Remote Resources Single Sign On

• US 20120084570A1
• Filed: 09/30/2010
• Published: 04/05/2012
• Est. Priority Date: 09/30/2010
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Kuzin, Sergey A., Eremenko, Andrew, Ben-Shachar, Ido, Hussain, Amjad, Baker, James, Reskusich, Raymond M.
• Granted Patent: US 8,505,083 B2
• Time in Patent Office: Days
• US Class Current: 713/182
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263

Abstract

Exemplary techniques for enabling single sign-on to an operating system configured to conduct a remote presentation session are disclosed. In an exemplary embodiment, a user credential can be encrypted using an encryption key generated by a remote presentation session server and sent to a client. The client can send the encrypted user credential to the remote presentation session server. The remote presentation session server can decrypt the user credential and use it to log a user into an operating system running on the remote presentation session server. In addition to the foregoing, other techniques are described in the claims, the detailed description, and the figures.

Claims

1. A system configured to effect single sign-on for remote presentation sessions, comprising:

a first server, comprising;

a first processor;

a first memory coupled to the first processor, the first memory including computer-executable instructions that upon execution cause the first processor to;

encrypt a user credential received from a client with a unique encryption key generated by a second server; and

send the encrypted user credential to the client;

the second server, comprising;

a second processor; and

a second memory coupled to the second processor, the second memory including computer-executable instructions that upon execution cause the second processor to;

decrypt a copy of the encrypted user credential received from the client;

log a user associated with the decrypted copy of the user credential into the operating system; and

conduct the remote presentation session with the client.

2. The system of claim 1, further comprising:

the client, comprising;

a third processor; and

a third memory coupled to the third processor, the third memory including computer-executable instructions that upon execution cause the third processor to;

retrieve the user credential from a client database and send the user credential to the first server in response to determining that a network identifier associated with the first server matches a network identifier stored in the client database.

3. The system of claim 1, further comprising:

the client, comprising;

a third processor; and

a third memory coupled to the third processor, the third memory including computer-executable instructions that upon execution cause the third processor to;

authenticate the second server in response to determining that a second server signed authentication certificate received from the second server matches a certificate received from the first server.

4. The system of claim 1, wherein the second memory further comprises computer-executable instructions that upon execution cause the second processor to:

delete a decryption key for decrypting the copy of the encrypted user credential received from the client after a single use of the unique encryption key.

5. The system of claim 1, wherein the instructions that upon execution by the first processor cause the first server to encrypt the user credential received from the client with the unique encryption key further comprise computer-executable instructions that upon execution cause the first processor to:

encrypt the user credential and digitally sign a list of remote presentation session configuration settings.

6. The system of claim 1, wherein the first memory further comprises computer-executable instructions that upon execution cause the first processor to:

send a configuration profile to the client, wherein the configuration profile includes a network identifier associated with the first server.

7. The system of claim 1, wherein the second memory further comprises computer-executable instructions that upon execution cause the first processor to:

configure a guest operating system executing within a virtual machine to conduct a virtual desktop session with the client.

8. The system of claim 1, wherein the instructions that upon execution cause the second processor to conduct the remote presentation session with the client further comprise computer-executable instructions that upon execution cause the second processor to:

conduct a remote desktop session with the client.

9. The system of claim 1, wherein the second memory further comprises computer-executable instructions that upon execution cause the second processor to:

delete a decryption key for decrypting the copy of the encrypted user credential after a predetermined amount of time.

10. The system of claim 1, wherein the second memory further comprises computer-executable instructions that upon execution cause the second processor to:

accept a connection request from the first server in response to a comparison between a network identifier of the first server and a network identifier stored in a second server registry.

11. A computer-readable storage medium including executable instructions for effectuating single sign-on for a virtual desktop session, the computer-readable storage medium including computer-executable instructions that cause a processor of a first sever to:

generate an encryption key and associate it with a unique identifier;

send both the encryption key and the unique identifier to a second server configured to encrypt a copy of the user credential with the encryption key;

receive an encrypted copy of the user credential and the unique identifier from a client;

decrypt the encrypted copy of the user credential in response to finding a decryption key that is associated with the unique identifier;

log a user associated with the user credential into a virtual desktop session; and

conduct the virtual desktop session with the client.

12. The computer-readable storage medium of claim 11, further comprising computer-executable that cause the processor of the first server to:

verify a signature of a list of virtual desktop configuration settings received from the client with the encryption key; and

configure the virtual desktop session in accordance with the list of virtual desktop configuration settings.

13. The computer-readable storage medium of claim 11, further comprising computer-executable that cause the processor of the first server to:

delete a decryption key for decrypting the copy of the encrypted user credential received from the client after a predetermined amount of time.

14. The computer-readable storage medium of claim 11, further comprising computer-executable that cause the processor of the first server to:

accept a connection request from the second server in response to a comparison between a network identifier of the second server and a stored network identifier stored in a first server registry.

15. A single sign on method, comprising:

sending a user credential to a first server;

receiving, from the first server, both a network identifier for a second server and an encrypted copy of the user credential encrypted by an encryption key generated by the second server;

sending the encrypted copy of the user credential to the network identifier of the second server;

receiving a signal indicating that the user credential was verified and used to log a user of the client into a remote presentation session on the second server; and

displaying user interface graphics indicative of the remote presentation session.

16. The method of claim 15, wherein sending the user credential to the first server further comprises:

sending the user credential retrieved from a client database in response to determining that a network identifier for the first server matches a network identifier stored in the client database.

17. The method of claim 15, further comprising:

deleting the user credential from a client database in response to receiving a signal identifying that a user has logged off the client.

18. The method of claim 15, further comprising:

deleting the user credential from a client database in response to receiving a signal identifying that a remote presentation session client engine has terminated.

19. The method of claim 15, further comprising:

receiving the user credential during an operating system logon operation.

20. The method of claim 15, further comprising:

authenticating the second server in response to determining that a second server signed authentication certificate received from the second server matches a certificate received from the first server.