Patent ID: 7770206
Filing Date: 2010-08-03
Classification: G06F

Abstract:
1. A method for a resource of a first organization to provide access thereto to a requestor of a second organization, the first organization having a first administrator trusted by the resource, the second organization having a second administrator, each of the first and second administrators for issuing credentials to entities, each credential as issued by an administrator to an entity tying the entity to the issuing administrator and evincing a relationship between the entity and the issuing administrator, the method comprising: the first administrator issuing to the second administrator a first credential by transmitting the first credential from a first administrator's computing device over a computer network to a second administrator's computing device, the first credential stating policy that the second administrator may issue a second credential to the requestor on behalf of the first administrator, the first credential comprising a public key of the second administrator (PU-B) and a signed private key of the first administrator (S(PR-A)); the second administrator issuing to the requestor the second credential on behalf of the first administrator by transmitting the second credential from the second administrator's computing device over the computer network to a requestor's computing device, the second credential comprising the first credential, a validity period, a first rule comprising a plurality of time periods within the validity period during which a request for access to the resource of the first organization is accepted, a signed private key of the second administrator (S(PR-B)), and a public key of the second credential; the requestor of the second organization transmitting the request for access to the resource of the first organization from the requestor's computing device over the computer network to the resource, the request comprising the second credential, and the resource comprising a resource computing device configured to provide access to digital content; the resource receiving from the requestor the request comprising the second credential; the resource obtaining a public key of the first administrator (PU-A); the resource validating the second credential by: responsive to the resource validating the second credential, the resource encrypting the digital content with the public key of the second credential and transmitting encrypted digital content to the requestor over the computer network, whereby the requestor decrypts the encrypted content with a private key of the second credential.