Method and apparatus for providing enhanced service authorization

Patent metadata

Field	Value
Publication number	US-9825930-B2
Application number	US-201514687529-A
Country	US
Kind code	B2
Filing date	Apr 15, 2015
Priority date	Feb 18, 2009
Publication date	Nov 21, 2017
Grant date	Nov 21, 2017

Abstract

An approach is provided for authorizing one or more services from service providers in a communications network. The approach includes receiving a request from a first service provider, the request having an associated primary token and a secondary token identifier, the secondary token identifier relating to resources of a second service provider. Based, at least in part, on the secondary token identifier, a secondary token is identified; and then the secondary token is sent to the first service provider, wherein the first service provider and the second service provider belong to different trust domains and the first service provider can use the secondary token to access resources of the second service provider.

First claim

What is claimed is:

1. A non-transitory computer-readable storage medium carrying one or more sequences of one or more instructions which, when executed by one or more processors, cause an apparatus to at least perform the following steps:
determining that a request is received electronically from a resource requesting device, the request having an associated primary token and a secondary token identifier, the secondary token identifier relating to one or more resources of a service provider;
determining a secondary token based on the secondary token identifier; and
causing, at least in part, an initiation of sending the secondary token to the resource requesting device, wherein the type of access and privileges the resource requesting device has in relation to the one or more resources of the service provider is based on the primary or secondary token.

2. A non-transitory computer readable storage medium of claim 1 , wherein, for determining the secondary token, the apparatus is further caused, at least in part, to further perform:
creating the secondary token based on the secondary token identifier, in response to receiving the request.

3. A non-transitory computer readable storage medium of claim 2 , wherein the resource requesting device and the service provider belong to different trust domains.

4. A non-transitory computer readable storage medium of claim 1 , wherein, for determining the secondary token, the apparatus is further caused, at least in part, to further perform:
retrieving the secondary token from a memory store based on the secondary token identifier.

5. A non-transitory computer readable storage medium of claim 1 , wherein, for determining the secondary token, the apparatus is further caused, at least in part, to further perform:
creating an account on an authorization server associated with the primary token, wherein the resource requesting device authenticates and authorizes access to one or more other resources of the requesting device based on the primary token, and wherein the primary token includes a user name and password.

6. A non-transitory computer readable storage medium of claim 5 , wherein, for determining the secondary token, the apparatus is further caused, at least in part, to further perform:
creating a plurality of secondary token identifiers and respective secondary tokens, associated with the account; and
storing the plurality of secondary token identifiers in a memory store of the authorization server.

7. An apparatus comprising:
at least one processor; and
at least one memory including computer program code for one or more programs,
the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to perform at least the following:
determine that a request is received electronically from a resource requesting device, the request having an associated primary token and a secondary token identifier, the secondary token identifier relating to one or more resources of a service provider;
determining a secondary token based on the secondary token identifier, wherein the type of access and privileges the resource requesting device has in relation to the one or more resources of the service provider is based on the primary token or secondary token, and
cause, at least in part, an initiation of sending the secondary token to the resource requestor device.

8. An apparatus of claim 7 , wherein the resource requesting device and the service provider belong to different trust domains.

9. An apparatus of claim 7 , wherein, for determining the secondary token, the apparatus is further caused, at least in part, to:
create the secondary token based on the secondary token identifier, in response to receiving the request.

10. An apparatus of claim 7 , wherein, for determining the secondary token, the apparatus is further caused, at least in part, to:
retrieve the secondary token from a memory store based on the secondary token identifier.

11. An apparatus of claim 7 , wherein, for determining the secondary token, the apparatus is further caused, at least in part, to:
create an account on an authorization server associated with the primary token, wherein the primary token includes a user name and password.

12. An apparatus of claim 11 , wherein, for determining the secondary token, the apparatus is further caused, at least in part, to:
create a plurality of secondary token identifiers and respective secondary tokens, associated with the account; and
store the plurality of secondary token identifiers in a memory store of the authorization server.

Assignees

• Nokia Technologies Oy

Inventors

• Fu Yan

Classifications

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/0807

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title