US 10,897,466 B2Granted

System and method for externally-delegated access control and authorization

AssigneeMicrosoft Technology Licensing, LLC

InventorsMark D. Sisley, Kerem Yuceturk, Alexandru Dan Burst, David Alexander Blyth, Merwan Vishnu Hade, Samuel L. Banina

Life of this patent

Estimating the term…

patentgrep

Loading patent…

Abstract

Methods for externally-delegated access control and authorization of applications and resources are performed by systems and devices. A request for access by a user to a resource of a first application is received from a client device. A memory data structure that associates the resource of the first application with an application identifier and permission information is accessed to obtain the application identifier and the permission information. A query is provided to a second application, identified by the application identifier, which has a different authorization model than the first application. The query includes a user identifier and the permission information. The second application performs a permission check and authorization for the user based on the query. A query response that includes an access indication is the received from the second application. The request is granted or denied based on the access indication.

Claims16

Dependent claims

An access control and authorization system comprising:

a processor;
and
a memory that stores program code of a first application that is a software-as-a-service (SaaS) workflow development application, the program code of the first application being configured to be executed by the processor, the program code of the first application including:
first program code configured to:
receive a request, from a client device, for access by a user to a workflow resource of the first application;
second program code configured to:
obtain an application identifier and permission information from a memory data structure that associates the workflow resource of the first application with the application identifier and the permission information, the permission information also being associated with a resource of an information sharing application that is referenced by the workflow and that comprises a list, a document, or a library;
third program code configured to:
provide a query to the information sharing application that has a different authorization model than the first application, the query including a user identifier and the permission information, and
receive, from the information sharing application, a query response that includes an access indication;
and
fourth program code configured to:
grant the request based on the access indication including a grant indication.

10 more elements

A computer-implemented method comprising:

receiving a request for access by a user to a workflow resource of a first application that is a software-as-a-service (SaaS) workflow development application;
obtaining, from a memory data structure, an application identifier and permission information that associates the workflow resource of the first application with the application identifier and the permission information, the permission information also being associated with a resource of an information sharing application that is referenced by the workflow and that comprises a list, a document, or a library;
providing a query to the information sharing application that has a different authorization model than the first application, the query including a user identifier and the permission information;
receiving, from the information sharing application, a query response that includes an access indication;
and
granting the request based on the access indication including a grant indication.

3 more elements

A computer-readable storage medium having program instructions recorded thereon that, when executed by a processing device, perform a method for access control and authorization, the method comprising:

receiving a request over a network, from a remote client device, for access by a user to a workflow resource of a first application that is a software-as-a-service (SaaS) workflow development application;
obtaining, from a memory data structure, an application identifier and permission information that associates the resource workflow of the first application with the application identifier and the permission information, the permission information also being associated with a resource of an information sharing application that is referenced by the workflow and that comprises a list, a document, or a library;
providing a query over the network to the information sharing application that has a different authorization model than the first application, the query including a user identifier and the permission information;
receiving, from the information sharing application, a query response that includes an access indication;
and
granting the request based on the access indication including a grant indication.

3 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/991,193Filed 29 May 2018 · us provisional application
Priority: 30 Mar 2018
Published: US 2019/0306171 A13 Oct 2019
Granted: 19 Jan 2021
Term ends: Not estimatedThe source records don’t support an estimate.

Classification10 codes

H04L 63/102
For controlling access to devices or network resources: entity profiles
G06F 21/10
Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity: protecting distributed…
G06F 21/6218
Protecting access to data via a platform, e.g. using keys or access control rules: to a system of files or objects, e.g. local or distributed file…
G06F 21/629
Protecting access to data via a platform, e.g. using keys or access control rules: to features or functions of an application