HTTP-based authentication
AssigneeMicrosoft Corporation
InventorsArun K. Nanda, Hervey Wilson
Life of this patent
Estimating the term…
Abstract
A system and method for authenticating an HTTP message. A relying party may respond to a request from a requester by sending an HTTP message with authentication specifications to the requester. The requester responds with a new request that adheres to a scheme specified by the relying party. A framework allows for a security token to be located in an HTTP header or a message body, with various options such as fragmenting the token available. An option allows for cryptographically binding the security token to the body of a message. An authentication framework provides for an implementation by an HTTP stack or by an application.
Claims20
A computer-readable storage medium comprising computer program instructions for processing messages exchanged between a requester and a server, the program instructions executable by a processor to perform actions including:
- a) receiving, from the server, a server message comprising one or more HTTP headers, the one or more HTTP headers including authentication specifications;
- b) in response to receiving the server message, generating a request message that complies with the authentication specifications, the request message comprising:
- i) a plurality of HTTP headers;
- ii) a security token including a cryptographic key, the security token complying with a security token specification in the authentication specifications;
- and
- iii) an HTTP token location header, of the plurality of HTTP headers, including a security token location specification, the security token location specification identifying a location of the security token;
- v) an HTTP security header, of the plurality of HTTP headers, including a digital signature;
- c) selectively determining the location of the security token to be in a message body;
- d) selectively determining the location of the security token to be in the plurality of HTTP token headers;
- and
- e) generating a digital signature of at least a portion of the request message based on a signature specification of the authentication specifications, and inserting the digital signature into the HTTP security header.
A computer-readable storage medium comprising computer program instructions for processing messages exchanged between a requester and a server, the program instructions executable by a processor to perform actions including:
- a) sending, to the requester, a server message comprising one or more HTTP headers, the one or more HTTP headers including one or more authentication specifications;
- b) receiving, from the requester, a request message comprising a message body and a plurality of HTTP headers, the plurality of HTTP headers including:
- i) a security token location specification identifying a location of a security token;
- and
- ii) a digest comprising a cryptographic representation of at least a portion of the message body and at least a portion of the plurality of HTTP headers;
- c) if the security token location specification indicates that the security token is in the plurality of HTTP headers, extracting the security token from the plurality of HTTP headers;
- d) if the security token location specification indicates that the security token is in the message body, extracting the security token from the message body;
- e) extracting the digest from the plurality of HTTP headers;
- f) verifying that the digest accurately represents the message body and the at least a portion of the HTTP headers;
- and
- g) generating a response message based on the security token.
A computer-based system for processing messages exchanged between a requester and a server, comprising a message processor configured to perform actions including:
- a) in response to a server message comprising one or more HTTP headers, the one or more HTTP headers including authentication specifications, generating a request message that complies with the authentication specifications;
- b) inserting, into the request message, a security token conforming to a security token specification in the authentication specifications;
- c) inserting, into the request message, an HTTP token location header that specifies a location of the security token;
- d) inserting, into the request message, an HTTP digest header that includes a digest comprising a cryptographic representation of at least one HTTP header;
- and
- e) inserting, into the request message, a security header that includes a digital signature of at least a portion of the request message.
Dependencies are inferred from the claim text.