Methods and systems for enabling access control based on credential properties

Patent metadata

Field	Value
Publication number	US-9923927-B1
Application number	US-201514869344-A
Country	US
Kind code	B1
Filing date	Sep 29, 2015
Priority date	Sep 29, 2015
Publication date	Mar 20, 2018
Grant date	Mar 20, 2018

Abstract

Methods and systems are provided to enable access control based on credential properties. Besides authenticating a credential, an authentication service can provide additional credential-related information with respect to a credential such as last updated time. An entity receiving such additional credential-related information can implement access control policies based on the credential-related information. For instance, a user's access rights may be gradually restricted after an initial expiration time and towards a final expiration time. In an example, such access control may be implemented by a client application or client website of the authentication service. Alternatively or additionally, such access control may be implemented by an authorization service used by the client application or client website.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
receiving, from a client device, an authentication request message for accessing a server resource, the authentication request message including a credential;
authenticating the credential to generate an authentication result;
determining a credential property associated with the credential, the credential property operable for determining an access right with an access right level of a plurality of different access right levels with respect to the resource, the credential property comprising information identifying a strength of the credential that is based at least in part on a complexity of an algorithm utilized to generate the credential, a requestor property associated with the client device for a credential update frequency of the credential, and a resource property associated with the server resource that includes a level of security for the server resource;
generating an authorization code comprising the authentication result and the credential property associated with the credential;
providing an authentication response message corresponding to the authentication request, the authentication response message comprising the authorization code;
receiving an authorization request message with respect to the server resource, the authorization request message comprising the authorization code;
extracting the credential property from the authorization code;
determining the access right with respect to the server resource based at least in part on the credential property; and
providing an authorization response message corresponding to the authorization request message comprising an access token configured to grant access to the server resource.

2. The computer-implemented method of claim 1 , wherein the credential property further comprises a last updated time of the credential.

3. The computer-implemented method of claim 1 , wherein determining the access right comprises:
determining a duration between a request time and an initial expiration time for the credential based at least in part on the credential property; and
determining the access right with the access right level of the plurality of different access right levels with respect to the server resource based at least in part on the duration, the different access right levels respectively corresponding to different durations between the request time and the initial expiration time for the credential.

4. One or more non-transitory computer-readable storage media storing computer-executable instructions that, when executed by a computing system, configure the computing system to perform operations comprising:
receiving, from a client device, an authentication request message for accessing a server resource, the authentication request message including a credential;
determining one or more credential properties operable for determining an access right with an access right level of a plurality of different access right levels with respect to the server resource, the one or more credential properties comprising information identifying a strength of the credential that is based at least in part on a complexity of an algorithm utilized to generate the credential and a resource property associated with the server resource that includes a level of security for the server resource: and
transmitting an authentication response message corresponding to the authentication request message, the authentication response message including the credential and the one or more credential properties.

5. The computer-readable storage media of claim 4 , wherein the one or more credential properties further comprise a last updated time, an initial expiration time, or a final expiration time of the credential.

6. The computer-readable storage media of claim 4 , wherein determining the one or more credential properties is based at least in part on one or more instructions from the client device.

7. The computer-readable storage media of claim 4 , wherein the determining the access right comprises:
determining a duration between a request time and an initial expiration time of the credential based at least in part on the one or more credential properties;
comparing the determined duration and one or more intermediate durations relative to the initial expiration time, each of the one or more intermediate durations associated with a set of one or more access rules;
selecting one of the one or more intermediate durations based on the comparison; and
determining the access right based at least in part on the set of access rules associated with the selected intermediate duration.

8. The computer-readable storage media of claim 7 , wherein the one or more intermediate durations includes a first intermediate duration with a first set of access rules and a second intermediate duration with a second set of access rules, the second intermediate duration being longer than the first intermediate duration and the second set of access rules being more restrictive than the first set of access rules.

9. The computer-readable storage media of claim 8 , wherein the first set of access rules are configured to allow access to the resource and the second set of access rules are configured to deny access to the server resource.

10. The computer-readable storage media of claim 8 , wherein the first set of access rules are configured to allow read/write access to the server resource and the second set of access rules are configured to allow read-only access to the server resource.

11. A computer system, comprising: a memory that stores computer-executable instructions; and a processor configured to access the memory and execute the computer-executable instructions to at least:
receive, from a client device, an authorization request message for accessing a resource, the authorization request message comprising an authorization code indicating an authentication of a credential;
generate an access token for accessing the resource based at least in part on the authentication code and one or more credential properties associated with the credential, the access token indicating an access right with an access right level of a plurality of different access right levels with respect to the resource, the one or more credential properties comprising information identifying a strength of the credential that is based at least in part on a complexity of an algorithm utilized to generate the credential and a requestor property associated with the client device for a credential update frequency;
determine the access right with respect to the resource based at least in part on the one or more credential properties; and
provide an authorization response message to the client device comprising the access token configured to enable access to the resource.

12. The computer system of claim 11 , wherein the one or more credential properties are obtained from the authorization request message.

13. The computer system of claim 12 , wherein the one or more credential properties are included in the authorization code.

14. The computer system of claim 11 , wherein the one or more credential properties are obtained from an authentication service that generates the authorization code.

15. The computer system of claim 11 , wherein generating the access token comprises:
determining a duration between a request time and an initial expiration time for the credential based at least in part on the one or more credential properties; and
determining an access right with an access right level of a plurality of different access right levels with respect to the reso

Assignees

• Amazon Tech Inc

Inventors

• Mcclintock Jon Arron
• Golwalkar Yogesh Vilas
• Bhimanaik Bharath Kumar
• Mcadams Darin Keith
• Sethi Tushaar

Classifications

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L63/105

  Multiple levels of security · CPC title

• H04L63/0846

  using time-dependent-passwords, e.g. periodically changing passwords · CPC title

• H04L63/108

  when the policy decisions are valid for a limited amount of time · CPC title