US 2014/0351594 A1Published application

Token-Based Authentication Using Middle Tier

AssigneeMicrosoft Corporation

InventorDimitrios Soulios

Life of this patent

Estimating the term…

Loading patent…

Abstract

An intermediary system facilitates a connection request from a client to a server. The intermediary system may participate in either or both of a token creation phase and a server connection phase. If participating in the token creation phase, the intermediary system generates a token that may later be used by the client during a server connection phase. The token includes a session identifier and is returned to the client. If participating in the server connection phase, the intermediary receives the token, which is sent from the client in conjunction with a connection request, extracts the session identifier from the token, and compares against the session identifier for the session in which the token was created. If the session identifiers match, then the intermediary connects to the server to complete the connection request for the client.

Claims19

Dependent claims

An intermediary system configured to be implemented between a first data processing system and a second data processing system, the intermediary system comprising:

one or more processors;
and
one or more computer storage media, having thereon computer-executable instructions that when executed by at least one of the one or more processors cause the intermediary system to perform a method for acquiring a connection token, the method comprising the intermediary system performing the following:
an act of receiving, at the intermediary system, information related to a connection request from a second data processing system to a first data processing system, the request including one or more connection credentials, formulated as one or more connection strings, used by the second data processing system to connect to the first data processing system;
at the intermediary system, an act of using at least one of the one or more connection credentials to connect to the first data processing system to verify that the connection credentials are part of a valid connection with the first data processing system;
an act of obtaining a session identifier generated as a result of the intermediary connecting to the first data processing system to verify that the connection credentials are part of a valid connection with the first data processing system;
an act of formulating a connection ticket that includes the session identifier and at least one of the one or more connection strings;
an act of encrypting the connection ticket using a secret key;
an act of generating a token that includes the connection ticket;
and
an act of providing the token that includes the connection ticket to the second data processing system.

8 more elements

A first intermediary system configured to be implemented between a first data processing system and a second data processing system, the first intermediary system comprising:

one or more processors;
and
one or more computer storage media, having thereon computer-executable instructions that when executed by at least one of the one or more processors cause other first intermediary system to perform a method for connecting a second data processing system to a first data processing system, the method comprising the first intermediary system performing the following:
an act of receiving a token from the second data processing system;
an act of extracting a connection ticket from the token;
an act of extracting a session identifier and at least one credential from the connection ticket;
an act of verifying that the session identifier extracted from the connection ticket matches a session identifier for a session in which the connection ticket was formulated, wherein the session identifier for the session in which the connection was formulated was obtained as a result of:
an intermediary receiving information related to a connection request from the second data processing system to the first data processing system, the request including one or more connection credentials, formulated as one or more connections strings, used by the second data processing system to connect to the first data processing system;
the intermediary using at least one of the one or more connection credentials to connect to the first data processing system to verify that the connection credentials are part of a valid connection with the first data processing system;
the intermediary obtaining a session identifier generated as a result of the intermediary connecting to the first data processing system to verify that the connection credentials are part of a valid connection with the first data processing system;
and
an act of using the extracted at least one credential to connect with the first data processing system for the second data processing system.

9 more elements

Dependencies are inferred from the claim text.

Facts

Application: 14/454,959Filed 8 Aug 2014
Priority: 30 Sep 2010
Published: 27 Nov 2014
Term ends: Not estimatedThe source records don’t support an estimate.

Classification5 codes

H04L 63/0807
For authentication of entities: using tickets, e.g. Kerberos
H04L 9/3213
Involving a third party or a trusted authority: using tickets or tokens, e.g. Kerberos
H04L 63/0428
For providing a confidential data exchange among entities communicating through data packet networks: wherein the data content is protected, e.g.…
H04L 63/08
Network architectures or network communication protocols for network security: for authentication of entities

Family

Application12/895,595Continuation · filed 30 Sep 2010
Application14/454,959Continuation
US 2012/0084561 A1Published application
US 8,819,424 B2Related patent
US 9,003,191 B2Related patent
US 2014/0351594 A1This patent

From the US filing history. Foreign family members aren’t listed.