USING REPRESENTATIONAL STATE TRANSFER (REST) FOR CONSENT MANAGEMENT

• US 20150089596A1
• Filed: 04/30/2014
• Published: 03/26/2015
• Est. Priority Date: 09/29/2011
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Sondhi, Ajay, Chu, Ching-Wen, Kim, Beomsuk, Hingarajiya, Ravi
• Granted Patent: US 9,350,718 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04W 12/06 Authentication

Abstract

A framework, which conforms to the OAuth standard, involves a generic OAuth authorization server that can be used by multiple resource servers in order to ensure that access to resources stored on those resource servers is limited to access to which the resource owner consents. Each resource server registers, with the OAuth authorization server, metadata for that resource server, indicating scopes that are recognized by the resource server. The OAuth authorization server refers to this metadata when requesting consent from a resource owner on behalf of a client application, so that the consent will be of an appropriate scope. The OAuth authorization server refers to this metadata when constructing an access token to provide to the client application for use in accessing the resources on the resource server. The OAuth authorization server uses this metadata to map issued access tokens to the scopes to which those access tokens grant access.

Claims

1. A computer-implemented method comprising:

sending, from an OAuth authorization server to a user through a Representational State Transfer (REST)-based interface, a request for consent to allow a software application to access information falling within a specified scope of information;

receiving, at the OAuth authorization server, from the user through the REST-based interface, consent to allow the software application to access the information falling with the specified scope of information; and

in response to receiving the consent, storing, at the OAuth authorization server, a mapping between the software application and the scope of information.

2. The computer-implemented method of claim 1, further comprising:

receiving, at the OAuth authorization server, from the software application, through the REST-based interface, a particular request that specifies the scope of information; and

in response to the particular request, sending, from the OAuth authorization server, through the REST-based interface, a request for an authentication credential associated with the user.

3. The computer-implemented method of claim 2, further comprising:

receiving the authentication credential at the OAuth authorization server through the REST-based interface; and

determining, at the OAuth authorization server, whether the authentication credential is associated with the user;

wherein said sending of the request for consent in performed in response to a determination, by the OAuth authorization server, that the authentication credential is associated with the user.

4. The computer-implemented method of claim 2, further comprising:

determining, at the OAuth authorization server, whether the scope of information specified in the mapping includes a scope of information specified in the request from the software application; and

in response to a determination by the OAuth authorization server that the scope of information specified in the mapping includes the scope of information specified in the request, providing, to the software application, through the REST-based interface, information that is associated with the user and that falls within the scope of information specified in the mapping.

5. The computer-implemented method of claim 1, wherein receiving the consent comprises receiving the consent without involving a Hypertext Transfer Protocol (HTTP) redirect operation.

6. The computer-implemented method of claim 1, further comprising:

receiving, at the OAuth authorization server, through the REST-based interface, a request to revoke the consent; and

in response to receiving the request to revoke the consent, deleting the mapping stored at the OAuth authorization server.

7. A computer-readable memory comprising instructions which, when executed by one or more processors, cause the one or more processors to perform:

sending, from an OAuth authorization server to a user through a Representational State Transfer (REST)-based interface, a request for consent to allow a software application to access information falling within a specified scope of information;

receiving, at the OAuth authorization server, from the user through the REST-based interface, consent to allow the software application to access the information falling with the specified scope of information; and

in response to receiving the consent, storing, at the OAuth authorization server, a mapping between the software application and the scope of information.

8. The computer-readable memory of claim 7, wherein the instructions, when executed by the one or more processors, cause the one or more processors to perform:

receiving, at the OAuth authorization server, from the software application, through the REST-based interface, a particular request that specifies the scope of information; and

in response to the particular request, sending, from the OAuth authorization server, through the REST-based interface, a request for an authentication credential associated with the user.

9. The computer-readable memory of claim 8, wherein the instructions, when executed by the one or more processors, cause the one or more processors to perform:

receiving the authentication credential at the OAuth authorization server through the REST-based interface; and

determining, at the OAuth authorization server, whether the authentication credential is associated with the user;

wherein said sending of the request for consent in performed in response to a determination, by the OAuth authorization server, that the authentication credential is associated with the user.

10. The computer-readable memory of claim 8, wherein the instructions, when executed by the one or more processors, cause the one or more processors to perform:

determining, at the OAuth authorization server, whether the scope of information specified in the mapping includes a scope of information specified in the request from the software application; and

in response to a determination by the OAuth authorization server that the scope of information specified in the mapping includes the scope of information specified in the request, providing, to the software application, through the REST-based interface, information that is associated with the user and that falls within the scope of information specified in the mapping.

11. The computer-readable memory of claim 7, wherein receiving the consent comprises receiving the consent without involving a Hypertext Transfer Protocol (HTTP) redirect operation.

12. The computer-readable memory of claim 7, wherein the instructions, when executed by the one or more processors, cause the one or more processors to perform:

receiving, at the OAuth authorization server, through the REST-based interface, a request to revoke the consent; and

in response to receiving the request to revoke the consent, deleting the mapping stored at the OAuth authorization server.

13. A system comprising:

a first machine that stores a software application; and

a second machine that stores an OAuth authorization server that is configured to;

send, to a user through a Representational State Transfer (REST)-based interface, a request for consent to allow the software application to access information falling within a specified scope of information;

receive, from the user through the REST-based interface, consent to allow the software application to access the information falling with the specified scope of information; and

store, in response to receiving the consent, a mapping between the software application and the scope of information.

14. The system of claim 13, wherein the OAuth authorization server is configured to:

receive, from the software application, through the REST-based interface, a particular request that specifies the scope of information; and

send, in response to the particular request, through the REST-based interface, a request for an authentication credential associated with the user.

15. The system of claim 14, wherein the OAuth authorization server is configured to:

receive the authentication credential through the REST-based interface; and

determine whether the authentication credential is associated with the user;

wherein said sending of the request for consent in performed in response to a determination that the authentication credential is associated with the user.

16. The system of claim 14, wherein the OAuth authorization server is configured to:

determine, whether the scope of information specified in the mapping includes a scope of information specified in the request from the software application; and

provide, to the software application, through the REST-based interface, information that is associated with the user and that falls within the scope of information specified in the mapping in response to a determination that the scope of information specified in the mapping includes the scope of information specified in the request.

17. The system of claim 13, wherein the OAuth authorization server is configured to receive the consent without involving a Hypertext Transfer Protocol (HTTP) redirect operation.

18. The system of claim 13, wherein the OAuth authorization server is configured to:

receive, through the REST-based interface, a request to revoke the consent; and

delete the mapping in response to receiving the request to revoke the consent.