AUTHENTICATION AND AUTHORIZATION WITH A BUNDLED TOKEN

• US 20140337955A1
• Filed: 05/09/2013
• Published: 11/13/2014
• Est. Priority Date: 05/09/2013
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Binshtock, Michael, Mendelovich, Meir, Laivand, Sharon, Carmon, Avraham, Cadena Briceno, Jairo A., Waitser, Mark, Keisar, Tzvi
• Application Number:
  US13/890,374
• Publication Number:
  US 20140337955A1
• Time in Patent Office: Days
• US Class Current: 726/9
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

Authentication and authorization can be performed with a bundled token, which encapsulates two or more security tokens in a single security token. The bundled token can be supplied in response to a request for a token from a token service, for example. Subsequently, the bundled token can be sent in conjunction with a request for resource access, wherein more than one token is required to access the resource.

Claims

1. A computer-implemented method, comprising:

receiving a request to access a resource; and

determining whether the request includes a bundled token encapsulating two or more security tokens in a single security token.

2. The method of claim 1 further comprises responding to the request with a signal identifying a location for authentication, if the request does not include the bundled token.

3. The method of claim 1 further comprises extracting a first security token from the bundled token if the request includes the bundled token.

4. The method of claim 3 further comprises performing token validation on the first security token.

5. The method of claim 4 further comprises responding to the request with a signal identifying a location for authentication, if the first security token is invalid.

6. The method of claim 4 further comprises determining whether to allow access to a network including the resource based on the first security token, if the first security token is valid.

7. The method of claim 6 further comprises formulating a request for access to the resource with a second security token of the bundled token.

8. The method of claim 3 further comprises formulating a request for access to the resource with a second security token of the bundled token.

9. The method of claim 1 further comprises receiving the request to access a private network resource from outside the private network.

10. The method of claim 9 further comprising receiving the request from an unmanaged computing device.

11. A system, comprising:

a processor coupled to a memory, the processor configured to execute the following computer-executable components stored in the memory;

a first component configured to control access to a private network resource as a function of a bundled token that comprises a network-access security token and a resource security token embedded within a single security token.

12. The system of claim 11 further comprises a second component configured to extract the network-access security token from the bundled token.

13. The system of claim 12 further comprises a second component configured to validate the network-access security token.

14. The system of claim 12 further comprises a second component configured to determine if a client is authorized to access the private network based on the network-access security token.

15. The system of claim 11 further comprises a second component configured formulate a request to access the access the private network resource with solely the resource security token.

16. The system of claim 11, the first component is configured to control access from an unmanaged computing device.

17. A computer-readable storage medium having instructions stored thereon that enable at least one processor to perform a method upon execution of the instructions, the method comprising:

receiving a request for a security token; and

generating a bundled token comprising two or more security tokens embedded in a single security token in response to the request.

18. The method of claim 17 further comprises returning the bundled token in response to the request.

19. The method of claim 17 further comprises receiving client credentials with the request.

20. The method of claim 17 further comprises receiving a previously provided authentication token with the request.