Intermediary Identity Management for Service Entitlement Delegation
Solution Overview
Problem
Digital services are often rigidly tied to a single subscriber account, limiting the ability to delegate entitlements or personalize services across multiple users and devices, as they exist in isolated 'silos' that do not share user profiles or analytics information, hindering user-centric experiences and service flexibility.
Innovation Solution
A system and method that enables entitlement delegation across multiple media services by storing authorization data in an intermediary system, allowing access to media services on behalf of users who have been delegated entitlements, without sharing credentials, thereby facilitating seamless access and personalization across devices and groups.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If digital services are rigidly tied to a single subscriber account with a single digital ID, then service security and account management are simplified, but the ability to delegate access to other users and personalize services for multiple users is lost
Solution Approach 1:
The patent segments the monolithic subscriber account into multiple user identities (primary user and secondary users) with distinct digital IDs. Each user can be independently authorized for specific services, allowing delegation without sharing credentials. The system divides account management into service-level entitlements that can be selectively granted to different users.
Solution Approach 2:
The patent introduces an intermediary identity management system that mediates between the subscriber account and multiple users. This intermediary handles authorization data storage, entitlement verification, and service access coordination, enabling seamless delegation while maintaining security. The intermediary translates service requests from secondary users into authorized access using stored authorization data.
2Adaptability or versatility
If digital services exist in isolated silos with separate authentication systems, then each service maintains independent security control, but users cannot share services or personalize features across different services
Solution Approach 1:
The patent creates a universal authorization framework that works across multiple service silos. The identity management system stores and manages authorization data that can be applied to any service, enabling users to access and personalize multiple services through a unified delegation mechanism. The system provides multi-functional entitlement verification that operates across different service domains.
Solution Approach 2:
The patent merges multiple isolated authentication systems into a unified identity management architecture. By combining authorization data storage, entitlement management, and service access control into a single coordinated system, the patent enables cross-service sharing while reducing the effective number of independent authentication mechanisms users must interact with.
3Ease of operation
If credential sharing is required for service delegation, then users can access services on behalf of others, but security is compromised and personalization is limited
Solution Approach 1:
The patent creates digital copies of authorization credentials in the form of authorization data stored in the identity management system. Instead of sharing actual credentials, the system stores authorized user information and service entitlements that can be verified without exposing sensitive authentication data. This copying mechanism enables secure delegation where the original credentials remain private.
Solution Approach 2:
The intermediary identity management system acts as a secure mediator that handles all credential verification and authorization. Users never need to share their actual credentials because the intermediary system manages authorization data that proves entitlement without exposing sensitive information. The intermediary verifies service requests by checking stored authorization data rather than requiring credential sharing.
4Adaptability or versatility
If services are personalized to a single account holder, then service recommendations and features are optimized for that user, but shared services cannot be personalized for different users
Solution Approach 1:
The patent segments personalization data by user identity, storing separate user profiles, preferences, and analytics for each digital ID. This allows the system to deliver personalized service experiences for each user (primary and secondary) while maintaining distinct personalization data sets. Service recommendations and features can be tailored to each user's behavior and preferences independently.
Solution Approach 2:
The identity management system serves as an intermediary that manages multiple user profiles and their associated personalization data. It coordinates between service requests and user-specific preferences, ensuring that each user receives personalized content appropriate to their identity and entitlements. The intermediary handles the complexity of multi-user personalization transparently.
Data Source
AI summary
A system and method are provided for delegating entitlements to media services. The method includes storing, at an intermediary system operable between a plurality of service providers and a plurality of user devices, authorization data for each of a plurality of media services associated with a first user, the authorization data enabling the intermediary system to access the corresponding media service from a service provider on behalf of the first user. The method also includes, after detecting a request to access one of the plurality of media services by a second user, using a set of stored associations to determine whether or not the second user has been delegated an entitlement to the one of the plurality of media services by the first user. The method also includes, after determining that the second user has the entitlement, using corresponding authorization data to access the one of the plurality of media services on behalf of the second user, via a communication interface between the intermediary system and the corresponding service provider.