FLEXIBLE AUTHENTICATION AND AUTHORIZATION MECHANISM

• US 20110173681A1
• Filed: 01/12/2010
• Published: 07/14/2011
• Est. Priority Date: 01/12/2010
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Muthurajan, Anand, Gbadegesin, Abolade, Raastroem, Jorge, Veeramachaneni, Jithendra, Qureshi, Rashid
• Granted Patent: US 8,763,089 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 4/06 Selective distribution of broadcast services, e.g. multimedia broadcast multicast service [MBMS]; Services to user groups; One-way selective calling services
• CPC Class Codes: H04W 4/10 Push-to-Talk [PTT] or Push-On-Call services

Abstract

Techniques and tools for flexible authentication and authorization of services on a push framework. For example, a push notification framework allows services (social networking web services, etc.) to use either an authenticated access mode or an unauthenticated access mode, in order to push information to client devices (e.g., mobile devices). In the authenticated mode, the push framework requires registration of the service with the push framework before allowing the service to push notifications to client devices. Different authenticated modes are provided for third-party and first-party services. In the unauthenticated mode, registration is not required, but notifications are throttled, thereby limiting risk of abuse by unauthenticated services. This allows flexibility for services that use the push framework.

Claims

1. In a computer system configured for facilitating communication between one or more client devices and one or more services, a method comprising:

providing an authenticated mode to a service, the authenticated mode requiring registration of the service with a push notification framework;

providing an unauthenticated mode to the service, the unauthenticated mode allowing unregistered use of the push notification framework;

selecting between the authenticated mode and the unauthenticated mode based on identifying information provided by the service; and

based at least in part on the selected mode, providing subscription information to the service that permits the service to send push notifications to one or more client devices over a network.

2. The method of claim 1 wherein the identifying information provided by the service is a certificate comprising a subject name, the method further comprising:

registering a service name for the service; and

validating the service name with the certificate'"'"'s subject name as part of authentication that confirms registration with the push notification framework.

3. The method of claim 1 wherein the identifying information provided by the service is a service name, the method further comprising:

looking up the service name to determine whether the service is registered with the push notification framework.

4. The method of claim 1 wherein the selecting comprises selecting the authenticated mode, and wherein the subscription information comprises an HTTPs endpoint.

5. The method of claim 1 wherein the selecting comprises selecting the unauthenticated mode, and wherein the subscription information comprises a front-end HTTP endpoint.

6. The method of claim 1 further comprising selecting between an authenticated third-party service sub-mode and an authenticated internal service sub-mode, wherein the subscription information depends at least in part on the selected sub-mode.

7. The method of claim 6, wherein the subscription information is a front-end HTTPs endpoint if authenticated third-party service sub-mode is selected, or a back-end HTTP endpoint if authenticated internal service sub-mode is selected.

8. The method of claim 1 wherein the unregistered use is regulated by throttling notification flow from the service.

9. In a computer system configured for facilitating communication between one or more client devices and one or more services, a method comprising:

receiving subscription request information from a client device, the subscription request information identifying a service operable to send push notifications over a network to the client device;

based at least in part on the subscription request information, selecting between an unauthenticated communication mode and one or more authenticated communication modes; and

providing a subscription token to the client device, the subscription token comprising endpoint information corresponding to the selected communication mode;

wherein the endpoint information facilitates sending of push notifications from the service to the client device via a push notification framework.

10. The method of claim 9 wherein the selected communication mode is the unauthenticated mode, the method further comprising:

monitoring volume of push notifications sent by the service;

determining whether the volume of push notifications sent by the service exceeds a threshold; and

if the threshold is exceeded, preventing subsequent push notifications from being sent to the client device.

11. The method of claim 10 wherein the threshold is associated with a time period.

12. The method of claim 10 wherein the preventing of subsequent notifications from being sent comprises invalidating the subscription token.

13. The method of claim 10 wherein the endpoint information comprises an IP address for a front-end HTTP endpoint.

14. The method of claim 9 wherein the service is a third-party authenticated service, wherein the selected communication mode is a third-party authenticated communication mode, and wherein the endpoint information comprises an IP address for a front-end HTTPS endpoint.

15. The method of claim 9 wherein the service is a first-party authenticated service, wherein the selected communication mode is a first-party authenticated communication mode, and wherein the endpoint information comprises an IP address for a private HTTP endpoint that is not accessible by third-party services.

16. The method of claim 9 wherein the providing the subscription token to the client device comprises sending the subscription token to a push notification client stack on the client device.

17. In a computer system configured for facilitating communication between one or more client devices and one or more services, a method comprising:

at a push notification framework server, receiving a push notification message from a service operable to send push notifications to one or more mobile client devices via the push notification framework server;

determining whether the service is an authenticated service or an unauthenticated service;

determining whether the service is a first-party service or a third-party service;

selecting between an unauthenticated communication mode, an authenticated third-party communication mode, and an authenticated first-party communication mode based on the determining; and

based at least in part on the selected communication mode, determining whether to throttle push notifications from the service.

18. The method of claim 17 wherein the push notification message comprises an HTTP POST request containing a push notification.

19. The method of claim 17 wherein the push notification message comprises a subscription token, the method further comprising:

as part of an authorization process, validating that a service name in the token is associated with a subscription that the subscription token points to.

20. The method of claim 19 wherein the subscription token comprises an IP address indicating an endpoint at the push notification framework server to which the push notification message can be sent.