Patent ID: 7546463

Claim:
A method for delegating an access authority for accessing protected resources over a network of computer systems, the method including: building an authorization certificate; issuing the authorization certificate to a plurality of participants to re-delegate the access authority, each of the plurality of participants including a computer system; at each re-delegation, establishing a chain of authorization certificates, wherein establishing the chain of authorization certificates includes communicating a first authorization certificate between a first participant and a second participant, the first participant delegating the access authority to the second participant, determining re-delegation authority of the second participant, creating a second authorization certificate permitting the second participant to re-delegate the access authority to a third participant, and communicating the first and the second authorization certificates between the second participant and the third participant, the second participant delegating the access authority to the third participant; receiving an access request for the protected resources from the third participant; and verifying the access request for the protected resources, wherein verifying includes authenticating the third participant providing the access request, receiving the chain of authorization certificates, and verifying the chain of authorization, wherein authenticating the third participant includes authenticating a type of operation to be performed by the third participant.