ASYNCHRONOUS IDENTITY ESTABLISHMENT THROUGH A WEB-BASED APPLICATION

• US 20100306668A1
• Filed: 06/01/2009
• Published: 12/02/2010
• Est. Priority Date: 06/01/2009
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Barton, Jeremy Scott, VandeKerkhof, Michael Peter, Williams, Sam Franklin III
• Granted Patent: US 9,088,414 B2
• Time in Patent Office: Days
• US Class Current: 715/741
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853

Abstract

A determination is made as to whether a user has been logged off from the web-based application accessed through a web browser on a computer. If it is determined that the user has been logged off from the web-based application, then a new user interface is provided through the web browser. The new user interface may enable the user to enter user credentials. The user credentials are received through the new user interface. A request to validate the user based on the user credentials is transmitted. Upon transmitting the request to validate the user, an instruction to remove the new user interface is received when the user is validated. Upon receiving the instruction, a display of the web-based application is transformed by removing the new user interface.

Claims

1. A computer-implemented method for establishing identity through a web-based application, the computer-implemented method comprising computer-implemented operations for:

determining whether a user has been logged off from the web-based application accessed through a web browser on a computer;

upon determining that the user has been logged off from the web-based application, providing a new user interface through the web browser, the new user interface enabling the user to enter user credentials;

receiving the user credentials through the new user interface;

transmitting a request to validate the user based on whether the user credentials are valid;

upon transmitting the request to validate the user, receiving an instruction to remove the new user interface when the user is validated; and

upon receiving the instruction to close the new user interface, transforming a display of the web-based application by removing the new user interface.

2. The computer-implemented method of claim 1, wherein determining that the user has been logged off from the web-based application comprises identifying that a previous authentication token has expired or has been deleted.

3. The computer-implemented method of claim 1, wherein the user is logged off from the web-based application as a result of a passive log off.

4. The computer-implemented method of claim 1, wherein the user is logged off from the web-based application as a result of an active log off.

5. The computer-implemented method of claim 1, wherein the new user interface blocks user access to a server-side representation of the web-based application through the web browser.

6. The computer-implemented method of claim 1, wherein subsequent requests by the web browser to access the web-based application include a new authentication token.

7. The computer-implemented method of claim 6, wherein the new authentication token is contained in a browser cookie.

8. The computer-implemented method of claim 1, wherein a state of a local representation of the web-based application displayed on the web browser after the new user interface is removed is the same as a state of the local representation of the web-based application displayed on the web browser prior to the user being logged off.

9. The computer-implemented method of claim 1, the computer-implemented method comprising further computer-implemented operations for determining whether the user credentials match original user credentials entered when the user initially accessed the web-based application;

and wherein determining whether the user credentials are valid comprises upon determining that the user credentials match the original user credentials, determining whether the user credentials are valid.

10. The computer-implemented method of claim 1, the computer-implemented method comprising further computer-implemented operations for:

maintaining a token indicating whether a document edited through the web-based application has been edited since the document was last loaded;

determining whether the token indicates that the document has been edited since the document was last loaded; and

upon determining that the token indicates that the document has been edited since the document was last loaded, providing a message notifying the user to take preventative measures to save any content entered into a local representation of the web-based application.

11. A computer system, comprising:

a processor;

a memory operatively coupled to the processor; and

a program module (i) which executes in the processor from the memory and (ii) which, when executed by the processor, causes the computer system to establish identity through a web-based application by

determining whether a user has been logged off from the web-based application accessed through a web browser on a computer,

upon determining that the user has been logged off from the web-based application by identifying that a previous authentication token has expired or has been deleted, providing a new user interface through the web browser, the new user interface enabling the user to enter user credentials,

receiving the user credentials through the new user interface,

transmitting a request to validate the user based on whether the user credentials are valid,

upon transmitting the request to validate the user, receiving an instruction to remove the new user interface when the user is validated, and

upon receiving the instruction to remove the new user interface, transforming a display of the web-based application by removing the new user interface.

12. The computer system of claim 11, wherein transmitting a request to validate the user based on whether the user credentials are valid comprises transmitting, to an authentication server, the request to validate the user based on the user credentials;

and wherein receiving a notification that the user has been validated comprises receiving, from the authentication server, the notification that the user has been validated.

13. The computer system of claim 11, wherein the instruction to remove the new user interface is received from a web page to which new user interface is directed.

14. The computer system of claim 11, wherein the user is logged off from the web-based application as a result of a passive log off or an active log off.

15. The computer system of claim 11, the program module, wherein the new user interface blocks user access to a server-side representation of the web-based application through the web browser.

16. The computer system of claim 11, wherein subsequent requests by the web browser to access the web-based application include a new authentication token.

17. The computer system of claim 16, wherein the new authentication token is contained in a browser cookie.

18. The computer system of claim 11, wherein the program module, when executed by the processor, further causes the computer system to establish identity through a web-based application by

determining whether the user credentials match original user credentials entered when the user initially accessed the web-based application;

and wherein determining whether the user credentials are valid comprises upon determining that the user credentials match the original user credentials, determining whether the user credentials are valid.

19. The computer system of claim 11, wherein the program module, when executed by the processor, further causes the computer system to establish identity through a web-based application by

maintaining a token indicating whether a document edited by the user through the web-based application has been edited by another since the document was last loaded,

determining whether the token indicates that the document has been edited since the document was last loaded, and

upon determining that the token indicates that the document has been edited since the document was last loaded, providing a message notifying the user to take preventative measures to save any content entered into a local representation of the web-based application.

20. A computer-storage medium having computer-executable instructions stored thereon which, when executed by a computer, cause the computer to:

determine whether a user has been logged off from a web-based application accessed through a web browser on a computer, the user being logged off as a result of a passive log off or an active log off;

upon determining that the user has been logged off from the web-based application by identifying that a previous authentication token has expired or has been deleted, provide a new user interface through the web browser, the new user interface enabling the user to enter user credentials, the new user interface configured to block user access to a server-side representation of the web-based application through the web browser;

receive the user credentials through the new user interface,

transmit, to an authentication server, a request to validate the user based on whether the user credentials are valid;

upon transmitting the request to validate the user, receive an instruction to remove the new user interface when the user is validated, wherein the instruction to remove the new user interface is received from a web page to which new user interface is directed by the authentication server; and

upon receiving the instruction to remove the new user interface, transform a display of the web-based application by removing the new user interface.