COMMON LOCATION OF USER MANAGED AUTHORIZATION

• US 20140283023A1
• Filed: 03/15/2013
• Published: 09/18/2014
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Flavin, Robert A., Robinson, David G., Smith, Andrew B.
• Granted Patent: US 9,811,687 B2
• Time in Patent Office: Days
• US Class Current: 726/21
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6263 during internet communication, e.g. revealing personal data from cookies

Abstract

A method and apparatus for managing authorizations to access personal data of a user is disclosed. A computer retrieves a set of authorizations for a plurality of web based applications, wherein an authorization enables an application of the plurality of web based applications to access at least a portion of the personal data of the user. The computer presents the set of authorizations on a graphical user interface. The computer receives a user input indicating a change to a particular authorization in the set of authorizations for a particular web based application in the plurality of web based applications. Responsive to receiving the user input indicating the change to the particular authorization in the set of authorizations, the computer then stores the change to the particular authorization in the set of authorizations for the plurality of web based applications to access the personal data.

Claims

1. A method for managing authorizations to access personal data of a user, the method comprising:

retrieving, by a computer, a set of authorizations for a plurality of web based applications, wherein an authorization enables an application of the plurality of web based applications to access at least a portion of the personal data of the user;

presenting the set of authorizations on a graphical user interface; and

responsive to receiving a user input indicating a change to a particular authorization in the set of authorizations for a particular web based application in the plurality of web based applications, storing, by the computer, the change to the particular authorization in the set of authorizations for the plurality of web based applications to access the personal data.

2. The method of claim 1, further comprising:

generating, by the computer, a command for making the change to the particular authorization and sending, by the computer, the command to the particular web based application.

3. The method of claim 1, wherein retrieving, by the computer, the set of authorizations for the plurality of web based applications comprises one of retrieving the set of authorizations from the plurality of web based applications and retrieving the set of authorizations from stored authorizations.

4. The method of claim 3, wherein retrieving, by the computer, the set of authorizations from the plurality of web based applications comprises using an application programming interface to transfer a representation of a state of the set of authorizations from the web based applications.

5. The method of claim 2, wherein sending, by the computer, the command to the particular web based application comprises using an application programming interface to make the change to the particular authorization by transferring a representation of the change to the particular web based application.

6. The method of claim 1, wherein presenting the set of authorizations on the graphical user interface comprises:

generating, by the computer, the graphical user interface comprising a copy of the set of authorizations.

7. The method of claim 6, wherein the graphical user interface further comprises options for arranging the set of authorizations in the graphical user interface by one or more of an expiration date for each authorization, a domain name of each web based application, and the portion of the personal data.

8. The method of claim 6, wherein the graphical user interface further comprises options for selecting a portion of the set of authorizations in the graphical user interface by one or more of an expiration date for each authorization, a domain name of each web based application, and the portion of the personal data.

9. The method of claim 8 wherein a command for making the change to the particular authorization is selected from one of a command to create the authorization in the web based application, a command to modify the authorization, and a command to delete the authorization, and wherein the change to the particular authorization in the set of authorizations for the particular web based application in the plurality of web based applications is based on the selected portion of the set of authorizations and the selected command.

10. The method of claim 2, wherein the computer is a centralized authorization server, and wherein the particular web based application in the plurality of web based applications is another centralized authorization server.

11. The method of claim 2 wherein the particular authorization corresponds to a previously assigned token for access to modifying the particular authorization, and wherein sending, by the computer, the command to the particular web based application further comprises:

sending the previously assigned token corresponding to the particular authorization.

12. An apparatus for managing authorizations to access personal data of a user, the apparatus comprising:

a processor unit, a memory, and a computer readable storage device;

first program instructions to retrieve a set of authorizations for a plurality of web based applications, wherein an authorization enables an application of the plurality of web based applications to access at least a portion of the personal data of the user;

second program instructions to present the set of authorizations on a graphical user interface; and

third program instructions to store a change to a particular authorization in the set of authorizations responsive to receiving a user input indicating the change to the particular authorization in the set of authorizations for a particular web based application in the plurality of web based applications, wherein the first program instructions, the second program instructions, and the third program instructions are stored in the computer readable storage device for execution by the processor unit via the memory.

13. The apparatus of claim 12, further comprising:

fourth program instructions to generate a command for making the change to the particular authorization and send the command to the particular web based application, wherein the fourth program instructions are stored in the computer readable storage device for execution by the processor unit via the memory.

14. The apparatus of claim 12, wherein the first program instructions to retrieve the set of authorizations for the plurality of web based applications comprise one of program instructions to retrieve the set of authorizations from the plurality of web based applications and program instructions to retrieve the set of authorizations from stored authorizations.

15. The apparatus of claim 14 wherein the first program instructions to retrieve the set of authorizations from the plurality of web based applications comprise program instructions to use an application programming interface to transfer a representation of a state of the set of authorizations from the web based applications, and wherein the program instructions to send the command to the particular web based application comprise program instructions to use the application programming interface to make the change to the particular authorization by transferring a representation of the change to the particular web based application.

16. The apparatus of claim 13 wherein the particular authorization corresponds to a previously assigned token for access to modifying the particular authorization, and wherein the program instructions to send the command to the particular web based application further comprise program instructions to send the previously assigned token corresponding to the particular authorization.

17. A computer program product comprising:

a computer readable storage device in a data processing system;

a program system running on the data processing system for managing authorizations to access personal data of a user;

program instructions, stored on the computer readable storage device, for retrieving a set of authorizations for a plurality of web based applications, wherein an authorization enables an application of the plurality of web based applications to access at least a portion of the personal data of the user;

program instructions, stored on the computer readable storage device, for presenting the set of authorizations on a graphical user interface; and

program instructions, stored on the computer readable storage device, responsive to receiving a user input indicating a change to a particular authorization in the set of authorizations for a particular web based application in the plurality of web based applications, for storing the change to the particular authorization in the set of authorizations for the plurality of web based applications to access the personal data.

18. The computer program product of claim 17, wherein the program system comprises a plurality of programs and wherein one program in the program system running on the data processing system causes another program to be downloaded to the data processing system while managing the authorizations to access the personal data.

19. The computer program product of claim 17, wherein the program instructions are downloaded over a network from a remote data processing system to the computer readable storage device in the data processing system.

20. The computer program product of claim 19, wherein the computer readable storage device in the data processing system is a first computer readable storage device in a server data processing system, and wherein the program instructions are downloaded over the network to the remote data processing system for use in a second computer readable storage device in the remote data processing system.