METHOD AND SYSTEM FOR PERFORMING DELEGATION OF RESOURCES

• US 20100319068A1
• Filed: 08/27/2008
• Published: 12/16/2010
• Est. Priority Date: 08/27/2007
• Status: Abandoned Application

• Current Assignee: NEC Europe Ltd
• Original Assignee: NEC Europe Ltd
• Inventors: Abbadessa, Daniele, Girao, Joao
• Application Number:
  US12/675,838
• Publication Number:
  US 20100319068A1
• Time in Patent Office: Days
• US Class Current: 726/21
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A method for performing delegation of resources, in particular services, wherein a user—resource owner—has access to a resource offered by a service provider and wherein the resource is delegated to at least one other user—delegate—by using delegation credentials, is characterized in that the method includes the steps of defining authorization rules for the delegate regarding resource access restrictions and registering the authorization rules at an identity provider thereby employing the delegation credentials, performing an authentication of the delegate at the service provider, and performing an authorization of the delegate at the identity provider based on the authorization rules. Furthermore, a corresponding system is disclosed.

Claims

1. Method for performing delegation of resources, in particular services, wherein a user—

resource owner—

has access to a resource offered by a service provider and wherein the resource is delegated to at least one other user—

delegate—

by using delegation credentials,

characterized in that the method comprises the steps of

performing an authentication of the delegate at the service provider, and

performing an authorization of the delegate at an identity provider based on authorization rules.

2. Method according to claim 1, wherein said authorization rules defined for a delegate are registered at said identity provider, thereby employing said delegation credentials.

3. Method according to claim 1, wherein said authorization rules defined for a delegate include resource access restrictions.

4. Method according to claim 1, wherein said access to a resource is established by the resource owner holding a subscription to a service.

5. Method according to claim 1, wherein said delegation credentials are issued by said service provider.

6. Method according to claim 1, wherein said delegation credentials are handed over to the delegate.

7. Method according to claim 1, wherein said authentication of the delegate at the service provider is performed on the basis of said delegation credentials.

8. Method according to claim 1, wherein, upon the delegate requesting the service at the service provider, an authentication of the delegate is performed at the identity provider on the basis of said delegation credentials.

9. Method according to claim 1, wherein an authorization is performed at the service provider.

10. Method according to claim 1, wherein user accounts are provided at the identity provider, each account being linked to another digital identity of the user.

11. Method according to claim 10, wherein said authorization rules defined for a delegate are defined in a digital identity specific manner.

12. Method according to claim 10, wherein the authentication of the delegate at the service provider is based upon the digital identity of the delegate.

13. Method according to claim 1, wherein said authorization rules are based on the type of resource/service, time, user costs of resource/service and/or the like.

14. Method according to claim 1, wherein said authorization rules relate to the allowance or denial of further delegation.

15. Method according to claim 1, wherein said delegation credentials include a certificate and a secret key.

16. Method according to claim 1, wherein the authorization information is centralized at the identity provider aggregated per each delegate.

17. Method according to claim 1, wherein the authorization information is centralized at the identity provider aggregated per each service.

18. System for performing delegation of resources, in particular services, the system comprising a service provider for offering a resource, wherein a user—

resource owner—

has access to the resource, and wherein the resource is delegated to at least one other user—

delegate—

by using delegation credentials,

characterized in that

said service provider is configured to perform an authentication of the delegate, and that

an identity provider is provided, which is configured to perform an authorization of the delegate based on authorization rules.

19. System according to claim 18, wherein said identity provider is configured to enable registration of said authorization rules defined for a delegate, thereby employing said delegation credentials.

20. System according to claim 18, wherein said authorization rules defined for a delegate include resource access restrictions.

21. System according to claim 18, including an Identity Management System for performing users'"'"' account management.