Delegating authorizations

Patent metadata

Field	Value
Publication number	US-9961072-B2
Application number	US-201715590343-A
Country	US
Kind code	B2
Filing date	May 9, 2017
Priority date	Nov 5, 2013
Publication date	May 1, 2018
Grant date	May 1, 2018

Abstract

Delegating authorizations sufficient to access services is contemplate. The authorization may be delegated in the form of a token or other transmissible construct relied upon to authenticate access to services, such as but not necessarily limited to conferring a user identity established via authenticated device for the purposes of enabling an unauthenticated or unsecured device to access a service associated with the user identity.

First claim

What is claimed is:

1. A method for delegating access tokens relied upon to authenticate access to services, the method comprising:
receiving a plurality of access tokens from a plurality of service providers after the plurality of service providers associates each of the plurality of access tokens with at least one of a plurality of users;
associating the plurality of access tokens with a plurality GP of control devices, the plurality of control devices each having been previously authenticated with at least one of the plurality of users;
receiving a first credential generated in response to a sink device being engaged to access a first service associated with a first service provider of the plurality of service providers at a first instance in time;
identifying a first control device of the plurality of control devices associated with the first credential as a function of information included within the first credential;
identifying a first access token of the plurality of access tokens associated with a first user of the plurality of users associated with the first control device; and
transmitting the first access token to the first service provider at a second instance in time occurring after the first instance, the first service provider granting the sink device access to the first service at the second instance according to entitlements of the first user if the first access token is valid when received, thereby enabling the sink device to access the first service without providing the first access token to the first service provider.

2. The method of claim 1 further comprising determining at least a portion of the information included in the first credential as a result of the sink device determining an identity of the first control device.

3. The method of claim 1 further comprising determining at least a portion of the information included in the first credential as a result of the sink device determining an indicator displayed on the first control device having an indicia sufficient for identifying the first control device.

4. The method of claim 3 further comprising instructing an identifier application on the sink device to determine the indicia by processing an image of the indicator captured with a camera of the sink device.

5. The method of claim 4 further comprising instructing the first user to capture the image by positioning the camera to take a picture of a webpage displayed on the first control device.

6. The method of claim 5 further comprising transmitting a redirect message to a browser operating on the sink device to automatically direct the browser to a service page used to engage the first service.

7. The method of claim 1 further comprising:
updating the first access token after being determined as invalid with a second access token received from the first service provider at a third instance in time occurring after the second instance;
receiving a second credential generated while the sink device is being engaged to access the first service at a fourth instance in time occurring after the third instance; and
transmitting the second access token to the first service provider at a fifth instance in time occurring after the fourth instance as a function of information included within the second credential, the first service provider granting the sink device access to the first service at the fifth instance if the second access token is valid when received, thereby enabling the sink device to access the first service without providing the second access token to the service provider.

8. The method of claim 1 further comprising:
transmitting an authentication request to the first control device at a third instance in time occurring before the first instance, the authentication request requesting the first control device to indicate an acceptance or a denial for transmission of the first access token to the first service provider;
transmitting the first access token to the first service provider when the authentication request indicates the acceptance; and
denying transmission of the first access token to the first service provider when the authentication request indicates the denial.

9. A non-transitory computer-readable medium having a plurality of non-transitory instructions operable with a processor to facilitate access to services of a service provider, the processor being a hardware construct capable of executing the plurality of non-transitory instructions, the non-transitory instructions being sufficient for:
associating each of a plurality of access tokens with at least one of a plurality of users;
associating each of the plurality of access tokens with at least one of a plurality or control devices, the plurality of control devices each having been previously authenticated with at least one of the plurality of users;
determining a credential generated in response to a sink device being engaged to access a service associated with the service provider at a first instance in time;
identifying a control device of the plurality of control devices associated with the credential as a function of information included within the credential;
identifying an access token of the plurality of access tokens associated with a user of the plurality of users associated with the control device; and
transmitting the access token to the service provider at a second instance in time occurring after the first instance when use of the access token is authenticated, the service provider granting the sink device access to the service at the second instance according to entitlements of the user if the access token is valid when received, thereby enabling the sink device to access the service without providing the access token to the service provider.

10. The non-transitory computer-readable medium of claim 9 wherein the non-transitory instructions are sufficient for determining at least a portion of the information included in the credential as a result of the sink device determining an identity of the control device.

11. The non-transitory computer-readable medium of claim 10 wherein the non-transitory instructions are sufficient for instructing the sink device to perform a discovery process whereby the identity of the control device is determined from messages exchanged between the sink device and the control device.

12. The non-transitory computer-readable medium of claim 9 wherein the non-transitory instructions are sufficient for determining at least a portion of the information included in the credential as a result of the sink device determining a (MAC) addresses of the control device.

13. The non-transitory computer-readable medium of claim 9 wherein the non-transitory instructions are sufficient for determining at least a portion of the information included in the credential as a result of the sink device determining a username for a user thereof.

14. The non-transitory computer-readable medium of claim 9 wherein the non-transitory instructions are sufficient for determining at least a portion of the information included in the credential as a result of the sink device determining an indicator displayed on the control device having an indicia sufficient for identifying the control device.

15. The non-transitory computer-readable medium of claim 14 wherein the non-transitory instructions are sufficient for instructing an application on the sink device to determine the indicia by processing an image of the indicator captured with a camera thereof.

16. The non-transitory computer-readable medium of claim 9 wherein the non-transitory instructions are sufficient for

Assignees

• Cable Television Laboratories Inc

Inventors

• Lund Robert M
• Johnson Steven E

Classifications

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L9/3213

  using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807) · CPC title

• H04L63/10 Primary

  for controlling access to devices or network resources · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L63/0815 Primary

  providing single-sign-on or federations · CPC title