# US 10,771,466 B2 · Third-party authorization of access tokens

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,771,466 B2
- Document ID: US10771466B2
- Status: Granted
- Kind: B2
- Application number: 16/390,579
- Filed: 2019-04-22
- Published: 2019-08-08
- Granted: 2020-09-08
- Earliest claimed: 2017-10-30
- Assignees: International Business Machines Corporation
- Applicants: International Business Machines Corporation
- Inventors: Chaya Berezin; Tamir Faibish; Lior Luker; Nitzan Nissim
- Web page: https://patentgrep.com/patent/US10771466B2

## CPC

- H04L 67/53: using third party service providers
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/105: {Multiple levels of security}
- H04L 67/563: Data redirection of data network streams
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method for third-party authorization is presented. A client request is received by a resource server in a computer system from a client, wherein the client request includes an access token. An introspection request for the access token based on the client request. The introspection gateway uses a third-party authorization server from a plurality of third-party authorization servers to handle the introspection request. A resource server response is received from the introspection gateway, wherein the resource server response identifies a set of scopes for the access token. A determination is made as to whether the access token has sufficient scope from the resource server response. In response to the access token having the sufficient scope, the client is granted access to the resource server.

## Claims

### Claim 1

A method for third-party authorization, the method comprising:
receiving, by a resource server in a computer system, a client request from a client, wherein the client request includes an access token;
sending, by the resource server, to an introspection gateway, an introspection request for the access token based on the client request, wherein the introspection gateway uses a third-party authorization server from a plurality of third-party authorization servers to handle the introspection request;
selecting, by the introspection gateway, the third-party authorization server from the plurality of third-party authorization servers to handle the introspection request;
determining a protocol for the third-party authorization server;
converting the introspection request into a third-party request used by the third-party authorization server to introspect the access token using the protocol;
receiving a resource server response from the introspection gateway, wherein the resource server response identifies a set of scopes for the access token;
determining whether the access token has sufficient scope from the resource server response; and
responsive to the access token having the sufficient scope, granting the client access to the resource server.

### Claim 2 (depends on 1)

The method of claim 1 further comprising:
sending the third-party request to the third-party authorization server;
receiving a third-party response from the third-party authorization server;
converting the third-party response into the resource server response; and
sending the resource server response to the resource server.

### Claim 3 (depends on 1)

The method of claim 1, wherein converting the introspection request into the third-party request used by the third-party authorization server comprises:
converting a payload in the introspection request into a format used by the third-party authorization server.

### Claim 4 (depends on 1)

The method of claim 1, wherein the resource server response comprises the set of scopes and an indication of whether the access token is active.

### Claim 5 (depends on 1)

The method of claim 1, wherein the resource server uses the introspection gateway as a single introspection endpoint for the resource server in which introspection of the access token is delegated to third-party authorization services by the introspection gateway.

### Claim 6 (depends on 1)

The method of claim 1, wherein the access token is an OAuth token.