LEVERAGING A PERSISTENT CONNECTION TO ACCESS A SECURED SERVICE

• US 20150012985A1
• Filed: 07/02/2014
• Published: 01/08/2015
• Est. Priority Date: 04/11/2001
• Status: Active Grant

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Inventors: Hirsh, Robert Bruce
• Granted Patent: US 9,461,981 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 67/55 Push-based network services

Abstract

Leveraging a persistent connection to provide a client access to a secured service may include establishing a persistent connection with a client in response to a first request from the client, and brokering a connection between the client and a secured service based on a second request from the client by leveraging the persistent connection with the client. The brokering may occur before the client attempts to connect to the secured service directly and the connection may be established between the client and the secured service without provision by the client of authentication information duplicative or additional to authentication information provided by the client to establish the persistent connection.

Claims

1. A method, comprising:

receiving, at a server and from a client, a request to access a secured service that is separate from the server;

receiving, from the client, authentication information to authenticate the client with the server;

authenticating, based on the authentication information, the client with the server;

sending, based on an authentication of the client with the server, authorization information to the client to enable the client to access the secured service independent of the server.

2. The method as recited in claim 1, further comprising negotiating the authorization information with the secured service.

3. The method as recited in claim 1, further comprising authenticating, based on the authentication information, the client with the secured service.

4. The method as recited in claim 3, wherein authenticating the client with the secured service comprises leveraging only the authentication information from the client to authenticate the client with the secured service.

5. The method as recited in claim 3, wherein authenticating the client with the secured service comprises requesting the authorization information from the secured service.

6. The method as recited in claim 1, wherein the authorization information comprises information stored by the secured service.

7. The method as recited in claim 6, wherein the authorization information comprises information indicative of an identity of the client.

8. The method as recited in claim 1, wherein the authorization information comprises a password and a request-to-honor for the password.

9. The method as recited in claim 1, wherein the authorization information comprises a connection authorization request comprising a target connection point for the secured service.

10. The method as recited in claim 1, wherein the authorization information comprises constraint information for determining whether the authorization information satisfies at least one connection constraint associated with the secured service.

11. A method, comprising:

receiving, at a secured service, a request for a client to access the secured service;

receiving, from an intermediary system that is separate from the secured service, authentication information for the client;

authenticating, based on the authentication information from the intermediary system, the client with the secured service; and

providing, to the client and in response to authenticating the client, access to the secured service.

12. The method as recited in claim 11, wherein the authentication information from the intermediary system comprises authentication information used to establish a connection between the client and the intermediary system.

13. The method as recited in claim 11, wherein providing access to the secured service comprises providing authorization information to the client.

14. The method as recited in claim 13, wherein the authorization information comprises information stored by the secured service.

15. The method as recited in claim 13, wherein the authorization information comprises a connection authorization request comprising a target connection point for the secured service.

16. The method as recited in claim 13, wherein the authorization information comprises constraint information for determining whether the authorization information satisfies at least one connection constraint associated with the secured service.

17. The method as recited in claim 16, wherein the constraint information includes at least one of an indication of a number of uses for using the authorization information, an indication of a time when the authorization information was determined, an indication of a time window for using the authorization information, or information indicative of an identity of the client.

18. A system, comprising:

at least one processor; and

at least one non-transitory computer readable storage medium storing instructions thereon that, when executed by the at least one processor, cause the system to;

receive, from a client, a request to access a secured service that is separate from the server;

receive, from the client, authentication information to authenticate the client with the server;

authenticate, based on the authentication information, the client with the server;

send, based on an authentication of the client with the server, authorization information to the client to enable the client to access the secured service independent of the server

19. The system as recited in claim 18, further comprising instructions that, when executed by the at least one processor, cause the system to negotiate the authorization information with the secured service.

20. The system as recited in claim 18, further comprising instructions that, when executed by the at least one processor, cause the system to authenticating, based on the authentication information, the client with the secured service.