SYSTEM AND METHOD OF INTER-ACCOUNT RESOURCE ACCESS MANAGEMENT

• US 20190007399A1
• Filed: 06/30/2017
• Published: 01/03/2019
• Est. Priority Date: 06/30/2017
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Inventors: Stevens, III, Ira C., Katis, Nicholas H.
• Granted Patent: US 10,530,771 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol

Abstract

An improved method and system of enabling the owner of an account associated with a resource to allow a second user to gain access to the resource or a particular aspect of the resource is disclosed. Solutions and implementations disclosed provide an easily manageable mechanism for allowing access to a resource, without the need for a complex administrator-based access control system. Instead, a negotiated account to account resource access arrangement is established between the first user'"'"'s account and the second user'"'"'s account to share some or all of the actions available to the first user for the resource.

Claims

1. A method comprising:

receiving a request from a first user to provide access to a resource to a second user, the request being received via a user interface of a first device;

creating a delegate for the resource, the delegate establishing an account to account access relationship between the first user and the second user;

notifying the second user via a message that the second user can access the resource;

presenting the message to the second user on a graphical user interface of a second user device, the message including a link for accepting the account to account access relationship;

receiving confirmation via an input device of the second user device, the confirmation indicating that the second user accepted the account to account access relationship;

authenticating the second user upon receiving confirmation of acceptance by the second user;

connecting the second user to the delegate; and

providing access to the resource to the second user via the delegate.

2. The method of claim 1, further comprising determining if the first user has permission to grant access to the resource to the second user before creating the delegate.

3. The method of claim 1, further comprising determining if the second user has permission to connect to the delegate, before connecting the second user to the delegate.

4. The method of claim 3, further comprising:

determining if the second user has an account;

creating an account if it is determined that the second user does not have an account; and

guiding the second user to log in to an application using the second user account.

5. The method of claim 1, wherein authenticating the second user includes verifying a digital signature included in the message was originated from the first user.

6. The method of claim 1, further comprising using the delegate to access the resource.

7. The method of claim 6, further comprising using the delegate to modify the resource.

8. The method of claim 1, wherein the request from the first user to provide access to the second user includes at least one condition on the second user'"'"'s access to the resource.

9. The method of claim 8, wherein the one condition includes a schedule of time when the second user can access the resource.

10. The method of claim 8, wherein the one condition includes a limitation a scope of the second user'"'"'s access to the resource.

11. The method of claim 1, further comprising terminating access to the resource.

12. At least one non-transitory computer readable medium on which are stored instructions comprising instructions that when executed cause a programmable device to:

receive a request from a first user to provide access to a resource to a second user, the request being received via a user interface of a first device;

create a delegate for the resource, the delegate establishing an account to account access relationship between the first user and the second user;

notify the second user via a message that the second user can access the resource;

present the message to the second user on a graphical user interface of a second user device, the message including a link for accepting the account to account access relationship;

receive confirmation via an input device of the second user device, the confirmation indicating that the second user accepted the account to account access relationship;

authenticate the second user upon receiving confirmation of acceptance by the second user;

connect the second user to the delegate; and

provide access to the resource to the second user via the delegate.

13. The non-transitory computer readable medium of claim 12, wherein the request from the first user includes one or more restrictions on the second user'"'"'s access to the resource.

14. The non-transitory computer readable medium of claim 13, wherein at least one of the restrictions is a geographical restriction placed on the second user'"'"'s access to the resource.

15. The non-transitory computer readable medium of claim 12, wherein the request from the first user includes one or more identifying information for the second user.

16. The non-transitory computer readable medium of claim 12, wherein access to the resource, includes permission to create a new resource.

17. A system comprising:

a processor;

a wireless communication module communicatively coupled to the processor; and

a memory, communicatively coupled to the processor on which are stored instructions that when executed configure the processor to;

receive a request from a first user to provide access to a resource to a second user, the request being received via a user interface of a first device and the wireless communication module;

create a delegate for the resource, the delegate establishing an account to account access relationship between the first user and the second user;

send a message that the second user can access the resource;

receive confirmation via an input device of the second user device, the confirmation indicating that the second user accepted the account to account access relationship;

authenticate the second user upon receiving confirmation of acceptance by the second user;

connect the second user to the delegate; and

provide access to the resource to the second user via the delegate.

18. The system of claim 17, further comprising instructions that when executed configure the processor to determine if the first user'"'"'s account includes a right to grant access to the second user'"'"'s account.

19. The system of claim 17, further comprising instructions that when executed configure the processor to provide a means to the second user to access the resource, once the link is created.

20. The system of claim 17, further comprising instructions that when executed configure the processor to delete the account to account access arrangement once a request to terminate is received.