Bidirectional authorization system, client and method

• US 9,462,003 B2
• Filed: 09/23/2013
• Issued: 10/04/2016
• Est. Priority Date: 03/01/2013
• Status: Active Grant

• Current Assignee: ZTE Corporation
• Original Assignee: ZTE Corporation
• Inventors: Liu, Xian
• Primary Examiner(s): LANIER, BENJAMIN E
• Application Number:
  US14/770,751
• Publication Number:
  US 20160006743A1
• Time in Patent Office: 1,107 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key

Abstract

Disclosed is a bidirectional authorization system, including a first service provision subsystem configured to acquire a first temporary credential of the first service provision subsystem and a second temporary credential of a second service provision subsystem, respectively, send the second and the first temporary credential to the user terminal and the second service provision subsystem, respectively, send the second authorization credential returned by the user terminal to the second service provision subsystem to exchange for a second access token and acquire the second service resources; a second service provision subsystem configured to modify the first temporary credential and send it to the user terminal, send the first authorization credential returned by the user terminal to the first service provision subsystem to exchange for a first access token, and acquire the first service resources; and a user terminal configured to authorize the received second and first temporary credentials, respectively, and return the second and first authorization credentials to the first and second service provision subsystems, respectively. A bidirectional authorization client and a method are also disclosed. The present disclosure can be used to enable clients on both sides to simultaneously access resources of the opposite side.

Claims

1. A system for bidirectional authorization, comprising a first service provision subsystem, a second service provision subsystem and a user terminal, wherein,

the first service provision subsystem is configured to acquire a first temporary credential of the first service provision subsystem and a second temporary credential of the second service provision subsystem, respectively, send the second temporary credential to the user terminal for authorization, receive a second authorization credential returned by the user terminal, send the second authorization credential to the second service provision subsystem to exchange for a second access token, acquire resources in the second service provision subsystem according to the second access token and send the first temporary credential to the second service provision subsystem;

the second service provision subsystem is configured to receive the first temporary credential from the first service provision subsystem, modify an identifier in the first temporary credential, send the modified first temporary credential to the user terminal for authorization, receive a first authorization credential returned by the user terminal, send the first authorization credential to the first service provision subsystem to exchange for a first access token, and acquire resources in the first service provision subsystem according to the first access token; and

the user terminal is configured to respectively receive the second temporary credential from the first service provision subsystem and the first temporary credential from the second service provision subsystem, respectively authorize the second and first temporary credentials, and send the second and first authorization credentials to the first and second service provision subsystems, respectively.

2. The system of claim 1, wherein the first service provision subsystem comprises a first client, a first Open Auth (OAuth) server and a first resources server;

wherein,

the first client is configured to send commands for requesting a temporary credential to the first OAuth server and the second service provision subsystem, respectively, receive the first and second temporary credentials returned respectively by the first OAuth server and the second service provision subsystem, send the second temporary credential to the user terminal for authorization;

receive the second authorization credential returned by the user terminal, send the second authorization credential to the second service provision subsystem to exchange for a second access token, send the second access token to the second service provision subsystem for authentication, access the resources provided by the second service provision subsystem after successful authentication by the second service provision subsystem, and send the first temporary credential to the second service provision subsystem for modification of a client identifier;

the first OAuth server is configured to receive from the first client the command for requesting a temporary credential, return the first temporary credential to the first client according to the command, receive the first authorization credential from the second service provision subsystem, return the first access token to the second service provision subsystem and send the first access token to the first resources server to serve as a basis of the authentication; and

the first resources server is configured to receive the first access token from the second service provision subsystem, authenticate the first access token sent by the second service provision subsystem according to the first access token sent by the first OAuth server, and provide first service resources to the second service provision subsystem for access after successful authentication.

3. The system of claim 1, wherein the second service provision subsystem comprises a second client, a second OAuth server and a second resources server;

wherein,

the second client is configured to receive the first temporary credential from the first service provision subsystem and modify the identifier of a first client in the first temporary credential to be an identifier of the second client, send the modified first temporary credential to the user terminal for authorization, receive the first authorization credential returned by the user terminal, send the first authorization credential to the first service provision subsystem to exchange for the first access token, send the first access token to the first service provision subsystem for authentication, and access the resources provided by the first service provision subsystem after successful authentication by the first service provision subsystem;

the second OAuth server is configured to receive a command for requesting a temporary credential from the first service provision subsystem, return the second temporary credential to the first service provision subsystem according to the command, receive the second authorization credential from the first service provision subsystem, return the second access token to the first service provision subsystem and send the second access token to the second resources server to serve as a basis of the authentication; and

the second resources server is configured to receive the second access token from the first service provision subsystem, authenticate the second access token sent by the first service provision subsystem according to the second access token sent by the second OAuth server, and provide second service resources to the first service provision subsystem for access after successful authentication.

4. The system of claim 2, wherein the second service provision subsystem comprises a second client, a second OAuth server and a second resources server;

the first client is configured to send the commands for requesting a temporary credential to the first OAuth server and the second OAuth server, respectively, receive the first and second temporary credentials returned by the first OAuth server and the second OAuth server, respectively, send the second temporary credential to the user terminal for authorization;

receive the second authorization credential returned by the user terminal, send the second authorization credential to the second OAuth server to exchange for the second access token, send the second access token to the second resources server for authentication, and access the resources provided by the second resources server after successful authentication by the second resources server;

the first client is further configured to send the first temporary credential to the second client;

the first OAuth server is configured to receive the command for requesting a temporary credential from the first client, return the first temporary credential to the first client according to the command, receive the first authorization credential from the second client, return the first access token to the second client and send the first access token to the first resources server to serve as a basis of the authentication;

the first resources server is configured to receive the first access token from the second client, authenticate the first access token sent by the second client according to the first access token sent by the first OAuth server, and provide the first service resources to the second client for access after successful authentication;

the second client is configured to receive the first temporary credential from the first OAuth server and modify the identifier of the first client in the first temporary credential to be the identifier of the second client, send the modified first temporary credential to the user terminal for authorization, receive the first authorization credential returned by the user terminal, send the first authorization credential to the first OAuth server to exchange for a first access token, send the first access token to the first resources server for authentication, and access the resources provided by the first resources server after the successful authentication by the first resources server;

the second OAuth server is configured to receive the command for requesting temporary credential from the first client, return the second temporary credential to the first client according to the command, receive the second authorization credential from the first client, return the second access token to the first client and send the second access token to the second resources server as a basis of the authentication; and

the second resources server is configured to receive the second access token from the first client, authenticate the second access token sent by the first client according to the second access token sent by the second OAuth server, and provide second service resources to the first client for access after successful authentication.

5. The system of claim 3, wherein the command for requesting a temporary credential is carried by a temporary credential request packet defined by an OAuth protocol.

6. A client provided in a service provision subsystem, the service provision subsystem further comprising an Open Auth (OAuth) server and a resources server;

the client comprising a memory storing programming instructions and a processor configured to be capable of executing the stored programming instructions to perform steps comprising;

sending commands for requesting a temporary credential to the OAuth server of the service provision subsystem at a local side and an OAuth server of a service provision subsystem at another side, respectively, receiving a first temporary credential returned by the OAuth server of the service provision subsystem at the local side and a second temporary credential returned by the OAuth server of the service provision subsystem at the another side, respectively, and sending the first temporary credential to a client of the service provision subsystem at the another side;

sending the second temporary credential to a user terminal for authorization, receiving an authorization credential returned by the user terminal and sending the authorization credential to the OAuth server of the service provision subsystem at the another side to exchange for an access token; and

sending the access token to a resources server of the service provision subsystem at the another side for authentication, accessing resources provided by the resources server of the service provision subsystem at the another side after successful authentication by the resources server of the service provision subsystem at the another side.

7. A client provided in a service provision subsystem, the service provision subsystem further comprising an OAuth server and a resources server;

the client comprising a memory storing programming instructions and a processor configured to be capable of executing the stored programming instructions to perform steps comprising;

receiving a first temporary credential from an OAuth server of a service provision subsystem at another side, and modifying a client identifier of the service provision subsystem at the another side in the first temporary credential to be a client identifier of the service provision subsystem at a local side;

sending the modified first temporary credential to a user terminal for authorization, receiving a first authorization credential returned by the user terminal, and sending the first authorization credential to the OAuth server of the service provision subsystem at the another side to exchange for a first access token; and

sending the first access token to a resources server of the service provision subsystem at the another side for authentication, and accessing resources provided by the resources server of the service provision subsystem at the another side after successful authentication by the resources server of the service provision subsystem at the another side.

8. A method for bidirectional authorization, comprising:

acquiring, by a first service provision subsystem, a first temporary credential of the first service provision subsystem and a second temporary credential of a second service provision subsystem, sending the second temporary credential to a user terminal for authorization and obtaining a second authorization credential, sending the second authorization credential to the second service provision subsystem to exchange for a second access token, acquiring resources in the second service provision subsystem according to the second access token, and sending the first temporary credential to the second service provision subsystem for modification of an identifier; and

sending, by the second service provision subsystem, the modified first temporary credential to the user terminal for authorization and obtaining a first authorization credential, sending the first authorization credential to the first service provision subsystem to exchange for a first access token, and acquiring resources in the first service provision subsystem according to the first access token.

9. The method of claim 8, wherein acquiring, by the first service provision subsystem, the first temporary credential of the first service provision subsystem and the second temporary credential of the second service provision subsystem comprises:

sending, by a first client of the first service provision subsystem, commands for requesting a temporary credential to a first OAuth server of the first service provision subsystem and a second OAuth server of the second service provision subsystem, respectively, and receiving the first and second temporary credentials respectively returned by the first and second OAuth servers.

10. The method of claim 8, wherein,

the authorization for the first temporary credential comprises inputting a user name and a password of the first service provision subsystem, wherein the user name and the password are a user name and a password registered by the user terminal at the first service provision subsystem;

and

the authorization for the second temporary credential comprises inputting a user name and a password of the second service provision subsystem, wherein the user name and the password are a user name and a password registered by the user terminal at the second service provision subsystem.

11. The method of claim 9, wherein,

the authorization for the first temporary credential comprises inputting a user name and a password of the first service provision subsystem, wherein the user name and the password are a user name and a password registered by the user terminal at the first service provision subsystem;

and

the authorization for the second temporary credential comprises inputting a user name and a password of the second service provision subsystem, wherein the user name and the password are a user name and a password registered by the user terminal at the second service provision subsystem.