# US 8,544,066 B2 · Access right management system, access right management method, and access right management program > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,544,066 B2 - Document ID: US8544066B2 - Status: Granted - Kind: B2 - Application number: 12/735,120 - Filed: 2008-12-25 - Published: 2010-11-04 - Granted: 2013-09-24 - Earliest claimed: 2007-12-27 - Assignees: NEC Corporation - Applicants: Makoto Hatakeyama - Inventors: Makoto Hatakeyama - Web page: https://patentgrep.com/patent/US8544066B2 ## CPC - G06F 21/31: User authentication - G06F 21/33: using certificates - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/10: {for controlling access to devices or network resources} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An authentication device includes a user authentication certificate generation unit that issues to another device user authentication information on which information about a user is recorded; and a right transfer certificate/token generation unit that issues right transfer information and a token corresponding to the right transfer information to another device on the basis of information about a user to whom the right is transferred and a condition under which the right is transferred. A service proxy access device includes a token request unit that requests the issuing of the right transfer information and the token in order to access another device; and a user proxy access unit that accesses another service using the token. The service providing device includes a user authentication certificate request unit that acquires user authentication information from the authentication device using the token. ## Claims ### Claim 1 An access right management system, comprising: an authentication device that manages a condition under which a right is transferred; a service providing device that provides a service in a response to a service request; and a service proxy access device that acts as a proxy in accessing the service providing device, the authentication device, the service providing device, and the service proxy access device being implemented using hardware, wherein the authentication device includes: a user authentication certificate generation unit that issues to the service providing device user authentication information on which information about a user is recorded; and a right transfer certificate/token generation unit that issues to the service proxy access device right transfer information and a token corresponding to the right transfer information on a basis of information about a user to whom the right is transferred and the condition under which the right is transferred, the condition being set by a user who transfers the right, wherein the service proxy access device includes: a token request unit that requests the issuing of the right transfer information and the token to the authentication device in order to access the service providing device; and a user proxy access unit that accesses the service providing device using the token, and wherein the service providing device includes: a user authentication certificate request unit that uses the token to acquire the user authentication information from the authentication device. ### Claim 2 (depends on 1) The access right management system according to claim 1, wherein the service providing device further includes: a token request unit that requests the issuing of the right transfer information and the token to act as a proxy for the user recorded in the user authentication information in accessing another service providing device; and a user proxy access unit that uses the token for said another service providing device to access another service. ### Claim 3 (depends on 1) The access right management system according to claim 1, wherein the authentication device further includes a right transfer condition storage unit that stores a condition under which an access right is transferred that is set by a user who transfers the right, and wherein the right transfer certificate/token generation unit issues the right transfer information and the token corresponding to the right transfer information on a basis of the condition under which the right is transferred that is stored in the right transfer condition storage unit. ### Claim 4 (depends on 1) The access right management system according to claim 1, wherein the authentication device further includes: a certificate storage unit that keeps the right transfer information issued by the right transfer certificate/token generation unit and the token corresponding to the right transfer information; and a certificate request acceptance unit that receives the token and acquires from the certificate storage unit the right transfer information corresponding to the token received. ### Claim 5 (depends on 1) The access right management system according to claim 1, wherein: the authentication device includes a right user conversion unit that makes a determination as to whether to allow an access right to be transferred to another user; and the right transfer certificate/token generation unit issues the right transfer information and the token corresponding to the right transfer information when the right user conversion unit determines to allow the transfer of the right. ### Claim 6 (depends on 2) The access right management system according to claim 2, wherein the authentication device further includes a right transfer condition storage unit that stores a condition under which an access right is transferred that is set by a user who transfers the right, and wherein the right transfer certificate/token generation unit issues the right transfer information and the token corresponding to the right transfer information on a basis of the condition under which the right is transferred that is stored in the right transfer condition storage unit. ### Claim 7 (depends on 4) The access right management system according to claim 4, wherein the authentication device further includes a right transfer condition storage unit that stores a condition under which an access right is transferred that is set by a user who transfers the right, and wherein the right transfer certificate/token generation unit issues the right transfer information and the token corresponding to the right transfer information on a basis of the condition under which the right is transferred that is stored in the right transfer condition storage unit. ### Claim 8 (depends on 5) The access right management system according to claim 5, wherein the authentication device further includes a right transfer condition storage unit that stores a condition under which an access right is transferred that is set by a user who transfers the right, and wherein the right transfer certificate/token generation unit issues the right transfer information and the token corresponding to the right transfer information on a basis of the condition under which the right is transferred that is stored in the right transfer condition storage unit. ### Claim 9 (depends on 2) The access right management system according to claim 2, wherein the authentication device includes a right user conversion unit that makes a determination as to whether to allow an access right to be transferred to another user, and wherein the right transfer certificate/token generation unit issues the right transfer information and the token corresponding to the right transfer information when the right user conversion unit determines to allow the transfer of the right. ### Claim 10 (depends on 4) The access right management system according to claim 4, wherein the authentication device includes a right user conversion unit that makes a determination as to whether to allow an access right to be transferred to another user, and wherein the right transfer certificate/token generation unit issues the right transfer information and the token corresponding to the right transfer information when the right user conversion unit determines to allow the transfer of the right. ### Claim 11 An access right management method for enabling an authentication device that manages a right transfer condition and issues user authentication information to generate and distribute information about a transfer of a right and a token to a service providing device that provides a service in a response to a service request and a service proxy access device that acts as a proxy in accessing the service providing device, the method comprising: at the authentication device, generating, for the service providing device, user authentication information on which information about a user is recorded and issues to the service proxy access device right transfer information and a token corresponding to the right transfer information on a basis of information about a user to whom the right is transferred and a condition under which the right is transferred, the condition being set by a user who transfers the right; at the service proxy access device, requesting the issuing of the right transfer information and the token to the authentication device in order to access the service providing device and accesses the service providing device using the token; and at the service providing device, using the token to acquire the user authentication information from the authentication device. ### Claim 12 (depends on 11) The access right management method according to claim 11, further comprising: at the authentication device, setting a condition under which an access right is transferred to another user, stores a condition under which the access right is transferred that is set by a user, keeps in a certificate storage unit the right transfer information and the token corresponding to the right transfer information that are issued by a right transfer certificate/token generation, and acquires from the certificate storage unit the right transfer information corresponding to the token received after receiving the token. ### Claim 13 (depends on 11) The access right management method according to claim 11, further comprising: at the service proxy access device, acquiring the user authentication information of a user who is accessing and keeps the user authentication information acquired. ### Claim 14 (depends on 11) The access right management method according to claim 11, further comprising: at the service providing device, receiving the token in order to acquire information about the user from the service proxy access device, makes a determination as to whether to allow access to service information by examining the information about the user, and keeps a service to be provided to another device. ### Claim 15 (depends on 14) The access right management method according to claim 14, further comprising: at the service providing device, requesting the issuing of the right transfer information and the token in order to access another device and accesses another service using the token. ### Claim 16 (depends on 13) The access right management method according to claim 13, further comprising: at the authentication device, setting a condition under which an access right is transferred to another user, stores a condition under which the access right is transferred that is set by a user, keeps in a certificate storage unit the right transfer information and the token corresponding to the right transfer information that are issued by a right transfer certificate/token generation, and acquires from the certificate storage unit the right transfer information corresponding to the token received after receiving the token. ### Claim 17 (depends on 14) The access right management method according to claim 14, further comprising: at the authentication device, setting a condition under which an access right is transferred to another user, stores a condition under which the access right is transferred that is set by a user, keeps in a certificate storage unit the right transfer information and the token corresponding to the right transfer information that are issued by a right transfer certificate/token generation, and acquires from the certificate storage unit the right transfer information corresponding to the token received after receiving the token.