PRIORITIZED TOKEN BASED ARBITER AND METHOD

• US 20140068700A1
• Filed: 08/31/2012
• Published: 03/06/2014
• Est. Priority Date: 08/31/2012
• Status: Active Grant

• Current Assignee: Motorola Solutions, Inc.
• Original Assignee: Motorola Solutions, Inc.
• Inventors: Reilly, Craig P., Bekiares, Tyrone D.
• Granted Patent: US 9,043,865 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 15/173 using an interconnection network, e.g. matrix, shuffle, pyramid, star, snowflake
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An apparatus and method for employing a token based arbiter. The apparatus includes a priority provider (26) comprising a processor for calculating an arbiter metric and an identity provider (18) having a processor for embedding the metric into a secured token. The apparatus also comprises memory coupled to the processor having one or more instructions executable at the processor. The processor is operable when executing the instructions to: collect authorization attributes (A) from one or more users seeking use of a resource (20) associated with a service provider; determine the level of priority to the one or more users based on prescribed policy of the priority provider; assign at least one arbiter metric (22, 32) to a secured token (T) for each of the one or more users based on the level of priority identified by the priority provider.

Claims

1. An apparatus comprising:

a priority provider having one or more processors for calculating an arbiter metric into a secured token; and

memory coupled to the one or more processors comprising one or more instructions executable at the one or more processors, the one or more processors operable when executing the instructions to;

collect authorization attributes from one or more users seeking use of a resource associated with the service provider;

determine the level of priority to the one or more users based on prescribed policy of a priority provider;

assign at least one arbiter metric to a secured token for each of the one or more users based on the level of priority identified by the priority provider, the arbiter metric establishing a priority right to access a resource between the one or more users.

2. The apparatus of claim 1 further comprising a service provider associated to a resource, the service provider comprising:

one or more processors for analyzing arbiter metrics in said secured tokens; and

memory coupled to the one or more processors comprising one or more instructions executable at the one or more processors, the one or more processors operable when executing the instructions to;

determine the highest priority user among the one or more users seeking access to the resource by reading the arbiter metric assigned in each secured token associated with the one or more users; and

allow the user of the one or more users having the highest priority to have exclusive access to the resource.

3. The apparatus of claim 1 wherein said secured token further comprises both authentication and authorization attributes.

4. The apparatus of claim 1 wherein said arbiter metric comprises a preemptive metric.

5. The apparatus of claim 4 further comprising a service provider associated to a resource, the service provider comprising:

one or more processors for analyzing arbiter metrics in said secured tokens; and

memory coupled to the one or more processors comprising one or more instructions executable at the one or more processors, the one or more processors operable when executing the instructions to;

determine the highest preemptive right user among the one or more users seeking access to the resource by reading the arbiter metric assigned in each secured token associated with the one or more users; and

allow the user of the one or more users having the highest preemptive metric to have exclusive access to the resource.

6. The apparatus of claim 1 further comprising a resource coupled to an interface capable of determining the highest preemptive right user by reading the arbiter metric assigned to each secured token associated with each of the one or more users.

7. The apparatus of claim 1 further comprising a resource coupled to an interface capable of determining the highest priority right user by reading the arbiter metric assigned to each secured token associated with each of the one or more users.

8. The apparatus of claim 1 further comprising an identity provider, the identity provider assigning authentication attributes to said secured token.

9. The apparatus of claim 1 further comprising an identity provider, the identity provider assigning authorization attributes to said secured token.

10. The apparatus of claim 1 wherein said prescribed policy of the priority provider forming the arbiter metric is a dynamic policy based on at least one of the user'"'"'s role, experienced incident, emergency type, and jurisdiction.

11. The apparatus of claim 1 wherein said instructions are Security Assertion Markup Language instructions.

12. The apparatus of claim 1 wherein said priority provider is a PCRF, having an interface allowing the assigned arbiter metric to be queried by the identity provider throughout the operation of seeking and obtaining use of the resource.

13. A method for arbitrating access between users to a resource, the method comprising the steps of:

embedding an arbiter metric into a secured token wherein the secured token is embedded into a non-transient computer readable medium by one or more processors, the arbiter metric comprising at least one of a priority right and preemptive right associated with each respective user of the users attempting to access a resource;

embedding attributes into the secured token with said one or more processors, the attributes comprising at least one of authorization rights and authentication rights associated with each respective user of the users attempting to access a resource;

reading at least one of said attributes in said secured token relative to the one or more users seeking use of a resource and determining a first level of access based on said attribute; and

determining which user of the users attempting to access a resource cleared from the first level of access is entitled to exclusive access among the users to the resource based on the priority right or preemptive right in the secured token relative to each user seeking access to the resource.

14. The method of claim 13 further comprising the step of providing an identity provider with an interface, the interface allowing the assigned secured token'"'"'s arbiter metric to be queried by the identity provider throughout the operation of seeking and obtaining use of the resource.

15. The method of claim 14 further comprising the step of providing a priority provider remotely from the identity provider, the identity provider embedding said attributes into the secured token with said one or more processors.

16. The method of claim 14 further comprising the step assigning a prescribed policy to the priority provider for forming the arbiter metric being based on at least one of the user'"'"'s role, experienced incident, emergency type, and jurisdiction.

17. The method of claim 16 further comprising the step of dynamically changing said arbiter metrics based on any change in at least one of the user'"'"'s role, experienced incident, emergency type, and jurisdiction throughout the operation of seeking and obtaining use of the resource.

18. The method of claim 13 further comprising the step of providing the users with an interface device for accessing said identity provider and soliciting said resource.

19. A system for arbitrating access between users of a resource, the system comprising:

a priority provider having one or more processors for calculating an arbiter metric comprising at least one of a priority right and preemptive right;

an identity provider having one or more processors for embedding attributes into a secured token, the attributes comprising at least one of authorization rights and authentication rights, and arbiter metric; and

memory coupled to the one or more processors comprising one or more instructions executable at the one or more processors, the one or more processors operable when executing the instructions to;

recognize at least one of said attributes in the secured token relative to the one or more users seeking use of a resource; and

determine the level of access to the one or more users based on the priority right or preemptive right in the secured token relative to each user seeking access to a resource.

20. The system of claim 19 wherein said identity provider includes a PCRF, having an interface allowing the assigned secured token'"'"'s arbiter metric to be queried by the identity provider throughout the operation of seeking and obtaining use of the resource.