Delegating authorizations

Patent metadata

Field	Value
Publication number	US-9350720-B2
Application number	US-201414284667-A
Country	US
Kind code	B2
Filing date	May 22, 2014
Priority date	Nov 5, 2013
Publication date	May 24, 2016
Grant date	May 24, 2016

Abstract

Delegation of authorizations from one device to another device is contemplated. The contemplated capabilities may enable an authenticated device to confer access tokens or other authoritative permissions to a non-authenticated or unsecured device, such as to enable the delegated device to access user content without the user having to enter a username and password or other identifying credentials thereto.

First claim

What is claimed is:

1. A method for delegating authorization to access user content kept at a plurality of service providers, the plurality of service providers associating the user content for a plurality of users with one or more of a plurality of access tokens such that each access token confers access to the user content of the associated user, the method comprising:
receiving the plurality of access tokens from the plurality of service providers after the plurality of service providers associates each of the plurality of access tokens with at least one of the plurality of users;
receiving credentials from a control device, the credentials identifying a first user of the plurality of the users and being received as a function of the first user interacting with a first webpage displayed on the control device;
selecting a first access token associated with the first user identified with the credentials from the plurality of access tokens received from the plurality of service providers;
transmitting the first access token to the control device for subsequent transmission to a sink device; and
transmitting a content request redirect to the sink device to prompt the sink device to transmit the first access token to a first service provider of the plurality of service providers, the first service provider verifying the first access token prior to responsively transmitting a first user content associated with the first access token to the sink device.

2. The method of claim 1 further comprising identifying the sink device as a function of the first user interacting with the first webpage displayed on the control device.

3. The method of claim 2 further comprising identifying the first service provider as a function of the first user interacting with the first webpage displayed on the control device.

4. The method of claim 3 further comprising:
determining the first user to be associated with multiple access tokens associated with different service providers; and
selecting the first access token from the multiple access tokens as a function of the first service provider identified from the first user interacting with the first webpage.

5. The method of claim 3 further comprising transmitting a session ID cookie with the first access token to the control device, the session ID cookie representing a relationship of the first user to the control device, the sink device and the first service provider proximate in time to receipt of the credentials.

6. The method of claim 5 further comprising transmitting a first universal resource locator (URL) with the session ID cookie to the control device, the control device subsequently transmitting the first URL and the session ID cookie to the sink device through an unsecure connection, the sink device transmitting the session ID cookie to a server associated with the first URL.

7. The method of claim 6 further comprising verifying the session ID cookie as received at the server and downloading a second webpage to the sink device when the session ID cookie is verified.

8. The method of claim 7 further comprising including instructions within the second webpage to prompt the sink device to establish a secure connection with the control device, the control device providing the access token and a second URL to the sink device through the secure connection, the second URL causing the sink device to create an iFrame within the second webpage and to re-transmit the session ID cookie to the server.

9. The method of claim 8 further comprising downloading a content access page to the sink device for display within the iFrame and including instructions with the content access page to prompt the sink device to transmit the first access token to the first service provider, the first user content received in response to the first access token then being displayed within the content access page of the iFrame, the first service provider being different from a second service provider associated with the sink device.

10. The method claim 9 further comprising transmitting a first authorization code to the first service provider following receipt of an enable message from the control device, the first service provider responsively transmitting the first access code to the server for the subsequent transmission to the control device, the enable message being generated at the control device as a function of user interaction with a third webpage displayed on the control device prior to determining the first service provider as a function of user interaction with the first webpage.

11. The method of claim 1 further comprising receiving the plurality of access tokens at a database associated with a multiple system operator (MSO) prior to the first access token being transmitted from the database to the control device.

12. The method of claim 1 further comprising transmitting the first access token to the control device without receiving credentials from the sink device before the first user content is transmitted thereto or without associating the sink device with the credentials of the control device.

13. A method of enabling access to user content kept at a first service provider without requiring a requesting device to provide a username and password or other user identifying credential for an associated user to the first service provider, the first service provider requiring receipt of the username and password or the other user identifying credential prior to issuing an access token required to access the user content, the method comprising:
storing the access token at a second service provider after issuance from the first service provider;
authenticating a conferring device to access a my services everywhere (MSE) service associated with the second service provider as a function of user identifying information received therefrom as a function of the first user interacting with a first webpage displayed on the conferring device;
receiving a request from the conferring device to enable the requesting device to access the user content via the MSE service; and
transmitting the access token from the second service provider to the conferring device, the conferring device then transmitting the access token to the requesting device to access the user content from the service provider, the access token thereby being provided to the requesting device without the requesting device having to provide the username and password or the other user identifying credential to either one of the first and second service providers.

14. The method of claim 13 further comprising transmitting the username and password or the other user identifying credential from the second service provider to the first service provider in order to obtain the access token from the first service provider for storage at the second service provider.

15. The method claim 13 further comprising facilitating display of the user content within a MSE webpage downloaded to the requesting device, the MSE webpage having branding for the second service provider.

16. The method claim 15 further comprising facilitating shared document object model (DOM) remote control of the MSE webpage via the conferring device.

17. A non-transitory computer-readable medium having a plurality of instructions operable with a processor to facilitate a my services everywhere (MSE) service, the MSE service enabling a control device to confer authorizations to a sink device to access user content without requiring input of personally identifying information through the sink device, the user content being kept at a plurality of se

Assignees

• Cable Television Lab Inc

Inventors

• Lund Robert M
• Marcia Oscar G
• Johnson Steven E

Classifications

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L9/3213

  using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807) · CPC title

• H04L63/0884

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title

• H04L2209/76

  Proxy, i.e. using intermediary entity to perform cryptographic operations · CPC title

• H04L9/32

  including means for verifying the identity or authority of a user of the system {or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials} · CPC title