Patent ID: 8161164
Filing Date: 2012-04-17
Classification: H04L

Abstract:
1. At an upstream service in a computerized environment in which the upstream service and one or more downstream services comprise a multi-tiered application system, a method of proving authority to communicate with the one or more downstream services, comprising the acts of: receiving an end-user request at an upstream service for one or more actions to be performed by a multi-tiered application system; determining that the end-user request involves an action to be performed by a downstream service, wherein the upstream service require its own security tokens from a trusted security source in order to communicate with the downstream service; the upstream service requesting a session token from a security token service, the request including authentication information for the upstream service; the upstream service requesting a session token from the security token service, the session token uniquely identifying the upstream service; the upstream service requesting a upstream service access token from the security token service, the upstream service access token request including the received session token, the upstream service access token allowing the upstream service to make requests of the downstream service; the upstream service receiving the upstream service access token from the security token service, the upstream service access token including a trusted subsystem claim which allows the downstream service to identify the upstream service as a trusted subsystem; the upstream service authenticating with the downstream service and proving sufficient authority to pass processing requests to the downstream service using at least the upstream service access token including the trusted subsystem claim; the upstream service establishing a secure communication channel with the downstream service using at least the upstream service access token, wherein the upstream service proves the upstream service is trusted to the downstream service and has authority to communicate with the downstream service as a trusted subsystem with the one or more security tokens identifying the upstream; and the upstream service sending the end-user request to the downstream service over the secure communication channel.