# US 2017/0288937 A1 · Authorization Processing Method, Device, and System

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2017/0288937 A1
- Document ID: US20170288937A1
- Status: Published application
- Kind: A1
- Application number: 15/626,668
- Filed: 2017-06-19
- Published: 2017-10-05
- Earliest claimed: 2014-12-17
- Assignees: Huawei Technologies Co., Ltd.
- Applicants: Huawei Technologies Co., Ltd.
- Inventors: Yaoye Zhang
- Web page: https://patentgrep.com/patent/US20170288937A1

## CPC

- H04L 63/105: {Multiple levels of security}
- G06F 21/10: Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]}
- H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)}
- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity}
- H04L 63/0892: {by using authentication-authorization-accounting [AAA] servers or protocols}
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/126: {the source of the received data}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

An authorization processing method, a device, and a system, where the method includes receiving an authorization request from a public client, where the authorization request includes a client identifier of the public client, a requested redirect uniform resource identifier (URI), and a requested authorization scope, obtaining authorization information of the public client according to the client identifier, obtaining an authorization scope corresponding to an authorization credential stored in the authorization information, obtaining authorization notification information of an owner of a resource according to the requested authorization scope when the requested authorization scope exceeds the authorization scope corresponding to the authorization credential, generating a first access token whose authorization scope corresponds to the requested authorization scope, and sending the first access token to the public client according to the requested redirect URI. Hence, the method effectively resolves a security threat problem in a process of authorizing the public client.

## Claims

### Claim 1

An authorization processing method for authorizing a user to access a resource using a public client, comprising:
receiving a first authorization request from the public client, wherein the first authorization request comprises a client identifier of the public client, a requested redirect uniform resource identifier (URI), and a first requested authorization scope;
obtaining authorization information of the public client according to the client identifier;
obtaining an authorization scope corresponding to an authorization credential of the user stored in the authorization information;
obtaining authorization notification information of an owner of the resource according to the first requested authorization scope when the first requested authorization scope exceeds the authorization scope corresponding to the authorization credential of the user;
generating, according to the first requested authorization scope and the authorization notification information, a first access token whose authorization scope corresponds to the first requested authorization scope; and
sending the first access token to the public client according to the requested redirect URI.

### Claim 2 (depends on 1)

The method according to claim 1, wherein obtaining the authorization notification information of the owner of the resource comprises:
sending an authentication request to the owner of the resource, wherein the authentication request comprises the first requested authorization scope; and
receiving an authentication response message returned by the owner of the resource, wherein the authentication response message comprises the authorization notification information of the owner of the resource, and wherein the authorization notification information indicates that the owner of the resource agrees to authorize the user to access the resource using the public client within the first requested authorization scope.

### Claim 3 (depends on 1)

The method according to claim 1, wherein after obtaining the authorization notification information of the owner of the resource, the method further comprises:
generating an authorization credential whose authorization scope corresponds to the first requested authorization scope; and
updating the authorization credential of the user using the generated authorization credential.

### Claim 4 (depends on 1)

The method according to claim 1, wherein before obtaining the authorization scope corresponding to the authorization credential of the user stored in the authorization information, the method further comprises:
obtaining a registered redirect URI of the public client according to the client identifier; and
determining that the requested redirect URI is the same as the registered redirect URI.

### Claim 5 (depends on 3)

The method according to claim 3, wherein the first authorization request further comprises a user identifier of the user, wherein the authorization information further comprises a user identifier, wherein a correspondence exists between the user identifier in the authorization information and the authorization credential in the authorization information, wherein obtaining the authorization scope corresponding to the authorization credential of the user stored in the authorization information comprises:
querying the authorization information according to the user identifier of the user in the first authorization request to obtain the authorization credential corresponding to the user identifier of the user; and
parsing the authorization credential corresponding to the user identifier of the user to obtain the authorization scope corresponding to the authorization credential of the user, and
wherein updating the authorization credential of the user using the generated authorization credential comprises:
querying the authorization information according to the user identifier of the user in the first authorization request to obtain the authorization credential corresponding to the user identifier of the user; and
updating, using the generated authorization credential, the authorization credential corresponding to the user identifier of the user.

### Claim 6 (depends on 3)

The method according to claim 3, further comprising:
receiving a second authorization request from the public client, wherein the second authorization request comprises the client identifier, the requested redirect URI, and a second requested authorization scope;
obtaining the authorization information of the public client according to the client identifier;
obtaining the authorization scope corresponding to the authorization credential of the user stored in the authorization information;
generating a second access token whose authorization scope corresponds to the second requested authorization scope when the second requested authorization scope does not exceed the authorization scope corresponding to the authorization credential of the user; and
sending the second access token to the public client according to the requested redirect URI.

### Claim 7 (depends on 3)

The method according to claim 3, further comprising:
receiving a second authorization request from the public client, wherein the second authorization request comprises the client identifier, the requested redirect URI, and a second requested authorization scope;
obtaining the authorization information of the public client according to the client identifier;
obtaining the authorization scope corresponding to the authorization credential of the user stored in the authorization information;
generating a second access token whose authorization scope corresponds to the authorization credential of the user when the second requested authorization scope does not exceed the authorization scope corresponding to the authorization credential of the user; and
sending the second access token to the public client according to the requested redirect URI.

### Claim 8 (depends on 1)

The method according to claim 1, further comprising:
receiving a third authorization request from the public client, wherein the third authorization request comprises the client identifier, the requested redirect URI, and a third requested authorization scope;
obtaining the authorization information of the public client according to the client identifier;
determining that no authorization credential of the user exists in the authorization information;
obtaining authorization notification information of the owner of the resource according to the third requested authorization scope;
generating, according to the third requested authorization scope and the authorization notification information obtained according to the third requested authorization scope, a third access token and a third authorization credential whose authorization scopes correspond to the third requested authorization scope;
storing, in the authorization information, the third authorization credential as an authorization credential of the user; and
sending the third access token to the public client according to the requested redirect URI.

### Claim 9

An authorization device for authorizing a user to access a resource using a public client, comprising:
a memory comprising a plurality of computer readable instructions; and
a processor coupled to the memory, wherein the plurality of computer readable instructions cause the processor to be configured to:
receive a first authorization request from the public client, wherein the first authorization request comprises a client identifier of the public client, a requested redirect uniform resource identifier (URI), and a first requested authorization scope;
obtain authorization information of the public client according to the client identifier;
obtain an authorization scope corresponding to an authorization credential of the user stored in the authorization information; and
obtain authorization notification information of an owner of the resource according to the first requested authorization scope when the first requested authorization scope exceeds the authorization scope corresponding to the authorization credential of the user;
generate, according to the first requested authorization scope and the authorization notification information, a first access token whose authorization scope corresponds to the first requested authorization scope; and
send the first access token to the public client according to the requested redirect URI.

### Claim 10 (depends on 9)

The device according to claim 9, wherein the plurality of computer readable instructions further cause the processor to be configured to:
send an authentication request to the owner of the resource, wherein the authentication request comprises the first requested authorization scope; and
receive an authentication response message returned by the owner of the resource, wherein the authentication response message comprises the authorization notification information of the owner of the resource, and wherein the authorization notification information indicates that the owner of the resource agrees to authorize the user to access the resource using the public client within the first requested authorization scope.

### Claim 11 (depends on 9)

The device according to claim 9, wherein the plurality of computer readable instructions further cause the processor to be configured to:
generate, according to the first requested authorization scope, an authorization credential whose authorization scope corresponds to the first requested authorization scope; and
update the authorization credential of the user using the generated authorization credential.

### Claim 12 (depends on 9)

The device according to claim 9, wherein the plurality of computer readable instructions further cause the processor to be configured to:
obtain a registered redirect URI of the public client according to the client identifier before obtaining the authorization scope corresponding to the authorization credential of the user stored in the authorization information; and
determine that the requested redirect URI is the same as the registered redirect URI.

### Claim 13 (depends on 11)

The device according to claim 11, wherein the first authorization request further comprises a user identifier of the user, wherein the authorization information further comprises a user identifier, wherein a correspondence exists between the user identifier in the authorization information and the authorization credential in the authorization information, and wherein the plurality of computer readable instructions further cause the processor to be configured to:
query the authorization information according to the user identifier of the user in the first authorization request to obtain the authorization credential corresponding to the user identifier of the user;
parse the authorization credential corresponding to the user identifier of the user to obtain the authorization scope corresponding to the authorization credential of the user;
query the authorization information according to the user identifier of the user in the first authorization request to obtain the authorization credential corresponding to the user identifier of the user; and
update, using the generated authorization credential, the authorization credential corresponding to the user identifier of the user.

### Claim 14 (depends on 11)

The device according to claim 11, wherein the plurality of computer readable instructions further cause the processor to be configured to:
receive a second authorization request from the public client, wherein the second authorization request comprises the client identifier, the requested redirect URI, and a second requested authorization scope;
obtain the authorization information of the public client according to the client identifier;
obtain an authorization scope corresponding to the authorization credential of the user stored in the authorization information;
generate a second access token whose authorization scope corresponds to the second requested authorization scope when the second requested authorization scope does not exceed the authorization scope corresponding to the authorization credential of the user; and
send the second access token to the public client according to the requested redirect URI.

### Claim 15 (depends on 11)

The device according to claim 11, wherein the plurality of computer readable instructions further cause the processor to be configured to:
receive a second authorization request from the public client, wherein the second authorization request comprises the client identifier, the requested redirect URI, and a second requested authorization scope;
obtain the authorization information of the public client according to the client identifier;
obtain an authorization scope corresponding to the authorization credential of the user stored in the authorization information;
generate a second access token whose authorization scope corresponds to a second original authorization scope when the second requested authorization scope does not exceed the authorization scope corresponding to the authorization credential of the user; and
send the second access token to the public client according to the requested redirect URI.

### Claim 16 (depends on 9)

The device according to claim 9, wherein the plurality of computer readable instructions further cause the processor to be configured to:
receive a third authorization request sent by the public client, wherein the third authorization request comprises the client identifier, the requested redirect URI, and a third requested authorization scope;
obtain the authorization information of the public client according to the client identifier;
determine that no authorization credential of the user exists in the authorization information;
obtain authorization notification information of the owner of the resource according to the third requested authorization scope;
generate, according to the third requested authorization scope, a third access token and a third authorization credential whose authorization scopes correspond to the third authorization scope;
store, in the authorization information, the third authorization credential as an authorization credential of the user; and
send the third access token to the public client according to the requested redirect URI.

### Claim 17

An authorization processing system, used to authorize a user to access a resource using a public client, comprising:
the public client configured to:
send a first authorization request to an authorization device, wherein the first authorization request comprises a client identifier of the public client, a requested redirect uniform resource identifier (URI), and a first requested authorization scope; and
receive a first access token from the authorization device, and
the authorization device configured to:
receive the first authorization request from the public client;
obtain authorization information of the public client according to the client identifier;
obtain an authorization scope corresponding to an authorization credential of the user stored in the authorization information;
obtain authorization notification information of an owner of the resource according to the first requested authorization scope when the first requested authorization scope exceeds the authorization scope corresponding to the authorization credential of the user;
generate, according to the first requested authorization scope and the authorization notification information, the first access token whose authorization scope corresponds to the first requested authorization scope; and
send the first access token to the public client according to the requested redirect URI.