Token-based authentication using middle tier
AssigneeMicrosoft Corporation
InventorDimitrios Soulios
Life of this patent
Estimating the term…
Abstract
An intermediary system that facilitates a connection request from a client to a server. The intermediary system may participate in either or both of a token creation phase and a server connection phase. If participating in the token creation phase, the intermediary system generates a token that may later be used by the client during a server connection phase. The token includes a session identifier and is returned to the client. If participating in the server connection phase, the intermediary receives the token, extracts the session identifier from the token, and compares against the session identifier for the session in which the token was created. If the session identifiers match, then the intermediary connects to the server to complete the connection request.
Claims18
A computer program product comprising one or more computer storage media, not including transmission media, having thereon computer-executable instructions that when executed by one or more processors of a computing system cause the computing system to perform a method for acquiring a connection token, the method comprising an intermediary system performing the following:
- an act of receiving, at the intermediary system, a connection request from a client to a server, the request including one or more connection credentials, formulated as one or more connection strings, used by the client to connect to the server;
- at the intermediary system, an act of using at least one of the one or more connection credentials to connect to the server to verify that the connection credentials are part of a valid connection with the server;
- as a result of the intermediary system connecting to the server to verify that the connection credentials are part of a valid connection with the server, an act of obtaining a session identifier generated as a result of the intermediary connecting to the server to verify that the connection credentials are part of a valid connection with the server;
- an act of formulating a connection ticket that includes the session identifier and at least one of the one or more connection strings;
- an act of encrypting the connection ticket using a secret key;
- an act of generating a token that includes the connection ticket;
- and
- an act of providing the token that includes the connection ticket to the client.
A computer implemented method for connecting a client to a server, the method comprising:
- an act of receiving a token from the client;
- an act of decrypting the token using a secret key to extract a connection ticket;
- an act of extracting a session identifier and at least one credential from the connection ticket;
- an act of verifying that the session identifier extracted from the connection ticket matches a session identifier for a session in which the connection ticket was formulated, wherein the session identifier for the session in which the connection was formulated was obtained as a result of:
- an intermediary receiving a connection request from a client to a server, the request including one or more connection credentials, formulated as one or more connection strings, used by the client to connect to the server;
- the intermediary using at least one of the one or more connection credentials to connect to the server to verify that the connection credentials are part of a valid connection with the server;
- as a result of connecting to the server to verify that the connection credentials are part of a valid connection with the server, the intermediary obtaining a session identifier generated as a result of the intermediary connecting to the server to verify that the connection credentials are part of a valid connection with the server;
- and
- an act of using the extracted at least one credential to connect with the server.
A computer network comprising:
- a client computing system,
- a server computing system, and
- an intermediary for facilitating a web request from the client computing system to the server computing system, wherein the intermediary is configured to perform facilitate the web request using a token creation phase, and a subsequent server connection phase,
- wherein the token creation phase comprises:
- an act of receiving, at the intermediary, a connection request from a client to a server, the request including one or more connection credentials, formulated as one or more connection strings, used by the client to connect to the server;
- an act of the intermediary using at least one of the one or more connection credentials to connect to the server to verify that the connection credentials are part of a valid connection with the server;
- as a result of the intermediary connecting to the server to verify that the connection credentials are part of a valid connection with the server, an act of obtaining a session identifier generated as a result of the intermediary connecting to the server to verify that the connection credentials are part of a valid connection with the server;
- an act of formulating a connection ticket that includes the session identifier and the at least one of the one or more connection strings;
- an act of encrypting the connection ticket using a secret key;
- and
- an act of generating a token that includes the connection ticket;
- and
- an act of providing the token that includes the connection ticket to the client,
- wherein the server connection phase comprises:
- an act of receiving the token from the client;
- an act of decrypting the token using the secret key to extract a connection ticket;
- an act of extracting the session identifier and the at least one credential from the connection ticket;
- an act of verifying that the session identifier extracted from the connection ticket matches a session identifier for a session in which the connection ticket was formulated;
- and
- an act of using the extracted at least one credential to connect with the server.
Dependencies are inferred from the claim text.