Method and apparatus for controlling resources access

Patent metadata

Field	Value
Publication number	US-9756055-B2
Application number	US-201514667717-A
Country	US
Kind code	B2
Filing date	Mar 25, 2015
Priority date	May 8, 2014
Publication date	Sep 5, 2017
Grant date	Sep 5, 2017

Abstract

Controlling resource access, a first device responsive to a request for access to a resource, determines whether to grant the access to the resource, based on an identity of a requestor requesting the access to the resource. The resource is provided by a second device that is separate from the first device. The first device customizes an access token with an access constraint to control the access to the resource, the access token is generated responsive to the first device determining that, based on the identity of the requestor requesting the access to the resource, the access to the resource is granted.

First claim

What is claimed is:

1. A method for controlling resource access, the method comprising:
receiving, by an authorization program on an authorization server from a user computing device, an authorization request to authorize access to a data resource on a resource server, wherein the authorization request is in response to a request, received by an application server from a user computing device, to access the data resource on the resource server by a client application on an application server, the resource access request including a user ID and user equipment information associated with the user computing device, and the resource access request having been redirected to the authorization server by the client server via the user computing device;
authenticating, by the authorization server, the user ID, based on information about a user associated with the user ID, and, if the user equipment information indicates that the user computing device is a mobile device, authenticating using biometric information suitable for the characteristics of the mobile device;
verifying, by the by the authorization server, whether the user ID has authorization to the client application;
authenticating, by the authorization server, the client application that is requesting access to the data resource, based on one or more items from the list consisting of: a certificate, a signature, and an encrypted data segment; wherein the one or more items are included in the authorization request received from the user computing device;
in response to the authorization server authenticating the user ID, and verifying that the user ID has authorization to the client application, and authenticating the client application, transmitting, by the authorization server, a code to the client application;
in response to receiving, by the authorization server from the client application, a request for an access token, the request including the code, and one or more items from the list consisting of the certificate, the signature, and the encrypted data segment, generating, by the authorization server, an access token, based on the access token request;
generating, by the authorization server, data resource access constraints, based on information associated with the user ID, wherein the access constraints specify: an access time constraint that designates a particular date, time or time segment when the resource may be accessed by the user ID; an access frequency constraint that designates the maximum allowed number of accesses to the resource by the user ID; and an access location constraint that designates that the resource is only accessible to the user ID from a user computing device in a specified geographical location;
integrating, by the authorization server, the generated data access restraints into the generated access token;
transmitting, by the authorization server to the client application, the generated access token;
in response to receiving, by the authorization server from the resource server, the generated access token, wherein the generated access token was received by the resource server from the client application, determining, by the authorization server, whether the generated access token is valid, and whether the generated data access restraints that are integrated into the access token are satisfied;
in response to determining, by the authorization server, that the generated access token is valid and that the generated data access restraints that are integrated into the access token are satisfied, confirming, by the authorization server to the resource server, that the generated access token is valid;
whereby in response to receiving, by the resource server, confirmation from the authorization server that the access token is valid, the resource server allows the requested access by the client application to the data resource.

2. The method of claim 1 , wherein authenticating, by the authorization server, the user ID, based on information about a user associated with the user ID, further comprises:
if a user requesting resource access is determined to have a record of violating the rules of use for the resource, a security level may be increased that may impose stricter authentication requirements for that user, wherein increasing the security includes requiring an increasing number of the following: a password, a graphical authentication code, voice input, fingerprint identification, and iris identification.

3. The system of claim 1 , wherein the biometric information is one or more from the list consisting of: voice input, fingerprint identification, and iris identification.

4. A computer program product for controlling resource access, the computer program product comprising one or more non-transitory computer readable storage medium and program instructions stored on at least one of the one or more non-transitory computer readable storage medium, the program instructions being executable by an authorization server to cause the authorization server to perform a method comprising:
receiving, by an authorization program on an authorization server from a user computing device, an authorization request to authorize access to a data resource on a resource server, wherein the authorization request is in response to a request, received by an application server from a user computing device, to access the data resource on the resource server by a client application on an application server, the resource access request including a user ID and user equipment information associated with the user computing device, and the resource access request having been redirected to the authorization server by the client server via the user computing device;
authenticating, by the authorization server, the user ID, based on information about a user associated with the user ID, and, if the user equipment information indicates that the user computing device is a mobile device, authenticating using biometric information suitable for the characteristics of the mobile device;
verifying, by the by the authorization server, whether the user ID has authorization to the client application;
authenticating, by the authorization server, the client application that is requesting access to the data resource, based on one or more items from the list consisting of: a certificate, a signature, and an encrypted data segment; wherein the one or more items are included in the authorization request received from the user computing device;
in response to the authorization server authenticating the user ID, and verifying that the user ID has authorization to the client application, and authenticating the client application, transmitting, by the authorization server, a code to the client application;
in response to receiving, by the authorization server from the client application, a request for an access token, the request including the code, and one or more items from the list consisting of the certificate, the signature, and the encrypted data segment, generating, by the authorization server, an access token, based on the access token request;
generating, by the authorization server, data resource access constraints, based on information associated with the user ID, wherein the access constraints specify: an access time constraint that designates a particular date, time or time segment when the resource may be accessed by the user ID; an access frequency constraint that designates the maximum allowed number of accesses to the resource by the user ID; and an access location constraint that designates that the resource is only accessible to the user ID from a user computing device in a specified geographical location;
integrating, by the authorization server, the generated data access restraints into the generated access token;
transmitting, by the authorization server to the client application,

Assignees

• IBM

Inventors

• Hsu Ming-Fa
• Wang Yu
• Xiao Yi
• Yang Guang
• Zou Jia

Classifications

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04L63/108 Primary

  when the policy decisions are valid for a limited amount of time · CPC title

• H04L63/0807

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title