Group URI Authorization for Multi-Subscriber Resource Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The Open Authorization Protocol (OAuth) is insufficient for secure sharing of communication services in telecommunications networks, as it lacks mechanisms for secure sharing of resources requiring consent from multiple subscribers, and it cannot issue access tokens for accessing resources of multiple subscribers simultaneously.
Innovation Solution
A services gatekeeper system that uses group Uniform Resource Identifiers (URIs) to enable secure sharing of communication services by allowing a designated group owner to issue access tokens for a group, thereby authorizing third-party applications to access protected communication services of all group members, while ensuring granular control and protection of subscriber data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If standard OAuth message flow is used, then secure sharing of individual subscriber resources is enabled, but secure sharing of resources requiring multiple subscriber consent is not possible
Solution Approach 1:
The patent segments the authorization process by introducing a group owner concept that can represent multiple subscribers. The group URI structure divides the authorization scope into individual subscriber resources while allowing a single access token to cover multiple subscribers when the group owner provides consent. This segmentation enables the system to handle both individual and group-level authorization needs.
Solution Approach 2:
The group owner acts as an intermediary between multiple subscribers and third-party applications. The group owner can issue access tokens on behalf of multiple subscribers without requiring each subscriber to individually authorize the application. This intermediary mechanism resolves the contradiction by providing a secure delegation path that maintains security while enabling multi-subscriber resource sharing.
2Reliability
If one access token is issued per subscriber, then individual subscriber consent is obtained, but efficient access to multiple subscriber resources is not achieved
Solution Approach 1:
The patent merges multiple individual authorization instances into a single group-level authorization. When a group owner consents to share resources, the system combines the authorization scope across multiple subscribers into one access token. This merging reduces the complexity of managing multiple separate tokens while maintaining the reliability of individual consent control through the group owner's authorization.
Solution Approach 2:
The access token is designed with multi-functionality, capable of representing either a single subscriber or multiple subscribers depending on the authorization scope. The same token structure and mechanism can be used for individual or group-level access, providing universality that simplifies the authorization system while maintaining security through scope-based control.
3Adaptability or versatility
If group URI authorization is implemented, then secure multi-subscriber resource sharing is enabled, but additional authorization layer is introduced
Solution Approach 1:
The patent introduces a new dimension to the OAuth authorization model by adding group-level abstraction. The group URI adds a hierarchical dimension where subscribers can be organized into groups, allowing authorization to operate at both individual and group levels. This dimensional addition enables multi-subscriber access without fundamentally complicating the underlying OAuth protocol structure.
Data Source
AI summary
In accordance with various embodiments, services gatekeeper systems and methods allow mapping and protecting communication services APIs with OAuth and group access to user information. Such a system can include a plurality of applications, executing on one or more application servers. The services gatekeeper is operable to define a group of members using a group URI, intercept requests for access to communication services APIs, obtain authorization from a group owner for access to a specified communication services API for each member of the group, and enable access to the specified communication services API of each member of the group in accordance with the scope authorized by the group owner.