Trustworthy device claims for enterprise applications
AssigneeMicrosoft Corporation
InventorsMark Novak, Yair Tor, Eugene Neystadt, Yoav Yassour, Alexey Efron, Amos Ortal, Daniel Alon, Ran Didi
Life of this patent
Estimating the term…
Abstract
Embodiments of the invention enable a client device to procure trustworthy device claims describing one or more attributes of the client device, have those device claims included in a data structure having a format suitable for processing by an application, and use the data structure which includes the device claims in connection with a request to access the application. The application may use the device claims to drive any of numerous types of application functionality, such as security-related and/or other functionality.
Claims20
A method, comprising:
- (A) receiving, by an application at a computing device from a client device via at least one network, one or more converted device claims, each converted device claim including a device claim, each device claim including an attribute of the client device and used to authenticate the client device with the computing device, the device claim not recognized by the application, a converted device claim recognized by the application;
- (B) employing at least one processor to process the one or more converted device claims, the processing enabling performance of a function of the application that depends on the attribute of the client device described by each of the one or more converted device claims.
A computer-readable storage medium having instructions encoded thereon which, when executed, perform a method comprising:
- (A) receiving, from a client device via at least one network, one or more device claims each describing an attribute of the client device and used to authenticate the client device, each device claim not recognized by the application;
- (B) generating a data structure which includes the one or more device claims, the data structure having a format suitable for processing by an application;
- and
- (C) providing the data structure to the client device for use in connection with a request by the client device to access the application.
A client device, comprising at least one processor programmed to:
- request, from an attestation facility accessible to the client device via at least one network, a certificate which includes one or more trustworthy device claims, each trustworthy device claim describing an attribute of the client device, each trustworthy device claim used to authenticate the client device and not recognized by a web application;
- provide, to a security token service (STS), the certificate or a Kerberos ticket generated using the certificate, the certificate or a Kerberos ticket including the one or more trustworthy device claims;
- receive, from the STS, a Security Assertion Markup Language (SAML) token including the one or more trustworthy device claims;
- and
- employing the SAML token including the one or more trustworthy device claims in connection with a request to access the web application.
Dependencies are inferred from the claim text.