Actively Federated Mobile Authentication

• US 20160164869A1
• Filed: 02/18/2016
• Published: 06/09/2016
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Young, Kyle Stapley, Drollinger, Robert Aron, O'Brien, Robert, Runde, David J., Pandya, Jagruti Dushyant, El Khoury, Georges
• Granted Patent: US 9,825,948 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54

Abstract

To make a trusted web service call, a client application sends a series of messages to obtain tokens that allow service requests to pass through a service relay. The user obtains a first security token by providing the user'"'"'s credentials. A second token is obtained from a trust broker that validates the first token. Both tokens are then sent with a service request to a service relay. The service relay validates the second token and then passes the first token and the service request to a connector service. The connector service validates the first token and passes the service request to a target back end service. The connector service acts as the user when communicating with the back end service. Service responses are routed back to the user through the connector service and the service relay.

Claims

1. A method for making web service calls to an enterprise service, comprising:

providing user credentials to an identity provider to obtain a first security token, the identity provider having an established trust relationship with the enterprise service, the token providing authentication for service requests received at the enterprise service;

providing the first token to a trust broker, the trust broker having an established trust relationship with a service relay and the identity provider;

receiving a second token from the trust broker in exchange for the first token, the second token providing authentication to a service relay; and

sending a service request to the service relay with the first token and the second token.

2. The method of claim 1, wherein the enterprise service is a back office service that processes the service requests.

3. The method of claim 1, wherein the enterprise service is a connector service that validates service requests and passes the service requests to a back office service.

4. The method of claim 3, wherein the first token comprises user identification information that allows the connector service to make web service calls to the back office service as if the connector service was the user.

5. The method of claim 1, wherein the enterprise service is a group of different systems providing a single service.

6. The method of claim 1, wherein the enterprise service is a group of different systems providing a plurality of different services.

7. A method for processing service requests at a connector service in an enterprise network, comprising:

receiving a service request and a token from a service relay, the service request directed to a back end service in the enterprise network, the token containing user identity information corresponding to a user who sent the service request;

validating the token and extracting the user identity information;

using the user identity information to communicate with the back end service in the user'"'"'s place;

sending the service request to the back end service;

receiving a response to the service request; and

sending the response to the service relay.

8. The method of claim 7, wherein the back end service is a group of different systems cooperatively providing a single service.

9. The method of claim 7, wherein the back end service is a group of different systems providing a plurality of different services.

10. The method of claim 7, wherein the token was issued to mobile device by an identity provider having a trust relationship with the enterprise network.

11. The method of claim 7, wherein the back end service is an enterprise resource planning application, and wherein the service request corresponds to a financial transaction initiated by the user on a remote device.

12. The method of claim 7, wherein the back end service is an enterprise resource planning application, and wherein the service request corresponds to a time entry logged by the user on a remote device.

13. A method for making web service calls to a back office service on an enterprise network, comprising:

providing user credentials to an identity provider to obtain a first token, the identity provider having an established trust relationship with an enterprise service, the token providing authentication for service requests received by the enterprise service;

providing the first token to a trust broker, the trust broker having an established trust relationship with a service relay and the identity provider;

receiving a second token from the trust broker in exchange for the first token, the second token providing authentication for a service relay;

sending a service request to the service relay with the first token and the second token, the service request directed to the back office service;

receiving the service request and the first token from the service relay at a connector service;

extracting user identity information from the first token;

using the user identity information to communicate with the back office service in the user'"'"'s place; and

sending the service request to the back office service.

14. The method of claim 13, further comprising:

receiving a response to the service request from the back office service; and

sending the response to the service relay; and

forwarding the response from the service relay to a user device.

15. The method of claim 13, wherein the enterprise service is the back office service that processes the service requests.

16. The method of claim 13, wherein the enterprise service is a connector service exposing a web service endpoint for a back office service.

17. The method of claim 13, wherein the enterprise service is a group of different systems cooperatively providing a single service.

18. The method of claim 13, wherein the enterprise service is a group of different systems providing a plurality of different services.

19. The method of claim 13, wherein the back office service is an enterprise resource planning application, and wherein the service request corresponds to a financial transaction initiated by the user on a remote device.

20. The method of claim 13, wherein the back office service is an enterprise resource planning application, and wherein the service request corresponds to a time entry logged by the user on a remote device.