Token delegation for third-party authorization in computer networking

Patent metadata

Field	Value
Publication number	US-9648141-B2
Application number	US-201514674596-A
Country	US
Kind code	B2
Filing date	Mar 31, 2015
Priority date	Mar 31, 2015
Publication date	May 9, 2017
Grant date	May 9, 2017

Abstract

In one embodiment, first content is served by an application server to a client computer through an Internet service provider network. The first content includes a link to second content on a third-party server. A token request is sent from the third-party server to the application server in response to selection of the link by the client computer. A token is provided to the third-party server by the application server in response to the token request. The token is configured to authorize data flow at a bandwidth for the second content by the Internet service provider network to the client computer. The data flow is authorized based on an agreement for the bandwidth between an operator of the application server and an operator of the Internet service provider network.

First claim

What is claimed is:

1. A method comprising:
serving first content, by an application server, to a client computer through an Internet service provider network, the first content including a link to second content on a third-party server;
receiving a token request, by the application server, from the third-party server in response to selection of the link by the client computer; and
providing a token, by the application server, to the third-party server in response to the token request, the token configured to authorize data flow having a flow characteristic for the second content from the third-party server by the Internet service provider network to the client computer, the data flow authorized based on an agreement for the flow characteristic between an operator of the application server and an operator of the Internet service provider network.

2. The method of claim 1 wherein the second content comprises game interaction, video content, audio content, conference content, or combinations thereof.

3. The method of claim 1 wherein receiving the token request comprises receiving an OAuth token request.

4. The method of claim 1 wherein receiving the token request further comprises receiving a server name of the Internet service provider handling the data flow and the flow characteristic for the data flow of the second content.

5. The method of claim 4 wherein receiving the server name comprises receiving an HTTP, HTTPS, port control protocol or STUN server name.

6. The method of claim 1 further comprising verifying an agreement between the operator of the application server and an operator of the third-party server;
wherein providing comprises providing when the agreement between the operator of the application server and the operator of the third-party server is verified.

7. The method of claim 1 wherein providing the token comprises providing a handle token.

8. The method of claim 1 wherein providing the token comprises providing the token linked to the third-party server.

9. The method of claim 1 further comprising verifying the agreement between the operator of the application server and the operator of the Internet service provider;
wherein providing comprises providing the token when the agreement between the operator of the application server and the operator of the Internet service provider is verified.

10. The method of claim 1 wherein providing comprises providing an OAuth token.

11. The method of claim 1 wherein providing the token comprises providing the token for use by the client computer to establish the data flow with the Internet service provider network for the second content.

12. The method of claim 1 wherein providing the token configured to authorize data flow at the flow characteristic comprises providing the token as a ticket to handle the data flow with a priority, minimum and maximum bandwidth, maximum jitter, at a rate, or combinations thereof.

13. The method of claim 1 further comprising:
receiving a request for another token from the client computer;
transmitting the other token to the client computer; and
validating the other token as received from the Internet service provider network;
wherein serving comprises serving the first content as another data flow established in the Internet service provider based on the other token.

14. A method comprising:
adding a data flow to a user computer from a first content server through an access network server;
establishing the data flow at a resource level of the access network server based on a first agreement between an operator of the access network server and an operator of a second content server; and
authorizing the resource level with an OAuth token from the second content server for the first content server.

15. The method of claim 14 , wherein adding comprises adding the data flow as a video data flow, and wherein establishing at the resource level comprises assigning a priority, loss, jitter, bandwidth, or combinations thereof.

16. The method of claim 14 wherein authorizing comprises authorizing with the OAuth token being a handle token provided to the first content server by the second content server, then provided by the first content server to the user computer, and then provided by the user computer to the access network server, further comprising:
validating the handle token by the access network server with the second content server.

17. The method of claim 14 wherein authorizing comprises verifying a second agreement between the operator of the second content server and an operator of the first content server.

18. An apparatus comprising:
a memory configured to store audio, video, or both audio and video;
an interface configured to receive a first token request from a client device, the first token request including an identification of an access network server and an identification of an application server; and
a processor configured to, using the interface, transmit a delegated token request to the application server, receive a delegated token from the application server, and transmit the delegated token to the client device;
wherein the audio, video, or both are served by the processor using the interface to the client device in a data flow through the access network server as validated by the application server.

19. The apparatus of claim 18 wherein the processor is configured to verify an agreement between an operator of the processor and an operator of the application server, and wherein the data flow is established based on another agreement between the operator of the application server and an operator of the network server.

20. The apparatus of claim 18 wherein the first token request is received in response to a link activation for the audio, video, or both audio and video.

Assignees

• Cisco Tech Inc

Inventors

• Reddy Tirumaleswar
• Wing Daniel
• Patil Prashanth

Classifications

• H04L67/42 Primary

  Electricity · mapped topic

• H04L63/0807 Primary

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• H04L67/01

  Protocols · CPC title

• H04L67/53

  using third party service providers · CPC title

• H04L67/289

  Intermediate processing functionally located close to the data consumer application, e.g. in same machine, in same home or in same sub-network · CPC title