Patent ID: 7685206
Filing Date: 2010-03-23
Classification: H04L

Abstract:
1. A method of providing from a centralized location access control to a resource for one or more users, said method comprising: receiving at the centralized location an authorization request from a first entity to issue authorization data for the one or more users based on roles associated with the users as part of an organization model, wherein said authorization data is required by a second entity for allowing the first entity to conditionally access a resource controlled by the second entity; responsive to the received authorization request, creating a conditional scope expression identifying the resource by a resource name and by at least one property name-property value pair associated with the resource to conditionally define access to the resource, said property name-property value pair determining a list of conditions for access to the resource controlled by the second entity; encrypting the created conditional scope expression; responsive to the received authorization request, issuing the authorization data from the centralized location to the first entity, wherein the first entity provides the issued authorization data to the second entity to conditionally access the resource controlled by the second entity, said authorization data including the conditional scope expression identifying the resource said authorization data further including validation information; receiving at the centralized location a validation request from the second entity to validate the issued authorization data provided to the second entity by the first entity; responsive to the received validation request, validating the issued authorization data based on the validation information included the authorization data; and responsive to validating the issued authorization data, sending from the centralized location a response to the second entity indicating a determined validation status, said second entity granting to the first entity access to the resource according to the conditions determined by the property name-property value pair when the determined validation status indicates that the authorization data is valid.