# US 10,375,053 B2 · Cross-platform single sign-on accessibility of a productivity application within a software as a service platform

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,375,053 B2
- Document ID: US10375053B2
- Status: Granted
- Kind: B2
- Application number: 15/267,012
- Filed: 2016-09-15
- Published: 2018-03-15
- Granted: 2019-08-06
- Earliest claimed: 2016-09-09
- Assignees: Microsoft Technology Licensing, LLC
- Applicants: Microsoft Technology Licensing, LLC.
- Inventors: Ganesh Sridharan; Vadim Eydelman; Anand Krishnamurthy; Srividhya Chandrasekaran; Daniel C. Stevenson; Sameer D. Bedekar; Aravind Namasivayam; Xiaozhong Luo; Andrew Guy Bybee; Ekaterina Bassova; Marc Kuperstein
- Web page: https://patentgrep.com/patent/US10375053B2

## CPC

- H04L 63/0815: {providing single-sign-on or federations}
- G06Q 10/10: Office automation; Time management
- H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)}
- H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

A Cross-Platform Single Sign On (CP-SSO) experience is provided herein to enable users to access multiple services via a single login when working across different platforms. A user may work across different platform when using multiple devices, when using multiple browsers on a single device, or when an integrated application requires a separate login for access within a host web application or portal service. A proxy token service manages login requests and authentication tokens after a given service has been logged into once by a user, so that the user does not need to provide login credentials on subsequent requests for the given service. By enabling a CP-SSO experience, network efficiency is improved, and the user experience is also improved as users do not need to supply authentication credentials as frequently and may freely choose to use multiple platforms instead of limiting usage to a single platform.

## Claims

### Claim 1

A method for single sign-on accessibility of a web-based application at an application service, comprising:
requesting, from a proxy token service, access to a first web-based application based on a first access request received from a user via the application service;
receiving a response from the proxy token service indicating that an identity (ID) token is needed to access the first web-based application and redirecting the request to a directory service, wherein the need for the ID token indicates that the first web-based application has not yet been accessed by the user via the application service and indicates that user account credentials need to be supplied to the directory service;
based on the response from the proxy token server, requesting, from the directory service, access to the first web-based application, wherein the request includes user account credentials for the first web-based application;
receiving a response from the directory service including the ID token and an authorization code based upon the directory service determining that the user account credentials are authorized to access the first web-based application;
posting the ID token and the authorization code to the proxy token service and storing the ID token and the authorization code in storage accessible by the proxy token service;
receiving an access token from the proxy token service, the proxy token service having previously acquired, and stored in the storage, the access token by redeeming the posted authorization code at the directory service;
providing the access token to the application service to receive authorization to access the first web-based application; and
when authorization to access the first web-based application is received, based on the access token being received at the application service, displaying the first web-based application in a user-accessible format.

### Claim 2 (depends on 1)

The method of claim 1, wherein the account credentials include a user name and password associated with the first web-based application.

### Claim 3 (depends on 1)

The method of claim 1, wherein requesting, from the directory service, access to the first web-based application further comprises providing a security feature that identifies the proxy token service.

### Claim 4 (depends on 1)

The method of claim 1, further comprising receiving a subsequent request to access a second web-based application from the user via the application service.

### Claim 5 (depends on 4)

The method of claim 4, wherein receiving the subsequent request to access the second web-based application further comprises:
requesting, from the proxy token service, access to the second web-based application based on a second access request received from the user;
receiving the access token from the proxy token service based on the proxy token service having determined that an ID token is not required due to the access token already being stored in the storage;
providing the access token to the application service for receiving authorization to access the second web-based application; and
when authorization to access the second web-based application is received, based on the access token being received at the application service, displaying the second application in a user-accessible format.

### Claim 6 (depends on 4)

The method of claim 4, wherein the access token is assigned an expirable period of time and wherein receiving the subsequent request to access the second web-based application SaaS platform further comprises:
requesting, from the proxy token service, access to the second web-based application;
receiving the access token from the proxy token service based on the proxy token service having determined that an ID token is not required due to the access token already being stored in the storage, wherein the access token was previously authorized for an assigned expirable period of time;
providing the access token to the application service for receiving authorization to access the second web-based application;
receiving a response from the application service that the access token is invalid due to expiration of the selected period of time;
notifying the proxy token service that the access token is invalid;
receiving a new access token from the proxy token service, the new access token having been acquired by the proxy token service by redeeming a multi-resource refresh token (MRRT) at the directory service, wherein the MRRT was previously received at the proxy token service when the posted authorization code was redeemed at the directory service;
providing the new access token to the application service for receiving authorization to access the second web-based application; and
when authorization to access the second web-based application based on the new access token is received, displaying the second productivity application in a user-accessible format.

### Claim 7 (depends on 1)

The method of claim 1, wherein the proxy token service retrieves the access token from the storage.

### Claim 8 (depends on 7)

The method of claim 7, wherein the proxy token service retrieves the access token from the storage based on a mapping of a user account associated with the application service to a user account associated with the first web-based application.

### Claim 9 (depends on 6)

The method of claim 6, wherein the access token, MRRT, and ID token are stored based on a mapping of a user account associated with the application service to a user account associated with the directory service.

### Claim 10 (depends on 1)

The method of claim 1, wherein displaying the first web-based application further comprises using, the access token to instantiate the first web-based application via a web software developer kit (SDK).

### Claim 11

A system for single sign-on accessibility of a web-based application at an application service, comprising:
a processing unit; and
a memory including instructions stored thereon for providing cross-platform single sign-on accessibility, which when executed by the processing unit, causes the system to:
request, from a proxy token service, access to a web-based application based on an access request received from a user via the application service;
receive a response from the proxy token service indicating that an identity (ID) token is needed to access the web-based application and redirecting the request to a directory service, wherein the need for the ID token indicates that the web-based application has not yet been accessed by the user via the application service and indicates that user account credentials need to be supplied to the directory service;
based on the response from the proxy token server, request, from the directory service, access to the web-based application, wherein the request includes user account credentials for the web-based application;
receive a response from the directory service including the ID token and an authorization code based upon the directory service determining that the user account credentials are authorized to access the web-based application;
post the ID token and the authorization code to the proxy token service and store the ID token and the authorization code in storage accessible by the proxy token service;
receive an access token from the proxy token service, the proxy token service having previously acquired, and stored in the storage, the access token by redeeming the posted authorization code at the directory service; and
provide the access token to the application service to receive authorization to access the web-based application; and
when authorization to access the web-based application based is received, based on the access token being received at the application service, display the web-based application in a user-accessible format.

### Claim 12 (depends on 11)

The system of claim 11, further comprising instructions that cause the system to terminate the display of the web-based application.

### Claim 13 (depends on 12)

The system of claim 12, further comprising instructions that cause the system to: receive a subsequent request to access the terminated application via the application service.

### Claim 14 (depends on 13)

The system of claim 13, wherein receiving the subsequent request to access the terminated web-based application via the application service further comprises instructions that cause the system to:
request, from the proxy token service, access to the web-based application;
receive the access token from the proxy token service based on the proxy token service having determined that an ID token is not required due to the access token already being stored in the storage;
provide the access token to the application service for receiving authorization to access the web-based application; and
when authorization to access the web-based application is received, based on the access token being received at the application service, display the web-based application in a user-accessible format.

### Claim 15 (depends on 13)

The system of claim 13, wherein receiving the subsequent request to access the terminated web-based application via the application service further comprises instructions that cause the system to:
request, from the proxy token service, access to the terminated web-based application;
receive the access token from the proxy token service based on the proxy token service having determined that an ID token is not required due to the access token already being stored in the storage, wherein the access token was previously authorized for a selected period of time;
provide the access token to the application service for receiving authorization to access the web-based application;
receive a response from the application service that the access token is invalid;
notify the proxy token service that the access token is invalid due to expiration of the selected period of time;
receive a new access token from the proxy token service, the new access token having been acquired by the proxy token service by redeeming multi-resource refresh token (MRRT) at the directory service, wherein the MRRT was previously received at the proxy token service when the posted authorization code was redeemed at the directory service;
provide the new access token to the application service for receiving authorization to access the web-based application; and
when authorization to access the web-based application is received at the application service, based on the new access token being received at the application service, display the web-based application in a user-accessible format.

### Claim 16 (depends on 11)

The system of claim 11, wherein the proxy token service retrieves the access token from the storage based on a mapping of a user account associated with the application service to a user account associated with the web-based application.

### Claim 17

A computer-readable memory device including instructions stored thereon for providing single sign-on accessibility of a web-based application at an application service, the instructions comprising:
requesting, from a proxy token service, access to a first web-based application based on an access request received from a user via the application service;
receiving a response from the proxy token service indicating that an identity (ID) token is needed to access the first web-based application and redirecting the request to a directory service, wherein the need for the ID token indicates that the first web-based application has not yet been accessed by the user via the application service and indicates that account credentials need to be supplied to the directory service;
based on the response from the proxy token server, requesting, from the directory service, access to the first web-based application, wherein the request includes user account credentials for the first web-based application;
receiving a response from the directory service including the ID token and an authorization code based upon the directory service determining that the user account credentials are authorized to access the first web-based application;
posting the ID token and the authorization code to the proxy token service and storing the ID token and the authorization code in storage accessible by the proxy token service;
receiving an access token from the proxy token service, the proxy token service having previously acquired, and stored in the storage, the access token by redeeming the posted authorization code at the directory service where the access token is assigned an expirable period of time;
providing the access token to the application service for receiving authorization to access the first web-based application;
displaying the first web-based application based on the received authorization;
terminating the first web-based application and the display of the first web-based application;
receiving a subsequent request to access the first web-based application from the user via the application service;
in response to the subsequent request to access the first web-based application, requesting, from the proxy token service, access to the application;
receiving the access token from the proxy token service based on the proxy token service having determined that an ID token is not required due to the access token already being stored in storage, wherein the access token was previously authorized for the expirable period of time; and
providing the access token to the application service for receiving authorization to access the first web-based application.

### Claim 18 (depends on 17)

The computer-readable memory device of claim 17, further comprising when the access token is determined to be valid by the application service, displaying the first web-based application in a user-accessible format.

### Claim 19 (depends on 17)

The computer-readable memory device of claim 17, further comprising when the access token is determined to be invalid by the application service due to expiration of the selected time period:
notifying the proxy token service that the access token is invalid;
receiving a new access token from the proxy token service, the new access token having been acquired by redeeming a multi-resource refresh token (MRRT) at the directory service, wherein the MRRT was previously received at the proxy token service when the posted authorization code was redeemed at the directory service;
providing the new access token to the application service for receiving authorization to access the first web-based application; and
when authorization to the access the first web-based application is received, based on the new access token being received at the application service, displaying the first web-based application within the SaaS platform.