Multiple Security Token Transactions

• US 20070226785A1
• Filed: 03/23/2006
• Published: 09/27/2007
• Est. Priority Date: 03/23/2006
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Rouskov, Yordan, Jiang, Wei, Pai, Dilip, Nagvekar, Sanjeev, Chow, Colin, Chow, Trevin, Wong, Pui-Yin
• Granted Patent: US 8,225,385 B2
• Time in Patent Office: Days
• US Class Current: 726/8
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol

Abstract

Embodiments of multiple security token transactions are described herein. One or more of the described techniques may be utilized to provide, in a single request and response, an authentication token and a plurality security tokens for proof of identity at respective service providers.

Claims

1. A method comprising:

forming a request for communication to an authentication service requesting a plurality of security tokens, and

obtaining the plurality of security tokens at a client via a single transaction between the authentication service and the client.

2. The method as recited in claim 1, wherein each security token is configured to prove identity of a client at a respective service provider.

3. The method as recited in claim 1, wherein the request includes credentials for verification by the authentication service and a single verification of the credentials permits issuance of the plurality of security tokens.

4. The method as recited in claim 1, wherein at least one of the plurality of security tokens obtained by the client is presentable to a corresponding service provider to prove identity of the client without submitting user credentials.

5. A method as in claim 1, wherein the plurality of tokens includes an authentication token configured to prove the identity of the client at the authentication service.

6. A method as in claim 5, further comprising providing the authentication token to the authentication service and receiving a security token corresponding to another service provider.

7. The method as recited in claim 1, wherein the request is configured according to a web service trust protocol.

8. The method as recited in claim 7, wherein the web service trust protocol is extended with syntax that permits a request for a plurality of security tokens.

9. A method comprising:

receiving at an authentication server a single request from a client over a network seeking a plurality of security tokens; and

communicating to the client, in response to the single request, a plurality of security tokens.

10. The method as recited in claim 9, wherein the communicating occurs upon verification of client credentials indicated in the single request.

11. The method as recited in claim 9, wherein the plurality of security tokens includes:

at least one authentication token configured to be provided to the authentication server as proof of the client'"'"'s identity, and

one or more service tokens each configured to be provided to at least one service provider as proof of the client'"'"'s identity to access one or more resources of the service provider.

12. The method as recited in claim 11, wherein the resources of said service providers are selected from the group consisting of:

instant messaging service;

web search service;

e-mail service;

productivity applications;

multimedia content;

web pages; and

blogs.

13. The method as recited in claim 9 wherein the request is configured according to WS-Trust.

14. The method as recited in claim 9 further comprising forming a response to the single request wherein the authentication server utilizes web service trust protocol to form the response.

15. The method as recited in claim 14 wherein the web service trust protocol is extended with syntax which permits inclusion of multiple error nodes in the response to the single request.

16. A method comprising:

communicating to an authentication service a request having credentials to authenticate a client and requesting a plurality of security tokens; and

receiving, in response to the request, an authentication token and one or more service tokens each corresponding to a respective service provider.

17. The method as recited in claim 16 wherein the request includes a plurality of request nodes corresponding to each requested security token.

18. The method as recited in claim 16 wherein the response includes a plurality of error nodes corresponding to errors in authenticating the client with respect to a plurality of the requested security tokens.

19. The method as recited in claim 16 further comprising providing one or more said service tokens to a respective said service provider as proof of identity to access resources of the service provider without submitting user credentials.

20. The method as recited in claim 16 further comprising providing the authentication token as proof of identity at the authentication server without submitting user credentials to obtain at least one other service token corresponding to another service provider.