Delegating authorizations

• US 9,350,720 B2
• Filed: 05/22/2014
• Issued: 05/24/2016
• Est. Priority Date: 11/05/2013
• Status: Active Grant

• Current Assignee: Cable Television Laboratories Incorporated
• Original Assignee: Cable Television Laboratories Incorporated
• Inventors: Lund, Robert M., Marcia, Oscar G., Johnson, Steven E.
• Primary Examiner(s): LEE, JASON T
• Application Number:
  US14/284,667
• Publication Number:
  US 20150128237A1
• Time in Patent Office: 733 Days
• Field of Search: 726/7
• US Class Current: 1/1
• CPC Class Codes: H04L 2209/42 Anonymization, e.g. involving pseudonyms
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807

Abstract

Delegation of authorizations from one device to another device is contemplated. The contemplated capabilities may enable an authenticated device to confer access tokens or other authoritative permissions to a non-authenticated or unsecured device, such as to enable the delegated device to access user content without the user having to enter a username and password or other identifying credentials thereto.

Claims

1. A method for delegating authorization to access user content kept at a plurality of service providers, the plurality of service providers associating the user content for a plurality of users with one or more of a plurality of access tokens such that each access token confers access to the user content of the associated user, the method comprising:

receiving the plurality of access tokens from the plurality of service providers after the plurality of service providers associates each of the plurality of access tokens with at least one of the plurality of users;

receiving credentials from a control device, the credentials identifying a first user of the plurality of the users and being received as a function of the first user interacting with a first webpage displayed on the control device;

selecting a first access token associated with the first user identified with the credentials from the plurality of access tokens received from the plurality of service providers;

transmitting the first access token to the control device for subsequent transmission to a sink device; and

transmitting a content request redirect to the sink device to prompt the sink device to transmit the first access token to a first service provider of the plurality of service providers, the first service provider verifying the first access token prior to responsively transmitting a first user content associated with the first access token to the sink device.

2. The method of claim 1 further comprising identifying the sink device as a function of the first user interacting with the first webpage displayed on the control device.

3. The method of claim 2 further comprising identifying the first service provider as a function of the first user interacting with the first webpage displayed on the control device.

4. The method of claim 3 further comprising:

determining the first user to be associated with multiple access tokens associated with different service providers; and

selecting the first access token from the multiple access tokens as a function of the first service provider identified from the first user interacting with the first webpage.

5. The method of claim 3 further comprising transmitting a session ID cookie with the first access token to the control device, the session ID cookie representing a relationship of the first user to the control device, the sink device and the first service provider proximate in time to receipt of the credentials.

6. The method of claim 5 further comprising transmitting a first universal resource locator (URL) with the session ID cookie to the control device, the control device subsequently transmitting the first URL and the session ID cookie to the sink device through an unsecure connection, the sink device transmitting the session ID cookie to a server associated with the first URL.

7. The method of claim 6 further comprising verifying the session ID cookie as received at the server and downloading a second webpage to the sink device when the session ID cookie is verified.

8. The method of claim 7 further comprising including instructions within the second webpage to prompt the sink device to establish a secure connection with the control device, the control device providing the access token and a second URL to the sink device through the secure connection, the second URL causing the sink device to create an iFrame within the second webpage and to re-transmit the session ID cookie to the server.

9. The method of claim 8 further comprising downloading a content access page to the sink device for display within the iFrame and including instructions with the content access page to prompt the sink device to transmit the first access token to the first service provider, the first user content received in response to the first access token then being displayed within the content access page of the iFrame, the first service provider being different from a second service provider associated with the sink device.

10. The method claim 9 further comprising transmitting a first authorization code to the first service provider following receipt of an enable message from the control device, the first service provider responsively transmitting the first access code to the server for the subsequent transmission to the control device, the enable message being generated at the control device as a function of user interaction with a third webpage displayed on the control device prior to determining the first service provider as a function of user interaction with the first webpage.

11. The method of claim 1 further comprising receiving the plurality of access tokens at a database associated with a multiple system operator (MSO) prior to the first access token being transmitted from the database to the control device.

12. The method of claim 1 further comprising transmitting the first access token to the control device without receiving credentials from the sink device before the first user content is transmitted thereto or without associating the sink device with the credentials of the control device.

13. A method of enabling access to user content kept at a first service provider without requiring a requesting device to provide a username and password or other user identifying credential for an associated user to the first service provider, the first service provider requiring receipt of the username and password or the other user identifying credential prior to issuing an access token required to access the user content, the method comprising:

storing the access token at a second service provider after issuance from the first service provider;

authenticating a conferring device to access a my services everywhere (MSE) service associated with the second service provider as a function of user identifying information received therefrom as a function of the first user interacting with a first webpage displayed on the conferring device;

receiving a request from the conferring device to enable the requesting device to access the user content via the MSE service; and

transmitting the access token from the second service provider to the conferring device, the conferring device then transmitting the access token to the requesting device to access the user content from the service provider, the access token thereby being provided to the requesting device without the requesting device having to provide the username and password or the other user identifying credential to either one of the first and second service providers.

14. The method of claim 13 further comprising transmitting the username and password or the other user identifying credential from the second service provider to the first service provider in order to obtain the access token from the first service provider for storage at the second service provider.

15. The method claim 13 further comprising facilitating display of the user content within a MSE webpage downloaded to the requesting device, the MSE webpage having branding for the second service provider.

16. The method claim 15 further comprising facilitating shared document object model (DOM) remote control of the MSE webpage via the conferring device.

17. A non-transitory computer-readable medium having a plurality of instructions operable with a processor to facilitate a my services everywhere (MSE) service, the MSE service enabling a control device to confer authorizations to a sink device to access user content without requiring input of personally identifying information through the sink device, the user content being kept at a plurality of service providers, the plurality of service providers associating the user content for a plurality of users with one or more of a plurality of access tokens such that each access token confers access to the user content of the associated user, the plurality of instructions being sufficient for:

facilitating an access token issuance process whereby the plurality of access tokens are received from the plurality of service providers as a function of personally identifying information obtained from the plurality of users;

downloading a first MSE page to the control device as a function of personally identifying credentials received therethrough, the personally identifying credentials identifying a first user of the plurality of users as a function of the first user interacting with a first webpage displayed on the control device;

transmitting a first access token to the control device via the first MSE page subsequent transmission to the sink device, the first access token being determined based on the credentials to be associated with the first user, the first access token being selected from the plurality of access tokens received from the plurality of service providers as a function of the personally identifying information; and

downloading a second MSE page to the sink device, the second MSE page prompting the sink device to transmit the first access token to a first service provider of the plurality of service providers, the first service provider verifying the first access token prior to responsively transmitting a first user content associated with the first access token to the sink device.

18. The non-transitory computer-readable medium of claim 17 further comprising instructions sufficient for displaying the first user content within an iFrame of the second MSE page downloaded to the sink device, thereby causing the first user content to be displayed on the sink device without requiring the user to input through the sink device the personally identifying information used to obtain the first access token from the first service provider.

19. The non-transitory computer-readable medium of claim 17 further comprising instructions sufficient for facilitating shared document object model (DOM) remote control of the second MSE webpage on the sink device via user inputs made to the first MSE webpage the of the control device.