FEDERATED REALM DISCOVERY

• US 20090320114A1
• Filed: 06/19/2008
• Published: 12/24/2009
• Est. Priority Date: 06/19/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Rouskov, Yordan, Chen, Rui, Ayres, Lynn, Guo, Wei-Qiang, Faulkner, Sarah
• Granted Patent: US 9,735,964 B2
• Time in Patent Office: Days
• US Class Current: 726/8
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853

Abstract

A federated realm discovery system within a federation determines a “home” realm associated with a portion of the user'"'"'s credentials before the user'"'"'s secret information (such as a password) is passed to a non-home realm. A login user interface accepts a user identifier and, based on the user identifier, can use various methods to identify an account authority service within the federation that can authenticate the user. In one method, a realm list of the user device can be used to direct the login to the appropriate home realm of the user. In another method, an account authority service in a non-home realm can look up the user'"'"'s home realm and provide realm information directing the user device to login at the home realm.

Claims

1. A method of identifying a home security authority for authenticating a security principal within a federation, the method comprising:

receiving through a login user interface of a non-home security authority on a user device at least a portion of a security principal identifier of the security principal;

requesting identification of the home security authority of the security principal based on the at least a portion of the security principal identifier;

receiving the identification of the home security authority of the security principal, responsive to the requesting operation.

2. The method of claim 1 wherein the non-home security authority and the home security authority are members of the federation.

3. The method of claim 1 further comprising:

requesting authentication from the identified home security authority of the security principal.

4. The method of claim 3 further comprising:

receiving a security token from the identified home security authority for access by the security principal to a network service.

5. The method of claim 1 wherein the requesting operation accesses a realm list datastore of the user device to identify the home security authority of the security principal, based on the at least a portion of the security principal identifier.

6. The method of claim 1 wherein the requesting operation comprises:

sending a request via a communications network to the non-home security authority, the request including the at least a portion of the security principal identifier and not including a secret credential of the security principal, the request requesting the non-home security authority to identify the home security authority of the security principal.

7. The method of claim 1 wherein the requesting operation comprises:

sending a request via a communications network to the non-home security authority, prior to receipt of all of characters of the security principal identifier.

8. The method of claim 1 wherein the requesting operation comprises:

sending a request via a communications network to the non-home security authority, prior to receipt of a secret credential of the security principal by the login user interface.

9. A computer-readable storage medium having computer-executable instructions for performing a computer process that submits user credentials of a security principal to a home security authority within a federation, the computer process comprising:

presenting to the security principal a login user interface from a non-home security authority within the federation;

receiving via the login user interface at least a portion of a security principal identifier of the security principal;

receiving identification of the home security authority of the security principal based on the at least a portion of the security principal identifier;

transmitting the user credentials of the security principal, including the security principal identifier and associated secret information of the security principal, to the identified home security authority without transmitting the associated secret information of the security principal to the non-home security authority.

10. The computer-readable storage medium of claim 9 wherein the receiving operation receives the user credentials of the security principal through the login user interface from the non-home security authority but does not transmit the associated secret information of the security principal to the non-home security authority, and further comprising:

requesting identification of the home security authority of the security principal based on the at least a portion of the security principal identifier.

11. The computer-readable storage medium of claim 10 further comprising:

presenting to the security principal a login user interface received from the identified home security authority, after the operation of requesting identification;

receiving via the login user interface received from the identified home security authority at least a portion of the security principal identifier of the security principal, prior to the transmitting operation.

12. The computer-readable storage medium of claim 9 wherein the computer process further comprises:

receiving a security token from the identified home security authority for access by the security principal to a network service.

13. The computer-readable storage medium of claim 9 wherein the requesting operation accesses a realm list datastore of the user device to identify the home security authority of the security principal, based on the at least a portion of the security principal identifier.

14. The computer-readable storage medium of claim 9 wherein the requesting operation comprises:

sending a request via a communications network to the non-home security authority, the request including the at least a portion of the security principal identifier and not including the associated secret information of the security principal, the request requesting the non-home security authority to identify the home security authority of the security principal.

15. The computer-readable storage medium of claim 9 wherein the requesting operation comprises:

sending a request via a communications network to the non-home security authority, prior to receipt of all of characters of the security principal identifier.

16. The computer-readable storage medium of claim 9 wherein the requesting operation comprises:

sending a request via a communications network to the non-home security authority, prior to receipt of a secret credential of the security principal by the login user interface.

17. A method of identifying a home security authority for authenticating a security principal within a federation, the method comprising:

receiving at a non-home security authority a request from a security principal requesting identification of the home security authority of the security principal based on at least a portion of a security principal identifier of the security principal provided with the request;

evaluating a realm list providing one or more mappings between security principal identifiers or portions thereof and realm information, the realm information identifying the home security authority corresponding to the security principal identifier or portion thereof,

sending from the non-home security authority to the security principal an identification of the home security authority of the security principal corresponding to the security principal identifier or a portion thereof that matches the at least a portion of the security principal identifier of the security principal.

18. The method of claim 17 wherein the non-home security authority and the home security authority are members of the federation.

19. The method of claim 17 wherein a secret credential of the security principal is not received by the non-home security authority with the request.

20. The method of claim 17 wherein the identification of the home security authority of the security principal includes a uniform resource locator to the home security authority.