# US 2023/0053907 A1 · Method and apparatus for flexible configuration managment using external identity management service

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2023/0053907 A1
- Document ID: US20230053907A1
- Status: Published application
- Kind: A1
- Application number: 17/891,759
- Filed: 2022-08-19
- Published: 2023-02-23
- Earliest claimed: 2021-08-19
- Assignees: ARRIS Enterprises LLC
- Applicants: ARRIS Enterprises LLC
- Inventors: Tat Keung CHAN; Alexander MEDVINSKY
- Web page: https://patentgrep.com/patent/US20230053907A1

## CPC

- G06F 21/335: {for accessing specific resources, e.g. using Kerberos tickets}
- H04L 63/105: {Multiple levels of security}
- H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)}
- H04L 9/3247: {involving digital signatures}
- H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)}
- H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F 21/45: Structures or tools for the administration of authentication
- G06F 21/645: {using a third party}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

To address the requirements described above, this document discloses a system and method for performing an action on at least one resource node of a hierarchical organization of resource nodes is disclosed. The system utilizes an external Identity Provider that provide more flexible authentication and authorization services, and leverages such services with secure server such as an on-line data signing service to provide flexible permission management.

## Claims

### Claim 1

A method of performing an action on at least one resource node of a hierarchical organization of resource nodes, comprising:
receiving a login request in secure server;
redirecting the login request to an identity provider, the identity provider defining a hierarchical organization of node resources, each node resource having one or more scopes and one or more attributes, each one or more scope associated with a scope permission, wherein each node resource is either a management node resource for maintaining the hierarchical organization of the node resources or a configuration node resource for performing the action;
receiving a second login request in the secure server, the second login request comprising:
client authorization credentials identifying a source of the second login request and permission information describing a permission to perform an action on a node resource, the client authorization credentials provided by the identity provider in response to the redirected login request;
receiving a request to perform an action on the node resource;
determining if the action is permitted according to the permission information of the client authorization credentials; and
if the action is permitted, performing the action on the node resource.

### Claim 2 (depends on 1)

The method of claim 1, wherein:
the one or more scopes of the node resources each comprise:
an admin scope having an admin scope permission permitting a user to modify any scope permission of a node resource associated with the admin scope;
a manage scope having a manage scope permission permitting the user to modify a use scope permission of the node resource associated with the manage scope;
the one or more scopes of the configuration node resource further comprise:
a use scope having the use scope permission permitting the user to use any configuration of the configuration node resource associated with the use scope.

### Claim 3 (depends on 2)

The method of claim 2, wherein the one or more scopes of the node resources each further comprise:
an edit scope having an edit scope permission permitting the user to edit attributes of the node resource associated with the edit scope; and
a view scope having a view scope permission permitting the user to view information defined for node resource associated with the view scope.

### Claim 4 (depends on 3)

The method of claim 3, further comprising:
determining, in the secure server, if the client authorization credentials are valid; and
receiving the request in the secure server to perform the action on the resource node only if the client authorization credentials are valid, otherwise denying the request.

### Claim 5 (depends on 3)

The method of claim 3, further comprising, if the action is not permitted:
accepting, from an administrator of the secure server, a request to change the permission of the node resource to permit the action;
determining if the requested change of permission is authorized; and
if the requested change of permission is authorized, transmitting a request to change the permission of the node resource to the identity provider to permit the action.

### Claim 6 (depends on 5)

The method of claim 5, further comprising:
receiving a third login request in the secure server, the third login request comprising further client authorization credentials identifying the source of the third login request and updated permission information describing permission to perform the action on the resource node according to the request to change the permission of the node resource.

### Claim 7 (depends on 3)

The method of claim 3, further comprising:
accepting, from an administrator of the secure server, a request to change the permission of the node resource;
determining if the requested change of permission is authorized; and
if the requested change of permission is authorized, transmitting a request to change the permission of the node resource to the identity provider.

### Claim 8 (depends on 7)

The method of claim 7, further comprising:
receiving a third login request in the secure server, the third login request comprising further client authorization credentials identifying the source of the third login request and updated permission information describing permission to perform a second action on the resource node according to the request to change the permission of the node resource.

### Claim 9 (depends on 3)

The method of claim 3, wherein:
the one or more attributes comprise:
a parent attribute specifying a parent node; and
a permission inheritance attribute specifying whether a scope permission of the node resource extends to subordinate node resources.

### Claim 10 (depends on 9)

The method of claim 9, wherein a null parent attribute indicates a hierarchically topmost node.

### Claim 11 (depends on 1)

The method of claim 1, wherein:
the client authorization credentials comprise:
an identifier (ID) token identifying the source of the second login request; and
an access token having permission information, the permission information describing permission to perform an action on the node resource.

### Claim 12 (depends on 1)

The method of claim 1, wherein the secure server is a data signing server and the action is signing the data.

### Claim 13

A system for performing an action on at least one resource node of a hierarchical organization of resource nodes, comprising:
a processor;
a memory, communicatively coupled to the processor, the memory storing processor instructions including processor instructions for:
receiving a login request in secure server;
redirecting the login request to an identity provider, the identity provider defining a hierarchical organization of node resources, each node resource having one or more scopes and one or more attributes, each one or more scope associated with a scope permission, wherein each node resource is either a management node resource for maintaining the hierarchical organization of the node resources or a configuration node resource for performing the action;
receiving a second login request in the secure server, the second login request comprising:
client authorization credentials identifying a source of the second login request and permission information describing a permission to perform an action on a node resource, the client authorization credentials provided by the identity provider in response to the redirected login request;
receiving a request to perform an action on the node resource;
determining if the action is permitted according to the permission information of the client authorization credentials; and
if the action is permitted, performing the action on the node resource.

### Claim 14 (depends on 13)

The system of claim 13, wherein:
the one or more scopes of the node resources each comprise:
an admin scope having an admin scope permission permitting a user to modify any scope permission of a node resource associated with the admin scope;
a manage scope having a manage scope permission permitting the user to modify a use scope permission of the node resource associated with the manage scope; and
the one or more scopes of the configuration node resource further comprise:
a use scope having the use scope permission permitting the user to use any configuration of the configuration node resource associated with the use scope.

### Claim 15 (depends on 14)

The system of claim 14, wherein the one or more scopes of the node resources each further comprise:
an edit scope having an edit scope permission permitting the user to edit attributes of the node resource associated with the edit scope; and
a view scope having a view scope permission permitting the user to view information defined for node resource associated with the view scope.

### Claim 16 (depends on 15)

The system of claim 15, wherein the processor instructions further comprise processor instructions for:
determining, in the secure server, if the client authorization credentials are valid; and
receiving the request in the secure server to perform the action on the resource node only if the client authorization credentials are valid, otherwise denying the request.

### Claim 17 (depends on 15)

The system of claim 15, wherein the processor instructions further comprise processor instructions for:
accepting, from an administrator of the secure server, a request to change the permission of the node resource to permit the action;
determining if the requested change of permission is authorized; and
if the requested change of permission is authorized, transmitting a request to change the permission of the node resource to the identity provider to permit the action.

### Claim 18 (depends on 17)

The system of claim 17, wherein the processor instructions further comprise:
receiving a third login request in the secure server, the third login request comprising further client authorization credentials identifying the source of the third login request and updated permission information describing permission to perform the action on the resource node according to the request to change the permission of the node resource.

### Claim 19 (depends on 15)

The system of claim 15, wherein:
the one or more attributes comprise:
a parent attribute specifying a parent node; and
a permission inheritance attribute specifying whether a scope permission of the node resource extends to subordinate node resources.

### Claim 20

A system for performing an action on at least one resource node of a hierarchical organization of resource nodes, comprising:
means for receiving a login request in secure server;
means for redirecting the login request to an identity provider, the identity provider defining a hierarchical organization of node resources, each node resource having one or more scopes and one or more attributes, each one or more scope associated with a scope permission, wherein each node resource is either a management node resource for maintaining the hierarchical organization of the node resources or a configuration node resource for performing the action;
means for receiving a second login request in the secure server, the second login request comprising:
client authorization credentials identifying a source of the second login request and permission information describing a permission to perform an action on a node resource, the client authorization credentials provided by the identity provider in response to the redirected login request;
means for receiving a request to perform an action on the node resource;
means for determining if the action is permitted according to the permission information of the client authorization credentials; and
means for performing the action on the node resource if the action is permitted.