Accessing a computer resource using an access control model and policy

Patent metadata

Field	Value
Publication number	US-9729531-B2
Application number	US-201414313993-A
Country	US
Kind code	B2
Filing date	Jun 24, 2014
Priority date	Jun 25, 2013
Publication date	Aug 8, 2017
Grant date	Aug 8, 2017

Abstract

In one embodiment disclosed herein is a method of processing a request made by a terminal of a user to access a resource made available to a client entity by a platform of a cloud computer service supplier. The method is performed by a server situated between the terminal and the platform utilizing distinct instructions for each client entity. The method comprises verifying that the user is authorized to access the computer resource via the terminal by applying to the user and to the resource an access control model and an access control policy corresponding to the model.

First claim

The invention claimed is:

1. A processing method for processing an access request from a terminal of a user who is one of a plurality of users attached to a client entity which is one of a plurality of client entities, to a computer resource selected from a set of computer resources made available to the client entity by a platform of a cloud computer service supplier, the cloud computer service supplier providing to a plurality of distinct client entities corresponding distinct sets of resources, said method being performed by a server situated between the terminal and the platform, said processing method comprising, on the access request being received by the server:
authenticating said user who is one of a plurality of users attached to said client entity which is one of said plurality of client entities with the help of at least a first authentication parameter for authenticating the user with the server;
verifying that the user is authorized to access said computer resource selected from said set of computer resources via said terminal by applying to said user and to said resource an access control model and an access control policy corresponding to said model, which model and policy are supplied to said server by said client entity; and
if the user is authorized to access the computer resource, sending to the platform a request derived from the access request on the basis of at least one second authentication parameter for authenticating the client entity with the platform wherein said server uses distinct authentication and authorization instructions for each client entity from among said plurality of client entities; or
else rejecting the access request.

2. A processing method according to claim 1 , wherein the verification process further comprises obtaining information about the availability of the computer resource coming from the platform.

3. A processing method according to claim 1 , wherein:
said at least one first authentication parameter comprises at least a first encryption key comprising a secret key held by the terminal and by the server, or a private and public key pair held respectively by the terminal and the server;
the access request from the terminal includes first authentication data for authenticating the terminal with the server generated from at least a portion of the access request or from an identifier of the user with the help of a said first encryption key held by the terminal; and
the authentication process comprises decrypting the first authentication data with the help of a said first encryption key held by the server.

4. A processing method according to claim 3 , wherein:
said at least one second authentication parameter for authenticating the entity comprises at least a second encryption key comprising a secret key held by the terminal and by the platform, or a private and public key pair held respectively by the terminal and by the platform;
the access request from the terminal further includes second authentication data for authenticating the entity as generated from at least a portion of the access request or from an identifier of said client entity with the help of a said second encryption key held by the terminal; and
the request derived from the access request from the terminal includes said second authentication data and third authentication data generated with the help of a third encryption key held by the server.

5. A processing method according to claim 4 , wherein:
said second authentication data is incorporated in said third authentication data; or
said third authentication data is generated with the help of said third encryption key from said at least one portion of the access request or from the identifier used to generate said second authentication data.

6. A processing method according to claim 3 , wherein said first authentication data comprises or is digital signatures.

7. A supply method for supplying access to a computer resource made available to a client entity by a platform of a cloud computer service supplier, wherein said computer resource is selected from a set of computer resources and wherein said client entity is one of a plurality of client entities, said method being performed by said service supplier platform and comprising:
receiving a request derived by a server from an access request from a terminal of a user who is one of a plurality of users attached to said client entity made to said computer resource and resulting from executing the access request processing method according to claim 5 , said server being situated between the terminal and the platform;
authenticating the client entity with the help of at least one second authentication parameter for authenticating the client entity with the platform and comprising:
decrypting the third authentication data with the help of an encryption key held by the platform and associated with the third encryption key held by the server; and
decrypting the second authentication data with the help of a said second encryption key held by the platform; and
supplying the computer resource to the terminal, wherein said cloud computer service supplier provides to said plurality of distinct client entities corresponding distinct sets of resources.

8. A supply method according to claim 7 , further comprising, before the process of supplying the computer resource to the terminal, verifying that the client entity is authorized to access said computer resource.

9. A processing method according to claim 1 , wherein:
said at least one second authentication parameter comprises at least a second encryption key comprising a secret key held by the server and by the platform, or a private and public key pair held respectively by the server and by the platform; and
the request derived from the access request from the terminal includes second authentication data for authenticating the entity with the platform as generated from at least a portion of the access request or of an identifier of the client entity with the help of a said second encryption key held by the server.

10. A processing method according to claim 1 , wherein the request derived from the access request from the terminal further includes information representative of the user authentication and verification processes being successful.

11. A computer having stored thereon instructions, which when executed by said computer, cause a service provider platform to perform a supply method for supplying access to a computer resource made available to a client entity by said service provider platform, wherein said computer resource is selected from a set of computer resources and wherein said client entity is one of a plurality of client entities, said supply method comprising:
receiving a request derived by a server from an access request from a terminal of a user who is one of a plurality of users attached to said client entity made to said computer resource and resulting from executing an access request processing method, said server being situated between the terminal and the platform;
authenticating the client entity with the help of at least one second authentication parameter for authenticating the client entity with the platform and comprising:
decrypting the third authentication data with the help of an encryption key held by the platform and associated with the third encryption key held by the server; and
decrypting the second authentication data with the help of a said second encryption key held by the platform; and

supplying the computer resource to the terminal, wherein said cloud computer service supplier provides to said plurality of distinct client entities corresponding distinct sets of resources;
wherein sai

Assignees

• Orange

Inventors

• He Ruan
• Qian Xiangjun

Classifications

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• H04L63/0815

  providing single-sign-on or federations · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• G06F21/41

  where a single sign-on provides access to a plurality of computers · CPC title

• H04L9/3226

  using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083) · CPC title