METHOD, SYSTEM, AND COMPUTER PROGRAM PRODUCT FOR PROVIDING E-TOKEN BASED ACCESS CONTROL FOR VIRTUAL WORLD SPACES

• US 20090254747A1
• Filed: 04/03/2008
• Published: 10/08/2009
• Est. Priority Date: 04/03/2008
• Status: Active Grant

• Current Assignee: Activision Publishing Incorporated (Microsoft Corporation)
• Original Assignee: International Business Machines Corporation
• Inventors: Schmidt, Ansgar, Sommer, Dieter, Husemann, Dirk, Bussani, Anthony
• Granted Patent: US 8,132,235 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/104 Grouping of entities

Abstract

A method for providing e-token based access control to virtual world (VW) spaces includes intercepting a request from a first VW member to invite a second VW member to a VW space within a VW network, the request intercepted outside of the VW network. The access controls also include using a secret code associated with the first member to generate an e-token that includes an identifier of the second member and the space. The access controls further include sending the e-token inside the network. In response to a request for access to the space, the access controls include sending the e-token outside of the network for verification. Upon successful verification of the e-token, the access controls include accessing the network and controlling a guard bot inside the network to grant access for the second member to the space. The guard bot adds the second member to an access control list.

Claims

1. A method for providing e-token based access control to virtual world (VW) spaces, comprising:

intercepting a request from a first VW member to invite a second VW member to a VW space within a VW network, the request intercepted outside of the VW network;

using a secret associated with the first VW member to generate an e-token, the e-token including a name or identifier of the second VW member and an identifier of the VW space;

sending the e-token inside the VW network for storage;

in response to a request, by the second VW member, for access to the VW space, sending the e-token outside of the VW network for verification; and

upon successful verification of the e-token outside of the VW network, accessing the VW network and controlling a guard bot residing inside the VW network to grant access to the second VW member with respect to the VW space;

wherein the guard bot adds the second VW member to an access control list for the VW space.

2. The method of claim 1, wherein the secret code is a private key of a public key/private key pair of the first VW member and the verification of the e-token includes validating whether the identity of the first VW member is an authorized identity for issuing invitations for the VW space.

3. The method of claim 1, wherein the request to invite the second VW member further includes conditions for accessing the VW space, comprising:

a date in which the second VW member is granted access;

a length of time for which the second VW member is granted access;

limitations on activities performed by the second VW member in the VW space; and

a capacity limit including a maximum number of users that are granted access to the VW space at one time;

the method further comprising;

storing the conditions in a database outside of the VW network;

granting access to the second VW member pursuant to the conditions; and

ejecting the second VW member from the VW space when the terms of the conditions have expired.

4. A system for providing e-token based access control to virtual world (VW) spaces, comprising:

a VW server;

an administrator system executing a verification and tracking application;

a first VW member system in communication with the VW server and the administrator system; and

a proxy application and an e-tokenizer application executing on the first VW member system, the proxy application and the e-tokenizer application implementing a method, comprising;

the proxy application intercepting a request from the first VW member system to invite a second VW member system to a VW space within a VW network, the request intercepted outside of the VW network;

the e-tokenizer application using a secret code associated with the first VW member system to generate an e-token, the e-token including a name of identifier of the second VW member system and an identifier of the VW space;

sending the e-token inside the VW network for storage;

in response to a request, by the second VW member system, for access to the VW space, sending the e-token outside of the VW network to the verification and tracking application for verification; and

upon successful verification of the e-token, the verification and tracking application accesses the VW network and controls a guard bot residing inside the VW network to grant access to the second VW member with respect to the VW space;

wherein the guard bot adds the second VW member to an access control list for the VW space.

5. The system of claim 4, wherein the secret code is a private key of a public key/private key pair of the first VW member and the verification of the e-token includes validating whether the identity of the first VW member is an authorized identity for issuing invitations for the VW space.

6. The system of claim 4, wherein the request to invite the second VW member further includes conditions for accessing the VW space, comprising:

a date in which the second VW member is granted access;

a length of time for which the second VW member is granted access;

limitations on activities performed by the second VW member in the VW space; and

a capacity limit including a maximum number of users that are granted access to the VW space at one time;

the method further comprising;

storing the conditions in a database outside of the VW network;

granting access to the second VW member pursuant to the conditions; and

ejecting the second VW member from the VW space when the terms of the conditions have expired.