US 2010/0077208 A1Published application

Certificate based authentication for online services

AssigneeMicrosoft Corporation

InventorsMadan R. Appiah, Murli Dharan Satagopan

Life of this patent

Estimating the term…

Loading patent…

Abstract

In one embodiment, a client computer system receives user credentials from a computer user. The client computer system formulates a system identifier that uniquely identifies the system, and sends the received user credentials with the system identifier to an authentication service running on a datacenter server. The authentication service is configured to authenticate the user credentials and generate an authentication certificate based on the user credentials and the system identifier. The client computer system receives the generated authentication certificate from the authentication service and stores the received authentication certificate. The computer system receives an authentication request to authenticate the user subsequent to storing the certificate and, in response to the authentication request, automatically sends the stored authentication certificate to indicate to the datacenter server that the user is authorized to access the datacenter-provided information, without prompting the user to provide user credentials for authentication.

Claims20

Dependent claims

In a computer networking environment including at least a client computer system and a datacenter comprising a plurality of server computer systems, a method for establishing secure communication between the client computer system and the datacenter server computer systems, the method comprising:

an act of a client computer receiving one or more user credentials from a computer user;
an act of formulating a client computer system identifier that uniquely identifies the client computer system;
an act of sending the received user credentials and the client computer system identifier to an authentication service running on at least one server computer in a datacenter, the authentication service being configured to:
authenticate the user credentials to determine that the user is authorized to access datacenter-provided information corresponding to one or more client-side applications;
and
generate an authentication certificate based on the user credentials and the received client computer system identifier, the certificate being generated for subsequent authentication to datacenter applications;
an act of receiving the generated authentication certificate from the authentication service indicating that the user is authorized to access the datacenter-provided information;
an act of storing the received authentication certificate in a store on the client computer;
an act of receiving from a datacenter server an authentication request to authenticate the user subsequent to storing the certificate;
and
in response to the authentication request, an act of automatically sending the stored authentication certificate to indicate to the datacenter server that the user is authorized to access the datacenter-provided information, without prompting the user to provide user credentials for authentication.

8 more elements

an act of receiving at a datacenter server computer one or more user credentials and a client computer system identifier from a client-side authentication service, the datacenter server providing a server-side authentication service, the client computer system identifier being formulated to uniquely identify the client computer system;
an act of causing an authentication certificate to be generated based on the received user credentials and the client computer system identifier, the certificate indicating to the datacenter server that the user at the specified client system is authorized to access the datacenter-provided information corresponding to one or more user-accessible applications for a limited amount of time;
an act of sending the generated authentication certificate to the client computer, the generated certificate including an expiration stamp identifying when the certificate's validity ends;
an act of receiving an information request from a client-side application to access datacenter-provided information corresponding to the client-side application, the information request including the authentication certificate;
and
in response to the information request, an act of automatically sending the requested client-side application information without prompting the user to provide user credentials for authentication, the included authentication certificate indicating that the user is authorized to access the requested information.

3 more elements

A computer system comprising the following:

one or more processors;
system memory;
one or more computer-readable storage media having thereon computer-executable instructions that, when executed by the one or more processors, causes the computing system to perform a method establishing secure communication between the client computer system and the datacenter server computer systems, the method comprising the following:
an act of receiving at a datacenter server computer one or more user credentials and a client computer system identifier from a client-side authentication service, the datacenter server providing a server-side authentication service, the client computer system identifier being formulated to uniquely identify the client computer system;
an act of generating an authentication certificate based on the received user credentials and the client computer system identifier, the certificate indicating to the datacenter server that the user at the specified client system is authorized to access the datacenter-provided information corresponding to one or more user-accessible applications for a limited amount of time;
an act of appending a time stamp to the generated authentication certificate such that the certificate is configured to expire or can be revoked upon reaching the time designated in the time stamp;
an act of sending the generated authentication certificate to the client computer;
an act of receiving an information request from a client-side application to access datacenter-provided information corresponding to the client-side application, the information request including the authentication certificate;
in response to the information request, an act of automatically sending the requested client-side application information without prompting the user to provide user credentials for authentication, the included authentication certificate indicating that the user is authorized to access the requested information;
an act of determining that the user has logged off a client-side authentication service or that the certificate has expired based on the time stamp;
and
an act of revoking the authentication certificate, such that the certificate is no longer valid.

9 more elements

Dependencies are inferred from the claim text.