Delegating authorizations

• US 9,998,448 B2
• Filed: 05/09/2017
• Issued: 06/12/2018
• Est. Priority Date: 11/05/2013
• Status: Active Grant

• Current Assignee: Cable Television Laboratories Incorporated
• Original Assignee: Cable Television Laboratories Incorporated
• Inventors: Lund, Robert M., Johnson, Steven E.
• Primary Examiner(s): Lee, Jason
• Application Number:
  US15/590,325
• Publication Number:
  US 20170244695A1
• Time in Patent Office: 399 Days
• Field of Search: 726 7
• CPC Class Codes: H04L 2209/42 Anonymization, e.g. involving pseudonyms
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807

Abstract

Delegating authorizations sufficient to access services is contemplate. The authorization may be delegated in the form of a token or other transmissible construct relied upon to authenticate access to services, such as but not necessarily limited to conferring a user identity established via authenticated device for the purposes of enabling an unauthenticated or unsecured device to access a service associated with the user identity.

Claims

1. A method for authenticating a sink device to access a service provided through a service webpage of a service without requiring the sink device to input a username and password combination to the service webpage and without requiring the sink device to provide an access token to the service provider, the method comprising:

receiving a credential from the service provider in response to the sink device generating an input to the service webpage, the input being sufficient to indicate a desire to access the service through the service webpage;

associating the access token with at least one of a plurality of control devices, the plurality of control devices each having been previously associated with a uniquely identifying client ID;

identifying a control device of the plurality of control devices associated with one of the uniquely identifying client IDs matching with a client ID included within the credential;

transmitting an alert to the control device indicating the sink device desiring access to the service through the service webpage;

receiving an alert response from the control device indicating an acceptance or a denial from a user thereof to permit transmission of the access token to the service provider on behalf of the sink device;

transmitting the access token to the service provider to facilitate the sink device accessing the service through the service webpage when the acceptance is determined; and

transmitting a denial of service to the service provider instead of the access token when the denial is determined.

2. The method claim 1 further comprising:

transmitting the alert to the control device via an alert webpage displayed on a browser of the control device; and

determining the acceptance or the denial as a function of an input made to the alert webpage.

3. The method claim 2 further comprising including an identification of the service within the alert webpage.

4. The method of claim 2 further comprising including an identification of the sink device within the alert webpage.

5. The method claim 2 further comprising:

including a username and password input within the alert webpage; and

authenticating input of the username and password combination to the input prior to transmitting the access token to the service provider.

6. The method of claim 1 further comprising:

including the credential within the alert;

recovering the credential from the acceptance; and

transmitting the credential recovered from the acceptance with the access token to the service provider to facilitate the sink device accessing the service.

7. The method of claim 6 further comprising discarding the credential following transmission of the alert and prior to receipt of the acceptance.

8. The method of claim 1 further comprising instructing the sink device to exchange wireless signals with the control device to obtain the client ID.

9. A method for authenticating a sink device to access a service provided through a service webpage of a service without requiring the sink device to input a username and password combination to the service webpage and without requiring the sink device to provide an access token to the service provider, the method comprising:

transmitting the access token from the service provider to a server prior to the sink device attempting to access the service webpage, the server associating the access token with at least one of a plurality of control devices, the plurality of control devices each having been previously associated with a uniquely identifying client ID;

transmitting a credential from the service provider to the server upon receipt of a client ID from the sink device, the credential indicating the service desired for access through the service webpage and the client ID;

receiving an access message from the server in response to the credential, the access message;

i) including the access token and an authentication indicator when a control device of the plurality of control devices having the uniquely identifying client ID matching the client ID in the credential indicates an acceptance to access the service; and

ii) omitting the access token and including an unauthenticated indicator when the control device indicates a denial to access the service is determined; and

permitting the sink device access to the service through the service webpage upon receipt of the authentication indicator and verification of the access token; and

denying the sink device access to the service upon receipt of the unauthenticated indicator.

10. The method of claim 9 further the server in response to the credential:

transmitting an alert to the control device indicating the sink device desiring access to the service through the service webpage; and

receiving an alert response from the control device indicating the acceptance or the denial from a user thereof.

11. The method of claim 9 further comprising instructing the sink device to perform a discovery process whereby the client ID is determined from messages exchanged between the sink device and the control device.

12. The method of claim 11 further comprising instructing the sink device to determine the client ID as a (MAC) addresses of the control device.

13. The method of claim 9 further comprising determining the client ID from a username input to the service webpage.

14. The method of claim 9 further comprising determining the client ID from the sink device determining an indicator displayed on the control device having an indicia sufficient for identifying the control device.

15. The method of claim 14 further comprising instructing an application on the sink device to determine the indicia by processing an image of the indicator captured with a camera thereof.

16. A non-transitory computer-readable medium having a plurality of non-transitory instructions operable with a hardware processor to facilitate access to a service of a service provider, the non-transitory instructions being sufficient for:

receiving a credential from the service provider in response to a sink device generating an input to a service webpage used to access the service, the input being sufficient to indicate a desire to access the service through the service webpage;

associating an access token used to confer access to the service with at least one of a plurality of control devices, the plurality of control devices each having been previously associated with a uniquely identifying client ID;

identifying a control device of the plurality of control devices associated with one of the uniquely identifying client IDs matching with a client ID included within the credential;

transmitting the access token to the service provider to facilitate the sink device accessing the service through the service webpage when an acceptance from the control device to access the service is determined; and

transmitting a denial of service to the service provider instead of the access token when a denial from the control device to access the service is determined.

17. The non-transitory computer-readable medium of claim 16 wherein the non-transitory instructions are sufficient for:

transmitting an alert to the control device indicating the sink device desiring access to the service through the service webpage; and

receiving an alert response from the control device indicating the acceptance or the denial from a user thereof to permit access to the service.

18. The non-transitory computer-readable medium of claim 17 wherein the non-transitory instructions are sufficient for:

transmitting the alert to the control device via an alert webpage displayed on a browser of the control device; and

determining the acceptance or the denial as a function of an input made to the alert webpage.

19. The non-transitory computer-readable medium of claim 18 wherein the non-transitory instructions are sufficient for including an identification of the service within the alert webpage.

20. The non-transitory computer-readable medium of claim 19 wherein the non-transitory instructions are sufficient for including an identification of the sink device within the alert webpage.