Methods and systems for flexible delegation

A method of flexible delegation comprising:

• implementing a method of delegation from a first data processing entity to a second data processing entity, said first and second entities having a bidirectional communication link with one another, the method of delegation comprising
• sending a delegation token from said first entity to said second entity, said delegation token including information relating to a delegation request,
• receiving a reply from said second entity at said first entity, said reply including information for determining acceptance of delegation represented by said delegation token by said second entity, and sending a signature from said first entity to said second entity responsive to said reply, said signature comprising a signature of at least said delegation token;
• determining a desired level of security;
• and
• selecting optional additional information to be included in said sending and receiving responsive to said determining, wherein said additional information is selected from at least one of:
• a delegation verification key, a signature of said delegation token and a delegation verification key;
• a signature of said first entity;
• a signature of said second entity;
• a signature of said delegation token;
• a signature of a delegation verification key;
• timestamp data;
• and nonce data.

A method of flexible delegation comprising:

• implementing a method of delegation from a first data processing entity to a second data processing entity, said first and second entities having a bidirectional communication link with one another, the method of delegation comprising
• sending a delegation token from said first entity to said second entity, said delegation token including information relating to a delegation request,
• receiving a reply from said second entity at said first entity, said reply including information for determining acceptance of delegation represented by said delegation token by said second entity, and
• sending a signature from said first entity to said second entity responsive to said reply, said signature comprising a signature of at least said delegation token;
• determining a desired level of security;
• and
• selecting optional additional information to be included in said sending and receiving responsive to said determining.

A method of confining acceptance of delegation from a first data processing entity to a second data processing entity, said first and second entities having a bi-directional communication link with one another, the method comprising:

• receiving a delegation token from said first entity, said delegation token including information relating to a delegation request;
• generating a reply for said first entity, said reply including at least a delegation verification key comprising one key of a pair of keys, the other key of which comprises a delegation signing key, said delegation signing key being a key usable to generate a signature for a message from said second entity, said delegation verification key being usable to verify said signature;
• and
• sending said reply to said first entity to confirm acceptance of said delegation.

A method of requesting a service, by a delegate data processing entity in a chain of delegate data processing entities of length at least one, from an end point data processing entity, the method comprising sending a request from said delegate entity to said end point entity, said request comprising:

• a set of delegation tokens, one from each delegate entity in said chain, each said delegation token including information relating to a delegation request;
• a set of delegation token signatures, one from each delegate entity in said chain, each comprising a respective delegate entity signature of a respective said delegation token;
• and
• service request data.

A method of delegating from a first data processing entity to a second delegation protocol entity, the method comprising:

• sending a message from said first to said second entity, the message including at least:
• a delegation token;
• a signature of a combination of said delegation token and a secret key;
• and
• an encrypted version of said secret key.

Data processing apparatus configured for delegation to a second data processor, the apparatus comprising:

• a data memory operable to store data to be processed;
• an instruction memory storing processor implementable instructions;
• and
• a processor coupled to the data memory and to the instruction memory and operable to process data in accordance with the instructions, the instructions comprising instructions for controlling the processor to:
• send a delegation token to said second processor, said delegation token including information relating to a delegation request;
• receive a reply from said second processor, said reply including information for determining acceptance of delegation represented by said delegation token by said second processor;
• and
• send a signature to said second processor responsive to said reply, said signature comprising a signature of at least said delegation token.

Data processing apparatus configured for accepting delegation from a delegating data processor, the apparatus comprising:

• a data memory operable to store data to be processed;
• an instruction memory storing processor implementable instructions;
• and
• a processor coupled to the data memory and to the instruction memory and operable to process data in accordance with the instructions, the instructions comprising instructions for controlling the processor to:
• receive a delegation token from said delegating processor, said delegation token including information relating to a delegation request;
• generate a reply for said delegating processor, said reply including at least a delegation verification key comprising one key of a pair of keys, the other key of which comprises a delegation signing key, said delegation signing key being a key usable to generate a signature for a message from the data processing apparatus, said delegation verification key being usable to verify said signature;
• and
• send said reply to said delegating processor to confirm acceptance of said delegation.

A data processor configured to request a service from an end point data processor when in a chain of delegate data processors, the chain having a length of at least one, the data processor comprising:

• a data memory operable to store data to be processed;
• an instruction memory storing processor implementable instructions;
• and
• a processor coupled to the data memory and to the instruction memory and operable to process data in accordance with the instructions, the instructions comprising instructions for controlling the processor to send a request to said end point processor, said request comprising:
• a set of delegation tokens, one from each delegate processor in said chain, each said delegation token including information relating to a delegation request;
• a set of delegation token signatures, one from each delegate processor in said chain, each comprising a respective delegate entity signature of a respective said delegation token;
• and
• service request data.