DELEGATED AUTHENTICATION FOR WEB SERVICES

• US 20090254978A1
• Filed: 04/02/2008
• Published: 10/08/2009
• Est. Priority Date: 04/02/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Guo, Michael, Young, Kyle, Rouskov, Yordan, Chen, Rui
• Granted Patent: US 8,402,508 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Embodiments of the claimed subject matter provide a method and an apparatus for enabling delegated authentication for web services. Delegated authentication is provided without divulging the information the user requires to complete an authorization procedure of another web service or otherwise subjecting the user to unnecessary risk. Furthermore, delegated authentication is granted for a limited duration and access is subject to further limitations to prevent unnecessary intrusion to the user, the user'"'"'s data, and the host web service.

One embodiment of the claimed subject matter is implemented as a method for enabling delegated authentication to allow a third party service access to protected data on a host service. A user attempting to utilize functionality of a third party website that requests access to the user'"'"'s data stored on a separate host website is enabled as a delegate with authorization to access the data stored on the host website.

Claims

1. A method for attempting to establish permission to enable delegated authentication for web services, the method comprising:

receiving an access request in a storage service from a delegate application to access protected data;

receiving a request that references an offer from the delegate application to access the protected data from the owner of the protected resource;

presenting the offer referenced by the delegate application to the owner of the protected data;

receiving a response from the owner of the protected data to the requested offer from the delegate application; and

sending a delegation token to the delegate application representing the response of the owner of the protected data.

2. The method according to claim 1, wherein receiving a response from the owner of the protected data further comprises recording the response from the owner of the protected data to the offer from the delegate application.

3. The method according to claim 2, wherein the response from the owner of the protected data is recorded in a database.

4. The method according to claim 1, wherein the delegation token further comprises:

a form of encryption;

a scope of consent;

a signature;

a duration; and

an association with one or more offers.

5. The method according to claim 1, wherein receiving an offer from the delegate application to access protected data from the owner of protected data further comprises checking stored permissions for corresponding existing permissions.

6. The method according to claim 4, wherein existing permissions are stored within a database.

7. The method according to claim 1, wherein the delegation token sent to the delegate application indicates the owner of the protected data'"'"'s consent or lack thereof.

8. The method according to claim 1, wherein receiving an offer from the delegate application further comprises referencing an offer database for the definition of the offer.

9. The method according to claim 8, wherein presenting the offer from the delegate application to the owner of the protected data further comprises presenting the definition of the offer, wherein the definition is provided by the offer from the delegate application or is retrieved from an offer database.

10. A method for enabling delegated authentication to allow access to a protected data, the method comprising:

attempting to establish permission from an owner of the protected data for the delegate service to access the protected data via the exchange of a delegation token, attempting to establish permission includes receiving an access request and an offer from a delegate service seeking access to the protected data, presenting the offer to the owner, receiving the response of the owner and sending a delegation token to the delegate service that provides the parameters of the access allowed to the delegate service;

validating the delegation token of the delegate service to access the protected data; and

providing access to the protected data when the request of the delegate service to access the protected data is valid.

11. The method according to claim 10, wherein attempting to establish permission from the owner of the protected data for the delegate service to access the protected data further comprises an attempt made by the owner of the protected data to utilize functionality of a delegate service that requires access to protected data in a storage service, the attempt occurring during a period of time prior to the time permission is established.

12. The method according to claim 10, wherein attempting to establish permission for the external application to access protected data further comprises checking stored permissions for an existing permission corresponding to the received offer.

13. The method according to claim 10, wherein validating the delegation token of the delegate service to access the protected resource further comprises denying access if the delegation token is invalid.

14. the method of claim 10, wherein validating the delegation token further comprises:

decrypting the token;

verifying the token signature;

verifying the expiration time; and

verifying the correct offer.

15. The method of claim 10, wherein validating the delegation token further comprises obtaining another delegation token if the allowed duration current delegation token has expired.

16. A system for enabling delegated authentication for web services, the system comprising:

a computer system having a processor coupled to a memory, the memory having computer readable code, which when executed by the processor causes the computer system to implement a storage application for facilitating delegated authentication to allow access to protected data,

wherein, the storage application receives a request and an offer from a delegate application to access protected data, presents he offer from the delegate application to the owner of the protected data, receives a response from the owner of the protected data to the offer from the delegate application, and sends a delegation token to the delegate application that provides the parameters of the access (if any) allowed to the delegate service.

17. The system according to claim 16, wherein the access request and offer are sent from a remote computing device.

18. The system according to claim 17, wherein the remote computing device is a computer system.

19. The system according to claim 17, wherein the remote computing device is a hand-held computing device.

20. The system according to claim 17, wherein the access request and offer is sent via the Internet.