SERVICE BINDING

• US 20100071048A1
• Filed: 09/12/2008
• Published: 03/18/2010
• Est. Priority Date: 09/12/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Novak, Mark F., Kaminsky, Daniel
• Granted Patent: US 8,850,553 B2
• Time in Patent Office: Days
• US Class Current: 726/10
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

Embodiments for performing service binding between a client and a target server are disclosed. In accordance with one embodiment, a clear text client service binding value is received from a client at the target server, the client service binding value is compared to a server service binding value, and a communication channel is formed between the client and the target server when the client service binding value matches the server service binding value.

Claims

1. A method for communication between a client and target server, comprising:

receiving a clear text client service binding value from a client at the target server;

comparing the client service binding value to a server service binding value; and

forming an authenticated communication channel between the client and the target server when the client service binding value matches the server service binding value.

2. The method for of claim 1, further comprising denying the client access to the target server when the client service binding value does not match the server service binding value.

3. The method of claim 1, wherein the clear text client service binding value is cryptographically protected during a transmission between the client and the target server by one of a Kerberos protocol, NT LAN Management (NTLM) protocol, or Digest authentication protocol.

4. The method for of claim 1, wherein the clear text client service binding value includes one of a gateway name that is known to the target server or a name of a different server that the client intends to reach.

5. The method for of claim 1, wherein the comparing includes performing a wild card match between the clear text client service binding value and the server service binding value, the server service binding value includes at least one wild card representation.

6. The method of claim 1, further comprising:

receiving a clear text client channel binding value from a client at the target server;

determining whether the clear text client channel binding value is a non-default value,

wherein the forming includes forming an authenticated communication channel between the client and the target server when the client service binding value matches the server service binding value and the client channel binding value is a non-default value.

7. The method of claim 1, further comprising:

forming an outer communication channel between a client and a gateway that is interspersed between the client and a target server via a Transport Security Layer (TLS) protocol,

wherein the receiving includes receiving a clear text client service binding

value from a client that has validated a certificate of the gateway, the client service binding value being derived from a name of the gateway.

8. The method of claim 1, wherein the receiving includes receiving a clear text client service binding value on the target server via a canonical name (CNAME) record in a Kerberos service ticket.

9. The method of claim 1, wherein the receiving includes receiving a clear text client service binding value on the target server via an attribute value pair in a NT LAN Manager (NTLM) authentication message.

10. The method of claim 1, wherein the receiving includes receiving a clear text client service binding value on the target server via a Digest directive.

11. A computer readable medium storing computer-executable instructions that, when executed, cause one or more processors to perform acts comprising:

forming a first outer communication channel between a client and a gateway, the gateway being interspersed between the client and a target server;

receiving a clear text client service binding value from a client at the target server at least partially via the first outer communication channel;

comparing the client service binding value to a server service binding value; and

forming an inner communication channel between the client and the target server when the client service binding value matches the server service binding value.

12. The computer readable medium of claim 11, the computer-executable instructions causing the one or more processors to perform acts further comprising forming a second outer communication channel between the gateway and the target server.

13. The computer readable medium of claim 11, wherein at least one of the first and second outer communication channels is established via a Transport Layer Security (TLS) protocol, and wherein the receiving includes receiving a clear text client service binding value from a client that has validated a certificate of the gateway, the client service binding value being derived from a name of the gateway.

14. The computer readable medium of claim 11, wherein the receiving comprises receiving a clear text client service binding value that is routed to the target server from the client by a domain name server.

15. The computer readable medium of claim 11, wherein the comparing includes performing a wild card match between the clear text client service binding value and the server service binding value, the server service binding value includes at least one wild card representation.

16. A server, comprising:

an input component to receive a clear text client service binding value from a client at the target server;

a comparison component to compare the client service binding value to a server service binding value, the comparison module to;

form a communication channel between the client and the target server when the client service binding value matches the server service binding value; and

deny the client access to the target server when the client service binding value does not match the server service binding value.

17. The system of claim 16, wherein the clear text client service binding value is cryptographically protected during a transmission between the client and the target server by one of a Kerberos protocol, NT LAN Management (NTLM) protocol, or Digest authentication protocol.

18. The server of claim 16, further comprising an unpack component to extract a clear text client service binding value from a canonical name (CNAME) record in a Kerberos service ticket.

19. The server of claim 16, further comprising an unpack component to extract a clear text client service binding value from an attribute value pair of a NT LAN Manager (NTLM) authentication message.

20. The server of claim 16, further comprising an unpack component to extract a clear text client service binding value from a Digest directive.