Access right control using access control alerts

• US 9,497,279 B2
• Filed: 05/11/2011
• Issued: 11/15/2016
• Est. Priority Date: 01/29/2003
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Technologies Oy (Nokia Corporation)
• Inventors: Trossen, Dirk, Mehta, Kuleen
• Primary Examiner(s): Lazaro, David
• Assistant Examiner(s): Chang, Julian
• Application Number:
  US13/105,581
• Publication Number:
  US 20110214164A1
• Time in Patent Office: 2,015 Days
• Field of Search: 709217-229, 709204-207, 726 1- 21
• US Class Current: 1/1
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/54 Presence management, e.g. monitoring or registration for receipt of user log-on information, or the connection status of the users
• CPC Class Codes: H04L 67/55 Push-based network services

Abstract

Systems and methods are provided for providing access controlled event subscription and notification and event access change alerts. In some embodiments, the systems and methods of the present invention operate within a SIP infrastructure. As such, SIP SUBSCRIBE messages and SIP NOTIFY messages are used for subscribing to and receiving notifications related to access control. According to some embodiments, event access change alerts are used in conjunction with access controlled event subscription to provide an efficient method for providing access controlled event subscription using current access control information.

Claims

1. A method comprising:

creating, by a requester, a subscribe message comprising a request for information about access rights to a particular resource and for information about any change to a level of access of the access rights, wherein the subscribe message specifies an event package and an event type to which to subscribe, wherein the information about access rights comprises information having an attribute-based format that conforms with a service location protocol;

determining, by the requester, to send the subscribe message to a network entity that comprises an event server, where the network entity queries a database of said event server containing access control information for said particular resource; and

in response to said access control information not indicating denial of access to said particular resource, receiving, in response to the sent subscribe message, a notify message specifying information about a description of the particular resource, access right information relating to the change to the level of access of the access rights to the particular resource, and an event triggering the change to the level of access of the access rights, wherein the subscribe message and the notify message are generated according to a session initiation protocol.

2. A method of claim 1, further comprising:

receiving another notify message specifying information about the changed access rights for the particular resource.

3. A method of claim 1, wherein the information is obtained by the network entity from a repository separate from the network entity only if the access control information does not indicate denial of access to said particular resource.

4. A method of claim 1, wherein the database of said event server stores subscription information and access control information of more than one user for said particular resource, and wherein the request for information is about access rights to the particular resource and for information about any change to the level of access of the access rights is for more than one user.

5. The method of claim 1, wherein the request comprises a request for information about any change to the level of access of the access rights of a particular user identified in the request.

6. A method of claim 1, further comprising interacting with a network entity to change the access rights for the event package, wherein the subscribe message is sent to another network entity.

7. A method comprising:

receiving, from a requester, a subscribe message comprising a request for information about access rights to a particular resource and for information about any change to a level of access of the access rights wherein the information about access rights comprises information having an attribute-based format that conforms with a service location protocol;

determining whether the requester is authorized to obtain status information about the access rights for the particular resource, wherein the determining comprises querying a database containing access control information for said particular resource;

based on the determination that there is not a denial of access, obtaining from a separate repository information about access rights to the particular resource; and

creating, in response to the subscribe message, a notify message specifying information about a description of the resource, access right information relating to the change to the level of access in the access rights to the particular resource, and an event triggering the change to the level of access of the access rights, wherein the subscribe message and the notify message are generated according to a session initiation protocol.

8. A method of claim 7, further comprising:

creating another notify message specifying information about changed access rights for the particular resource.

9. A method of claim 7, wherein the matching of the information comprises:

determining to send a match message to the repository, the match message requesting access rights information for the particular resource; and

receiving a response from the repository, the response comprising access right information for the particular resource.

10. A method of claim 7, further comprising:

receiving the status information from a local cache of access rights.

11. An apparatus comprising:

at least one processor; and

at least one memory including computer program code for one or more programs,

the at least one memory and the computer program code configured to with the at least one processor, cause the apparatus to perform at least the following,

create a subscribe message comprising a request for information about access rights to a particular resource and for information about any change to a level of access of the access rights, wherein the subscribe message specifies an event package and an event type to which to subscribe, wherein the information about access rights comprises information having an attribute-based format that conforms with a service location protocol;

determine to send the subscribe message to a network entity that comprises an event server, where the network entity queries a database of said event server containing access control information for said particular resource; and

based on said access control information not indicating a denial of access to said particular resource, receive, in response to the sent subscribe message, a notify message specifying information about a description of the resource, access right information relating to the change to the level of access of the access rights to the particular resource, and an event triggering the change to the level of access of the access rights, wherein the subscribe message and the notify message are generated according to a session initiation protocol.

12. An apparatus of claim 11, wherein the apparatus is further caused to:

receive another notify message specifying information about the changed access rights for the particular resource.

13. An apparatus of claim 11, wherein the information is obtained by the network entity from a repository separate from the network entity only if the access control information does not indicate denial of access to said particular resource.

14. An apparatus comprising:

at least one processor; and

at least one memory including computer program code for one or more programs,

the at least one memory and the computer program code configured to with the at least one processor, cause the apparatus to perform at least the following,;

receive, from a requester, a subscribe message comprising a request for information about access rights to a particular resource and for information about any change to a level of access of the access rights, wherein the information about access rights comprises information having an attribute-based format that conforms with a service location protocol;

determine whether the requester is authorized to obtain status information about the access rights for the resource, wherein the determining comprises querying a database containing access control information for said particular resource;

if the determination does not indicate denial of access, then obtaining from a separate repository information about access rights to the particular resource; and

create, in response to the subscribe message, a notify message specifying information about a description of the resource, access right information relating to access rights to the particular resource, and an event triggering the change to the level of access of the access rights, wherein the subscribe message and the notify message are generated according to a session initiation protocol.

15. An apparatus of claim 14, wherein the apparatus is further caused to:

create another notify message specifying information about changed access rights for the particular resource.

16. An apparatus of claim 14, wherein the apparatus matches the information by:

determining to send a match message to the repository, the match message requesting access rights information for the particular resource; and

receiving a response from the repository, the response comprising access right information for the particular resource.