Authenticating Linked Accounts

• US 20080134295A1
• Filed: 11/30/2006
• Published: 06/05/2008
• Est. Priority Date: 11/30/2006
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Bailey, David W., Guo, Weiqiang Michael, Huang, Lin, Rouskov, Yordan I., Ayres, Lynn C.
• Granted Patent: US 8,327,428 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Embodiments of authenticating linked accounts are presented herein. In an implementation, an authentication service provides functionality to form links between a plurality of user accounts. A client may then authenticate by providing credentials for one account in a group of linked accounts, and is permitted access to each account in the group of linked accounts based upon the linking. Thus, a single sign-in of a client to one account may permit the client to obtain services for service providers corresponding to multiple linked accounts, without an individual sign-in to each account.

Claims

1. A method comprising:

storing at an authentication service a link identifier corresponding to a plurality of account identifiers to form a set of linked accounts; and

managing authentication of a client to the set of linked accounts, such that the client, upon providing to the authentication service credentials corresponding to one account in the set of linked accounts, receives access to each account in the set of linked accounts.

2. The method as recited in claim 1, wherein:

the authentication service manages authentication of clients on behalf of a plurality of service providers; and

access to each account in the set of linked accounts includes access to corresponding services provided by the plurality of service providers.

3. The method as recited in claim 1, further comprising:

exposing an application programming interface callable by the client to indicate a plurality of user accounts to link one to another; and

storing the link identifier in response to an indication received from the client via the interface.

4. The method as recited in claim 1, further comprising forming an authentication token for communication to the client which includes the link identifier to reference the set of linked accounts.

5. The method as recited in claim 4, wherein the link identifier is to permit one or more service providers presented with the authentication token as proof of a client'"'"'s identity to identify the set of linked accounts.

6. The method as recited in claim 5, wherein, based on the link identifier, the one or more service providers permit access to services corresponding to each account described by the link identifier, without additional authentication of the client.

7. The method as recited in claim 1, wherein managing authentication of the client includes exposing one or more interfaces to permit client interaction with the set of linked accounts.

8. The method as recited in claim 7, wherein the one or more interfaces to permit client interaction include:

an application programming interface callable by the client to indicate a plurality of accounts to link one to another; and

an additional application programming interface callable by the client to indicate a link to remove between a set of linked accounts.

9. The method as recited in claim 1, wherein managing authentication of the client includes exposing one or more interfaces to permit interactions of one or more service providers with the set of linked accounts.

10. The method as recited in claim 9, wherein the one or more interfaces to permit interactions of the one or more service providers include an application programming interface to:

receive from one said service provider the link identifier obtained by the service provider from an authentication token provided by the client; and

based upon the link identifier, provide the service provider access to data corresponding to the set of linked accounts which are linked via the link identifier.

11. The method as recited in claim 9, wherein the one or more interfaces to permit interactions of one or more service providers are to:

receive from one said service provider a link identifier obtained by the one said service provider from a authentication token provided by the client, wherein the authentication token;

corresponds to a first account in the set of linked accounts; and

is issued to the client by the authentication service upon verification of credentials for the first account provided by the client;

based upon the link identifier, provide data to the one said service provider to identify the corresponding set of linked accounts in a user interface portion to select one of the set of linked accounts;

receive from the service provider a user selection of a second account in the set of linked accounts made via the user interface portion; and

perform a switch between the first account and the second account, such that the authentication token after the switch corresponds to the second account.

12. The method as recited in claim 11, wherein the switch includes overwriting an account identifier of the first account in the authentication token with an account identifier of the second account.

13. The method as recited in claim 12 wherein:

when the authentication token corresponds to the first account, the service provider provides services to the client corresponding to the first account; and

when the authentication token corresponds to the second account, the service provider provides services to the client corresponding to the second account.

14. The method as recited in claim 11, wherein the switch is performed without additional credentials being provided.

15. One or more computer readable media comprising computer executable instructions which, when executed, direct an authentication server to:

expose an a interface accessible by a client over a network to define a link between a plurality of user accounts;

store a link identifier to form a set of linked accounts defined by the client via the interface; and

based upon a single sign-in of the client to one account of the set of linked accounts, form an authentication token for communication to the client which includes the link identifier to reference the set of linked accounts.

16. One or more computer readable media as recited in claim 15, wherein the link identifier included in the authentication token is to permit the client to access services from one or more service providers corresponding to each of the accounts in the set of linked accounts with the single sign-in.

17. One or more computer readable media as recited in claim 15, further comprising instructions to expose an interface to:

receive the link identifier via the network from a service provider to reference the set of linked accounts, the link identifier obtained by the service provider from the authentication token when the client presents the authentication token for proof of identity to access corresponding services; and

based on the link identifier, provide the service provider access to data corresponding to the set of linked accounts, the data utilized by the service provider to output a user interface for the client to interact with the set of linked accounts.

18. A method comprising:

receiving an authentication token via a network from a client, wherein the authentication token;

includes a link identifier to reference a set of accounts linked via an authentication service;

corresponds to a first account in the set of linked accounts; and

is issued to the client by the authentication service upon verification of credentials for the first account provided by the client;

utilizing the link identifier obtained from the authentication token to output, in a user interface to provide services corresponding to the first account, a portion to select a second one of the set of linked accounts; and

when a second one of the set of linked accounts is selected via the portion;

providing the selection to the authentication service to cause a switch between the first account and the second account, such that the authentication token after the switch corresponds to the second account; and

based upon the switch, outputting a user interface to provide services corresponding to the second account.

19. The method as recited in claim 18, wherein the switch is performed without additional credentials being provided.

20. The method as recited in claim 18, wherein the switch includes overwriting an account identifier of the first account in the authentication token with an account identifier of the second account.