Delegation-based authorization

US9160738B2 · kind B2 · utility

Assignee

• Microsoft Corporation · US

Inventor

• Moritz Becker · Stuttgart, DE

Key dates

• Filing date: May 27, 2010
• Grant date: Oct 13, 2015
• Expiry date: Sep 14, 2032

Classification

• Technology area (CPC H): Electricity
• CPC primary: H04L63/1408
• WIPO field: Digital communication
• WIPO sector: Electrical engineering

Abstract

Delegation-based authorization is described. In one example, a reference monitor receives from a first entity a request and a credential statement comprising a delegation of authority over a fact to a further entity. An authorization node then determines whether the further entity consents to provide the fact to the first entity and evaluates the request in accordance with an authorization policy and the credential statement. In another example, an assertion comprising a statement delegating authority over a fact to a further entity is received at an authorization node from a first entity. An authorization policy is then used to determine that the first entity vouches for the fact if each of these conditions are met: i) the first entity consents to import the fact from the further entity, ii) the further entity consents to export the fact to the first entity, and iii) the further entity asserts the fact.