Web ticket based upon a symmetric key usable for user authentication

• US 10,356,078 B2
• Filed: 04/06/2018
• Issued: 07/16/2019
• Est. Priority Date: 02/28/2013
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Tidwell, Paul, Pitsch, Yves, Rao, Deepak, Eydelman, Vadim, Kondepudi, Satya
• Primary Examiner(s): Simitoski, Michael
• Application Number:
  US15/947,705
• Publication Number:
  US 20180227291A1
• Time in Patent Office: 466 Days
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 65/40 Support for services or applications
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/563 Data redirection of data network streams
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context

Abstract

Described herein are various aspects pertaining to generating web tickets for use with authenticating computing devices to a computing system. Symmetric keys are used when generating the web tickets, wherein a symmetric key is valid for use when generating web tickets for a first period of time, and a web ticket generated based upon the symmetric key is valid for use when authenticating a computing device for a second period of time that is longer than the first period of time. Thus, the symmetric key is used for authenticating computing devices after it has ceased being used to generate web tickets.

Claims

1. A computing system comprising:

at least one processor; and

memory storing instructions that, when executed by the at least one processor, cause the at least one processor to perform acts comprising;

generating a first symmetric key and storing the first symmetric key in computer-readable storage, the first symmetric key has a first expiration time assigned thereto;

responsive to receiving a request for a first web ticket from a first computing device that is in communication with the computing system, generating the first web ticket based upon the first symmetric key wherein the first web ticket has a second expiration time assigned thereto that is subsequent the first expiration time;

responsive to receiving the request for the first web ticket, transmitting the first web ticket to the first computing device, wherein the first web ticket is valid for authenticating the first computing device until the second expiration time has passed, and further wherein the first computing device is authenticated subsequent to the first expiration time based upon the first web ticket and the first symmetric key;

generating a second symmetric key and storing the second symmetric key in the computer-readable storage, the second symmetric key has a third expiration time assigned thereto, the third expiration time is subsequent to the first expiration time and prior to the second expiration time;

subsequent to the first expiration time, prior to the second expiration time, and responsive to receiving a second request for a second web ticket from a second computing device that is in communication with the computing system, generating the second web ticket based upon the second symmetric key, wherein the second web ticket has a fourth expiration time assigned thereto that is subsequent the second expiration time; and

responsive to receiving the request for the second web ticket, transmitting the second web ticket to the second computing device, wherein the second web ticket is valid for authenticating the second computing device until the fourth expiration time has passed, and further wherein the second computing device is authenticated based upon the second web ticket and the second symmetric key.

2. The computing system of claim 1, the acts further comprising:

subsequent the first expiration time and prior to the second expiration time, receiving the first web ticket from the first computing device; and

responsive to receiving the first web ticket, authenticating the first computing device based upon the first web ticket and the first symmetric key.

3. The computing system of claim 1, the acts further comprising:

prior to the first expiration time, receiving the first web ticket from the first computing device; and

responsive to receiving the first web ticket, authenticating the first computing device based upon the first web ticket and the first symmetric key.

4. The computing system of claim 1, the acts further comprising:

subsequent the second expiration time, receiving the first web ticket from the first computing device; and

failing to authenticate the first computing device due to the first web ticket having expired.

5. The computing system of claim 1, the acts further comprising:

subsequent the first expiration time and prior to the third expiration time, receiving the second web ticket from the second computing device; and

responsive to receiving the second web ticket, authenticating the second computing device based upon the second web ticket and the second symmetric key.

6. The computing system of claim 1, the acts further comprising:

subsequent the third expiration time and prior to the fourth expiration time, receiving the second web ticket from the second computing device; and

responsive to receiving the second web ticket, authenticating the second computing device based upon the second web ticket and the second symmetric key.

7. The computing system of claim 1, the acts further comprising:

subsequent the fourth expiration time, receiving the second web ticket from the second computing device; and

failing to authenticate the second computing device due to the second web ticket having expired.

8. The computing system of claim 1, wherein the first web ticket comprises a first signature and the second web ticket comprises a second signature, wherein the first signature is based upon the first symmetric key, and further wherein the second signature is based upon the second symmetric key.

9. The computing system of claim 8, wherein the first web ticket further comprises a first identifier that identifies the first symmetric key, and further wherein the second web ticket further comprises a second identifier that identifies the second symmetric key.

10. The computing system of claim 1, wherein both the first web ticket and the second web ticket have a size of less than 200 bytes.

11. A method executed by a computing system, the method comprising:

generating and storing a first symmetric key in computer-readable storage;

assigning a first expiration time to the first symmetric key;

receiving, from a first computing device, a first request for a first web ticket, wherein the first computing device is to authenticate with the computing system based upon the first web ticket;

responsive to receiving the first request, generating the first web ticket based upon the first symmetric key, wherein the computing system is configured to use the first symmetric key to generate web tickets only until the first expiration time, the first web ticket is valid for authenticating the first computing device only until a second expiration time, and further wherein the second expiration time is subsequent the first expiration time;

transmitting the first web ticket to the first computing device, wherein subsequent to the first expiration time the computing system authenticates the first computing device based upon the first web ticket when the first computing device provides the computing system with the first web ticket;

generating and storing a second symmetric key in the computer-readable storage;

assigning a third expiration time to the second symmetric key, wherein the third expiration time is subsequent the first expiration time;

subsequent the first expiration time, receiving, from a second computing device, a second request for a second web ticket, wherein the second computing device is to authenticate with the computing system based upon the second web ticket;

responsive to receiving the second request, generating the second web ticket based upon a second symmetric key, wherein the computing system is configured to use the second symmetric key to generate web tickets only until the third expiration time, the second web ticket is valid for authenticating the second computing device only until a fourth expiration time, and further wherein the fourth expiration time is subsequent the second expiration time; and

transmitting the second web ticket to the second computing device, wherein the computing system authenticates the second computing device based upon the second web ticket when the second computing device provides the computing system with the second web ticket.

12. The method of claim 11, wherein the third expiration time is prior to the second expiration time.

13. The method of claim 12, further comprising:

wherein the second symmetric key is generated and stored subsequent to the first expiration time and prior to the second expiration time.

14. The method of claim 12, wherein the first web ticket comprises a first identifier for the first symmetric key, the method further comprising:

receiving, from the first computing device, the first web ticket;

responsive to receiving the first web ticket, determining that the first identifier is included in a list of symmetric key identifiers, wherein the symmetric key identifiers identify valid symmetric keys that have not expired;

responsive to determining that the first identifier is included in the list of symmetric key identifiers, obtaining the first symmetric key from the computer-readable storage; and

authenticating the first computing device based upon the first web ticket and the first symmetric key.

15. The method of claim 14, wherein the second web ticket comprises a second identifier for the second symmetric key, and further wherein the second identifier is included in the list of symmetric key identifiers.

16. The method of claim 15, further comprising:

receiving, from the second computing device, the second web ticket;

responsive to receiving the second web ticket, determining that the second identifier is included in the list of symmetric key identifiers;

responsive to determining that the second identifier is included in the list of symmetric key identifiers, obtaining the second symmetric key from the computer-readable storage; and

authenticating the second computing device based upon the second web ticket and the second symmetric key.

17. The method of claim 14, further comprising:

removing the first identifier from the list of symmetric key identifiers at the second expiration time.

18. The method of claim 12, further comprising:

receiving a request to authenticate the first computing device, the request is in the form of a uniform resource locator (URL), wherein the URL comprises the web ticket.

19. A computer-readable storage medium comprising instructions that, when executed by a processor, cause the processor to perform acts comprising:

generating a first symmetric key and storing the first symmetric key in computer-readable storage, the first symmetric key has a first expiration time assigned thereto;

responsive to receiving a request for a first web ticket from a first computing device that is in communication with the computing system, generating the first web ticket based upon the first symmetric key, wherein the first web ticket has a second expiration time assigned thereto that is subsequent the first expiration time;

responsive to receiving the request for the first web ticket, transmitting the first web ticket to the first computing device, wherein the first web ticket is valid for authenticating the first computing device until the second expiration time has passed, and further wherein the first computing device is authenticated based upon the first web ticket and the first symmetric key;

generating a second symmetric key and storing the second symmetric key in the computer-readable storage, the second symmetric key has a third expiration time assigned thereto, the third expiration time is subsequent to the first expiration time and prior to the second expiration time;

subsequent to the first expiration time, prior to the second expiration time, and responsive to receiving a second request for a second web ticket from a second computing device that is in communication with the computing system, generating the second web ticket based upon the second symmetric key, wherein the second web ticket has a fourth expiration time assigned thereto that is subsequent the second expiration time; and

responsive to receiving the request for the second web ticket, transmitting the second web ticket to the second computing device, wherein the second web ticket is valid for authenticating the second computing device until the fourth expiration time has passed, and further wherein the second computing device is authenticated based upon the second web ticket and the second symmetric key.

20. The computer-readable storage medium of claim 19, wherein both the first web ticket and the second web ticket have a size of less than 200 bytes.