# US 10,484,357 B1 · Method and apparatus for federated single sign on using authentication broker > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,484,357 B1 - Document ID: US10484357B1 - Status: Granted - Kind: B1 - Application number: 15/067,564 - Filed: 2016-03-11 - Granted: 2019-11-19 - Earliest claimed: 2012-12-31 - Assignees: EMC IP Holding Company LLC - Applicants: EMC Corporation - Inventors: Manoj K. Jain - Web page: https://patentgrep.com/patent/US10484357B1 ## CPC - G06F 21/41: where a single sign-on provides access to a plurality of computers - H04L 63/0815: {providing single-sign-on or federations} - H04L 63/10: {for controlling access to devices or network resources} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Example embodiments of the present invention provide a method, an apparatus, and a computer program product for brokering establishment of a trusted relationship between a first domain and a second domain. The method includes receiving, from a first domain, a request to establish a trusted relationship with a second domain and brokering establishment of the trusted relationship between the first domain and the second. Other example embodiments include brokering authenticated access for a client in the first domain to a resource in the second domain according to the established trusted relationship. ## Claims ### Claim 1 A computer-implemented method for execution in a system comprising a plurality of domains, a plurality of authentication servers, and an authentication broker layer spanning the plurality of domains, the method comprising: receiving, from a first domain, a request to establish a trusted relationship through a firewall with a second domain, wherein the first domain and the second domain use dissimilar open authentication standards that do not interoperate with each other; brokering establishment of the trusted relationship, via the authentication broker layer, between the first domain and the second domain, wherein the brokering establishment includes encapsulating the request in a format according, at least in part, to the open authentication standard of the second domain, wherein the request is encrypted; and brokering authenticated access for a client in the first domain to a resource in the second domain according to the established trusted relationship. ### Claim 2 (depends on 1) The method of claim 1 wherein brokering establishment of the trusted relationship between the first domain and the second domain comprises: forwarding the request to establish the trusted relationship to the second domain; receiving, from the second domain, a challenge for authentication; and providing the challenge for authentication to the first domain. ### Claim 3 (depends on 2) The method of claim 2 further comprising: receiving, from the first domain, an authentication request including credentials; forwarding the authentication request to the second domain; receiving trust properties from the second domain; and forwarding the trust properties to the first domain. ### Claim 4 (depends on 3) The method of claim 3 further comprising receiving a registration from the first domain to register the trust properties. ### Claim 5 (depends on 1) The method of claim 1 wherein brokering authenticated access for a client in the first domain access to a resource in the second domain according to the established trusted relationship comprises: receiving, from the first domain, an assertion regarding the resource in the second domain; generating, according to the assertion, a token, configured to be redeemed by the client in the first domain to access the resource in the second domain; and providing the token to the first domain. ### Claim 6 (depends on 5) The method of claim 5 wherein receiving, from the first domain, an assertion regarding the resource in the second domain comprises: providing a notification to the first domain that access to the resource by the client in the first domain requires authentication; and receiving a request from the client in the first domain to generate a token for authentication of the client in the first domain to access the resource in the second domain. ### Claim 7 (depends on 6) The method of claim 6 wherein receiving, from the first domain, a request to generate a token for authentication to the resource in the second domain further comprises: providing an authentication challenge to the client in the first domain; and receiving authorization from the client in the first domain to access the service in the second domain. ### Claim 8 (depends on 6) The method of claim 6 further comprising: receiving an indication of the token from the client in the first domain; and providing access to the resource in the second domain according to the indication of the token. ### Claim 9 (depends on 6) The method of claim 6 wherein the token is generated in the second domain. ### Claim 10 A system comprising: an authentication server configured to receive, from a first domain, a request to establish a trusted relationship through a firewall with a second domain, wherein the first domain and the second domain use dissimilar open authentication standards that do not interoperate with each other; and an authentication broker configured to broker establishment of the trusted relationship between the first domain and the second domain and to broker authenticated access for a client in the first domain to a resource in the second domain according to the established trusted relationship, wherein the brokering establishment includes encapsulating the request in a format according, at least in part, to the open authentication standard of the second domain, and wherein the request is encrypted. ### Claim 11 (depends on 10) The system of claim 10 wherein the authentication broker is further configured to forward the request, to establish the trusted relationship to the second domain, receive, from the second domain, a challenge for authentication, and provide the challenge for authentication to the first domain. ### Claim 12 (depends on 10) The system of claim 10 wherein the authentication service is further configured to receive, from the first domain, an authentication request including credentials, forward the authentication request to the second domain, receive trust properties from the second domain, and forward the trust properties to the first domain. ### Claim 13 (depends on 10) The system of claim 10 wherein the authentication broker is further configured to receive a registration from the first domain to register the trust properties. ### Claim 14 (depends on 10) The system of claim 10 wherein the authentication broker is further configured to receive, from the first domain, an assertion regarding the resource in the second domain; and wherein the authentication server is further configured to generate, according to the assertion, a token configured to be redeemed by the client in the first domain to access the resource in the second domain, and provide the token to the first domain. ### Claim 15 (depends on 14) The system of claim 14 wherein the first domain is configured to provide an authentication challenge to the client in the first domain and receive authorization from the client in the first domain to access the service in the second domain. ### Claim 16 (depends on 15) The system of claim 15 wherein the second domain is configured to receive an indication of the token from the client in the first domain and provide access to the resource in the second domain according to the indication of the token. ### Claim 17 (depends on 14) The system of claim 14 wherein the token is generated in the second domain. ### Claim 18 (depends on 10) The system of claim 10 wherein the second domain is configured to provide a notification to the first domain that access to the service by the client in the first domain requires authentication and receive a request from the client in the first domain to generate a token for authentication of the client in the first domain to access the resource in the second domain. ### Claim 19 A computer program product including a non-transitory computer-readable storage medium encoded with computer program code that, when executed on a processor of a computer, causes the computer to broker establishment of a trusted relationship between a first domain and a second domain, the computer program product comprising: computer program code for receiving, from the first domain, a request to establish the trusted relationship through a firewall with the second domain, wherein the first domain and the second domain use dissimilar open authentication standards that do not interoperate with each other; and computer program code for brokering establishment of the trusted relationship, via an authentication broker between the first domain and the second domain and for brokering authenticated access for a client in the first domain to a resource in the second domain according to the established trusted relationship, wherein the brokering establishment includes encapsulating the request in a format according, at least in part, to the open authentication standard of the second domain, and wherein the request is encrypted.