IP Library › Granted Patent US 8,843,415

Granted Patent B2

US 8,843,415 · App. 12/245,559 · Granted Sep 23, 2014

Secure software service systems and methods

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 8,843,415
App. No.: 12/245,559
Granted: Sep 23, 2014
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

In one embodiment the present invention includes a method of performing a secure transaction in a software system, such as a software service system, for example. Embodiments of the invention include encoding symmetric keys for securing transactions between a service consumer and service provider. Asymmetric keys are also used for providing additional security during transactions. In one embodiment, license tokens and capability tokens are encoded and passed between a service consumer and service provider for allowing a consumer secure access to authorized services.

Claims (71)

1. A method of performing a secure software service transaction comprising:

performing a first transaction between a software service consumer and a license token service, the first transaction comprising:

receiving, on at least one computer system executing the license token service, a license token request from the software service consumer, and

sending, by the at least one computer system executing the license token service, a license token to the software service consumer in response to the license token request, wherein the license token is encrypted by a key shared between the license token service and a security token service;

performing a second transaction between the software service consumer and the security token service, the second transaction comprising:

receiving, on at least one computer system executing the security token service, a capability token request from the software service consumer, the capability token request including the encrypted license token and identifying one or more particular software services to be accessed on a backend system,

decrypting, by the at least one computer system executing the security token service, the encrypted license token with the key shared between the license token service and a security token service, and

sending, by the at least one computer system executing the security token service, a capability token to the software service consumer in response to the capability token request, wherein the capability token is encrypted by a key shared between the security token service and the backend system, the capability token including information identifying the one or more particular software services to be accessed on the backend system;

performing a third transaction between the software service consumer and the backend system, the third transaction comprising:

receiving, on at least one computer system executing the backend system, a service request from the software service consumer, the service request including the encrypted capability token,

decrypting, by the at least one computer system executing the backend system, the capability token with the key shared between the security token service and the backend system,

generating, by the at least one computer system executing the backend system, a new capability token including information identifying the one or more particular software services to be accessed on the backend system,

sending, by the at least one computer system executing the backend system, the new capability token to the software service consumer,

receiving, on the at least one computer system executing the backend system, a service request from the software service consumer comprising the new capability token and an identification of the one or more particular software services to be accessed on the backend system, and

executing, by the at least one computer system executing the backend system, the service request on the one or more particular software services to be accessed on the backend system.

2. The method of claim 1 further comprising a fourth transaction, prior to the first transaction, wherein the security token service and the license token service share the key used to encrypt and decrypt the license token.

3. The method of claim 1 further comprising a fourth transaction, prior to the first transaction, wherein the security token service and the backend system share the key used to encrypt and decrypt the capability token.

4. The method of claim 1 further comprising a fourth transaction, prior to the first transaction, wherein the backend system provides the security token service the ability to grant capability tokens.

5. The method of claim 1 further comprising:

receiving a delegation token in the security token service from the backend system;

sending, with the capability token during the second transaction, the delegation token from the security token service to the software service consumer; and

receiving, with the capability token during the third transaction, the delegation token from the software service consumer in the backend system; and

verifying that the delegation token was issued by the backend system to the security token service.

6. A system for performing a secure software service transaction comprising:

one or more processors; and

a memory comprising processor readable instructions, which when executed by the processor perform the steps of:

performing a first transaction between a software service consumer and a license token service, the first transaction comprising:

receiving a license token request from the software service consumer, and

sending a license token to the software service consumer in response to the license token request, wherein the license token is encrypted by a key shared between the license token service and a security token service;

performing a second transaction between the software service consumer and the security token service, the second transaction comprising:

receiving a capability token request from the software service consumer, the capability token request including the encrypted license token and identifying one or more particular software services to be accessed on a backend system,

decrypting the encrypted license token with the key shared between the license token service and a security token service, and

sending a capability token to the software service consumer in response to the capability token request, wherein the capability token is encrypted by a key shared between the security token service and the backend system, the capability token including information identifying the one or more particular software services to be accessed on the backend system;

performing a third transaction between the software service consumer and the backend system, the third transaction comprising:

receiving a service request from the software service consumer, the service request including the encrypted capability token,

decrypting the capability token with the key shared between the security token service and the backend system,

generating a new capability token including information identifying the one or more particular software services to be accessed on the backend system,

sending the new capability token to the software service consumer,

receiving a service request from the software service consumer comprising the new capability token and an identification of the one or more particular software services to be accessed on the backend system, and

executing the service request on the one or more particular software services to be accessed on the backend system.

7. The system of claim 6 wherein the instructions, when executed by the processor, further perform a fourth transaction, prior to the first transaction, wherein the security token service and the license token service share the key used to encrypt and decrypt the license token.

8. The system of claim 6 wherein the instructions, when executed by the processor, further perform a fourth transaction, prior to the first transaction, wherein the security token service and the backend system share the key used to encrypt and decrypt the capability token.

9. The system of claim 6 wherein the instructions, when executed by the processor, further perform a fourth transaction, prior to the first transaction, wherein the backend system provides the security token service the ability to grant capability tokens.

10. The system of claim 6 wherein the instructions, when executed by the processor, further perform the steps of:

receiving a delegation token in the security token service from the backend system;

sending, with the capability token during the second transaction, the delegation token from the security token service to the software service consumer; and

receiving, with the capability token during the third transaction, the delegation token from the software service consumer in the backend system; and

verifying that the delegation token was issued by the backend system to the security token service.

11. A non-transitory computer readable storage medium including processor executable instructions which when executed cause the processor to perform a method, the method comprising: