User to user delegation service in a federated identity management environment

Patent metadata

Field	Value
Publication number	US-9401918-B2
Application number	US-201214007328-A
Country	US
Kind code	B2
Filing date	Mar 26, 2012
Priority date	Mar 25, 2011
Publication date	Jul 26, 2016
Grant date	Jul 26, 2016

Abstract

Method for providing user-to-user delegation service in federated identity environment, characterized in that it comprises a delegation or assignment step wherein a delegator specifies said delegation at an identity provider for delegating a privilege or task to a delegatee to be performed at a service provider.

First claim

The invention claimed is:

1. A method for providing user-to-user delegation service in federated identity environment, comprising:
receiving, at an identity provider, a delegation assignment from a first user, delegator, the delegation assignment specifying a service provider, privilege or task to delegate to be performed at the service provider, and a second user, delegatee,
operating the identity provider to authenticate the second user, the delegatee, if the authentication step is successful and if the identity provider finds delegations for the second user, the delegatee, providing the second user, the delegatee, a mechanism from which to choose which delegation to perform, therefrom receiving a delegation selection from the second user, and embedding, by the identity provider, a delegation assertion corresponding to the delegation selection in the authentication step and sending the delegation assertion to the service provider,
in response to receiving the delegation selection from the second user, the delegatee, operating the service provider to authorize the delegations based on access control rules of an access control engine of the service provider; and
associating a delegation invocation step with the user authentication step by:
a. receiving a login request from the second user, the delegatee, at the service provider, and
b. operating the service provider to delegate authentication of the second user, the delegatee, to the identity provider.

2. The method according to claim 1 , wherein the delegation is a simple delegation, applicable to a discretionary access control model, wherein the first user, the delegator, gives all privileges to the second user, the delegatee, for a specified time period.

3. The method according to claim 1 , wherein a delegation policy is in a metadata stored in the service provider, applicable to discretionary and role-based access control models, wherein during the assignment step, checking, by the identity provider, the delegation policy.

4. The method according to claim 1 , wherein the delegation is applicable to any access control models, wherein the method comprises the identity provider asking the service provider dynamically for privileges that the first user, the delegator, can delegate to the second user, the delegatee.

5. The method according to claim 2 , wherein the method comprises a delegation revocation step comprising the identity provider providing means for the first user, the delegator, to revoke a delegation, said revocation being the responsibility of the first user, the delegator, at the identity provider.

6. The method according to claim 4 , wherein the method comprises a delegation revocation step comprising the identity provider removing the delegation to the second user, the delegatee, by the first user, the delegator, from the identity provider's record of the delegation.

7. The method according to claim 4 , comprising operating the service provider to initiate revocation of the delegation.

8. The method according to claim 4 , comprising the identity provider cleaning up the delegation repository periodically.

9. A system for providing user-to-user delegation service in federated identity environment comprising an identity provider, more than one service providers, user-delegators, and user-delegatees, wherein the identity provider acts as the delegation authority, managing delegations for the service providers, wherein
the identity provider:
receives delegation assignments specifying service provider, privilege or task to delegate to be performed at a service provider and a user-delegatee from user-delegators,
authenticates the user-delegatee, if the authentication step is successful and if the identity provider finds delegations for the user-delegatee, providing the user-delegatee a mechanism from which to choose which delegation to perform, therefrom receiving a delegation selection from the user-delegatee, and embedding, by the identity provider, a delegation assertion corresponding to the delegation selection in the authentication step and sending the delegation assertion to the service provider thereby informs service providers of delegation selections,

associating a delegation invocation step with the user authentication step by:
a. receiving a login request from the user-delegatee at the service provider, and
b. operating the service provider to delegate authentication of the user-delegatee to the identity provider, and wherein

the service providers authorize delegations based on access control rules of an access control engine of the service provider.

10. The system for providing user-to-user delegation in federated identity environment of claim 9 wherein a user-delegator performs a delegation or assignment step by specifying said delegation at an identity provider for delegating a privilege or task to a user-delegatee to be performed at a service provider.

11. The system for providing user-to-user delegation service in federated identity environment of claim 9 wherein:
a. the user-delegatee is operable to request to login at the service provider, which delegates the user authentication to the identity provider;
b. the identity provider is operable to authenticate the user-delegatee, and if the authentication step is successful and if the identity provider finds delegations for the user-delegatee, the user-delegatee is operable to choose which delegation to perform;
thereby associating a delegation invocation step with a user authentication step.

Assignees

• Lu Hongqian Karen
• Krishna Ksheerabdhi
• Sachdeva Kapil
• Gemalto Sa

Inventors

• Lu Hongqian Karen
• Krishna Ksheerabdhi
• Sachdeva Kapil

Classifications

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• H04L9/32

  including means for verifying the identity or authority of a user of the system {or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials} · CPC title

• H04L63/10 Primary

  for controlling access to devices or network resources · CPC title

• G06F2221/2137

  Time limited access, e.g. to a computer or data · CPC title

• G06F21/00

  Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity · CPC title