Patent ID: 8312526

Claim:
A method for delegating an access authority for accessing protected resources, the method including: building, at a first client, an original authorization certificate to control access to protected resources maintained by the first client; issuing, by the first client, the original authorization certificate to a second client, the original authorization certificate delegating to the second client a level of authority to access the protected resources maintained by the first client and a level of authority to re-delegate the access authority to another client via a second authorization certificate created by the second client; establishing, at each successive re-delegation, a chain of the authorization certificates conveying a level of access authority which is at most the level of access authority conveyed in the immediately preceding delegation, and a level of re-delegation authority which is at most the level of re-delegation authority conveyed in the immediately preceding delegation, each authorization certificate in the chain containing information indicating the level of access authority given to a particular client to access the protected resources and a re-delegation flag indicating the level of re-delegation authority given to the particular client, including whether the particular client has a right to re-delegate authority to another client; receiving at the first client an access request for the protected resources from a requesting client other than the second client; and verifying at the first client the access request for the protected resources based on the chain of the authorization certificates and on an encrypted signature from the requesting client, wherein the original authorization certificate for establishing at each successive re-delegation the chain of the authorization certificates conveying a level of access authority includes a valid period and a re-delegation flag.