AUTHORIZATION FOR ACCESS TO WEB SERVICE RESOURCES

• US 20080263638A1
• Filed: 02/01/2008
• Published: 10/23/2008
• Est. Priority Date: 04/20/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: McMurtry, Craig V., Gabarra, Mark E., Weinert, Alexander T., Meleshuk, Vadim
• Granted Patent: US 7,979,896 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

A web service includes a protected resource. A requester requests access to the protected resource by sending a request to the web service. The web service prevents access to the web service until the request has been authorized by an authorizer. After the request has been authorized by the authorizer, the web service allows the requester to access the protected resource.

Claims

1. A computing system for controlling access to a protected Web service resource, the computing system comprising:

a communication device for communicating across a communication network;

a processor communicatively connected to the communication device; and

memory storing program instructions, which when executed by the processor cause the computing system to perform operations comprising;

receiving a request to access a protected Web service resource from the communication network;

determining whether the request to access the protected Web service resource has been authorized;

if the request has not been authorized, denying access to the protected Web service resource; and

if the request has been authorized, permitting access to the protected Web service resource.

2. The computing system of claim 1, wherein receiving the request comprises receiving a create message.

3. The computing system of claim 2, wherein, upon receiving the create message, the instructions cause the computing system to perform operations comprising:

determining whether authorization is required to access the protected Web service resource; and

generating and storing a resource request associated with the request to store data relating to a status of the request.

4. The computing system of claim 1, the operations further comprising generating and storing a request resource associated with the request in memory, the request resource containing data that identifies whether the request has been authorized.

5. The computing system of claim 4, wherein the request resource is defined by an extensible markup language.

6. The computing system of claim 5, wherein the request resource comprises:

a first element that stores an identifier of an operation to be performed; and

a second element that stores an identifier of a current status of the request to access the protected Web service resource.

7. The computing system of claim 6, wherein the request resource further comprises a request element storing a copy of the status element, details element, approval processes element, and data element.

8. The computing system of claim 4, wherein determining whether the request to access the protected Web service resource has been authorized comprises retrieving the data that identifies whether the request has been authorized from the request resource.

9. The computing system of claim 4, wherein denying access to the protected Web service resource comprises sending a fault message across the network.

10. The computing system of claim 4, wherein permitting access to the protected Web service resource further comprises an operation selected from the group comprising changing the protected resource, modifying the protected resource, adding to the protected resource, deleting the protected resource, modifying the protected resource, and using the protected resource.

11. A method of authorizing access to a Web service resource, the method comprising:

receiving a request from a requester identifying a Web service resource;

determining that authorization is required to access the Web service resource;

receiving authorization from an authorizer which authorizes the requester to access the Web service resource; and

communicating the authorization to the requester.

12. The method of claim 11, further comprising:

receiving a second request from the requester identifying the Web service resource;

determining that the second request has been authorized by the authorizer; and

providing access to the Web service resource.

13. A method of claim 11, further comprising generating a request resource after determining that authorization is required.

14. The method of claim 13, further comprising updating the request resource after receiving authorization from the authorizer with data indicating that the request has been authorized by the authorizer.

15. The method of claim 13, wherein the resource request is generated in an extensible markup language.

16. A computer readable storage medium containing computer executable instructions which when executed by a computer perform a method of authorizing access to of a protected resource, the method comprising:

receiving a request from a requester identifying the protected resource of a Web service;

receiving an authorization which authorizes use of the protected resource of the Web service;

determining that the request has been authorized; and

communicating the authorization to the requester.

17. The computer readable storage medium of claim 16, the method further comprising allowing access to the protected resource after determining that the request has been authorized.

18. The computer readable storage medium of claim 16, the method further comprising generating and storing a resource request after receiving a request identifying the protected resource of the Web service.

19. The computer readable storage medium of claim 18, the method further comprising updating the resource request after receiving the authorization to indicate that the request has been authorized.

20. The computer readable storage medium of claim 19, wherein determining that the request has been authorized comprises retrieving data from the resource request and determining that the data indicates that the request has been authorized.