Leveraging a persistent connection to access a secured service

• US 7,237,257 B1
• Filed: 06/29/2001
• Issued: 06/26/2007
• Est. Priority Date: 04/11/2001
• Status: Active Grant

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: AOL LLC (Apollo Global Management, Inc.)
• Inventors: Hirsh, Robert Bruce
• Primary Examiner(s): Moazzami; Nasser
• Assistant Examiner(s): Cervetti; David Garcia
• Application Number:
  US09/894,919
• Time in Patent Office: 2,188 Days
• Field of Search: 713/201, 713/155, 726/10, 726/8
• US Class Current: 726/10
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 67/55 Push-based network services

Abstract

Leveraging a persistent connection to provide a client access to a secured service may include establishing a persistent connection with a client in response to a first request from the client, and brokering a connection between the client and a secured service based on a second request from the client by leveraging the persistent connection with the client. The brokering may occur before the client attempts to connect to the secured service directly and the connection may be established between the client and the secured service without provision by the client of authentication information duplicative or additional to authentication information provided by the client to establish the persistent connection.

Claims

1. A method, performed by a client, of leveraging a connection with an intermediary to access a secured service, the method comprising:

establishing an authenticated connection between a client and an intermediary;

receiving a user request for access to a secured service;

submitting, by the client, a request, which is based on the user request for access to a secured service, to the intermediary that is physically distinct of the secured service;

receiving, from the intermediary, constrained authorization information that has been electronically negotiated by the secured service and the intermediary, the constrained authorization information being electronically negotiated in response to the client request; and

submitting, by the client, the constrained authorization information to the secured service to establish a direct authenticated connection between the client and the secured service independent of the authenticated connection between the client and the intermediary.

2. The method of claim 1 wherein establishing the authenticated connection between the client and the intermediary comprises:

sending, by the client, keystone authentication information to the intermediary; and

receiving, from the intermediary, verification of the keystone authentication information.

3. The method of claim 2 wherein submitting the request to the intermediary for access to the secured service prompts the intermediary to authenticate itself to the secured service without provision by the client of authentication information duplicative or additional to the keystone information.

4. The method of claim 3 wherein the intermediary is authenticated to the secured service by provision, by the intermediary, of a leveraged authentication based on the keystone authentication.

5. The method of claim 1 wherein the constrained authorization information has been issued by the secured service and sent by the secured service to the intermediary.

6. The method of claim 1 wherein the constrained authorization information has been provided by the intermediary and authenticated by the secured service.

7. The method of claim 1 wherein the constrained authorization information comprises, a constraint that the authorization information be used within a predetermined time.

8. The method of claim 1 wherein the client comprises one or more of a web browser, an e-mail client, a synchronization client, an instant messaging client, a software productivity application, an operating system, and an operating system kernel.

9. The method of claim 1 wherein the intermediary comprises one or more of an instant messaging service, an e-mail service, a login service, an authentication service, an authorization service, a persistent connection service, and a broker service.

10. The method of claim 1 wherein the secured service comprises one or more of an e-mail service, a synchronization service, a print service, a file access service, an instant messaging service, an operating system, an operating system kernel, an authentication service, an authorization service, and a persistent connection service.

11. The method of claim 1 wherein the client request for access to the secured service comprises an explicit request for access by the client.

12. The method of claim 1 wherein the client request for access to the secured service comprises a communication sent by the client to the intermediary via the secured service.

13. The method of claim 1 wherein the secured service is available for direct authentication by a user without the user establishing an authenticated connection between the user and the intermediary.

14. The method of claim 1 wherein the direct authenticated connection between the client and the secured service is established by leveraging a connection other than the authenticated connection between the client and the intermediary.

15. The method of claim 1 wherein receiving, from the intermediary, constrained authorization information that has been electronically negotiated by the secured service and the intermediary comprises receiving constrained authorization information electronically negotiated by the secured service and the intermediary through an exchange of electronic messages between the secured service and the intermediary.

16. The method of claim 15 wherein receiving constrained authorization information electronically negotiated by the secured service and the intermediary through an exchange of electronic messages between the secured service and the intermediary comprises receiving constrained authorization information generated by the secured service and sent to the intermediary in an electronic message.

17. The method of claim 15 wherein receiving constrained authorization information electronically negotiated by the secured service and the intermediary through an exchange of electronic messages between the secured service and the intermediary comprises receiving constrained authorization information generated by the intermediary, sent to the secured service in an electronic message, and accepted by the secured service.

18. The method of claim 1 wherein receiving, from the intermediary, constrained authorization information that has been electronically negotiated by the secured service and the intermediary comprises receiving constrained authorization information stored by the secured service in electronic storage.

19. The method of claim 18 wherein submitting, by the client, the constrained authorization information to the secured service to establish a direct authenticated connection between the client and the secured service independent of the authenticated connection between the client and the intermediary comprises submitting, by the client, the constrained authorization information to the secured service to establish a direct authenticated connection between the client and the secured service by comparing the constrained authorization information submitted by the client with the constrained authorization information stored by the secured service in electronic storage.

20. The method of claim 1 wherein receiving, from the intermediary, constrained authorization information that has been electronically negotiated by the secured service and the intermediary comprises receiving constrained authorization information and a target connection point.

21. The method of claim 20 wherein submitting, by the client, the constrained authorization information to the secured service to establish a direct authenticated connection between the client and the secured service independent of the authenticated connection between the client and the intermediary comprises submitting, by the client, the constrained authorization information to the secured service at the target connection point.

22. The method of claim 1 wherein the constrained authorization information comprises a constraint that the authorization information has been used no more than a predetermined number of times.

23. The method of claim 1 wherein the constrained authorization information comprises a constraint that the authorization information be received from only the client.

24. A method, performed by an intermediary, of leveraging a connection with a client to provide the client with access to a secured service, the method comprising:

establishing an authenticated connection between a client and an intermediary;

receiving, from the client, a request for access to a secured service that is physically distinct of the intermediary;

electronically negotiating constrained authorization information with the secured service in response to receiving the client request; and

submitting the constrained authorization information to the client to enable the client to submit the constrained authorization information to the secured service to establish a direct authenticated connection between the client and the secured service independent of the authenticated connection between the client and the intermediary.

25. The method of claim 24 wherein establishing the authenticated connection between the client and the intermediary comprises:

receiving, from the client, keystone authentication information at the intermediary; and

sending, to the client, verification of the keystone authentication information.

26. The method of claim 25 wherein receiving, from the client, a request for access to a secured service prompts the intermediary to authenticate itself to the secured service without provision by the client of authentication information duplicative or additional to the keystone information.

27. The method of claim 26 wherein the intermediary is authenticated to the secured service by provision, by the intermediary, of a leveraged authentication based on the keystone authentication.

28. The method of claim 24 wherein the client comprises one or more of a web browser, an e-mail client, a synchronization client, an instant messaging client, a software productivity application, an operating system, and an operating system kernel.

29. The method of claim 24 wherein the intermediary comprises one or more of an instant messaging service, an e-mail service, a login service, an authentication service, an authorization service, a persistent connection service, and a broker service.

30. The method of claim 24 wherein the secured service comprises one or more of an e-mail service, a synchronization service, a print service, a file access service, an instant messaging service, an operating system, an operating system kernel, an authentication service, an authorization service, and a persistent connection service.

31. The method of claim 24 wherein the client request for access to the secured service comprises an explicit request for access by the client.

32. The method of claim 24 wherein the client request for access to the secured service comprises a communication sent by the client to the intermediary via the secured service.

33. The method of claim 24 wherein the secured service is available for direct authentication by a user without the user establishing an authenticated connection between the user and the intermediary.

34. The method of claim 24 wherein the direct authenticated connection between the client and the secured service is established by leveraging a connection other than the authenticated connection between the client and the intermediary.

35. The method of claim 24 wherein electronically negotiating constrained authorization information with the secured service in response to receiving the client request comprises electronically negotiating constrained authorization information through an exchange of electronic messages between the secured service and the intermediary.

36. The method of claim 24 wherein electronically negotiating constrained authorization information through an exchange of electronic messages between the secured service and the intermediary comprises receiving constrained authorization information generated by the secured service in an electronic message.

37. The method of claim 24 wherein electronically negotiating constrained authorization information through an exchange of electronic messages between the secured service and the intermediary comprises generating constrained authorization information, sending the constrained authorization information to the secured service in an electronic message, and receiving an electronic message from the secured service indicating that the secured service has accepted the constrained authorization information.

38. The method of claim 24 wherein electronically negotiating constrained authorization information with the secured service in response to receiving the client request comprises electronically negotiating constrained authorization information stored by the secured service in electronic storage.

39. The method of claim 38 wherein submitting the constrained authorization information to the client to enable the client to submit the constrained authorization information to the secured service to establish a direct authenticated connection between the client and the secured service independent of the authenticated connection between the client and the intermediary comprises submitting the constrained authorization information to the client to enable the client to submit the constrained authorization information to the secured service to establish a direct authenticated connection between the client and the secured service by comparing the constrained authorization information submitted by the client with the constrained authorization information stored by the secured service in electronic storage.

40. The method of claim 24 wherein:

electronically negotiating constrained authorization information with the secured service in response to receiving the client request comprises electronically negotiating constrained authorization information and a target connection point, and

submitting the constrained authorization information to the client to enable the client to submit the constrained authorization information to the secured service to establish a direct authenticated connection between the client and the secured service independent of the authenticated connection between the client and the intermediary comprises submitting the constrained authorization information and the target connection point to the client.

41. The method of claim 40 wherein submitting the constrained authorization information to the client to enable the client to submit the constrained authorization information to the secured service to establish a direct authenticated connection between the client and the secured service independent of the authenticated connection between the client and the intermediary comprises submitting the constrained authorization information to the client to enable the client to submit the constrained authorization information to the secured service at the target connection point.

42. The method of claim 24 wherein the constrained authorization information comprises a constraint that the authorization information be used within a predetermined time.

43. The method of claim 24 wherein the constrained authorization information comprises a constraint that the authorization information has been used no more than a predetermined number of times.

44. The method of claim 24 wherein the constrained authorization information comprises a constraint that the authorization information be received from only the client.

45. A method, performed by a secured service, of allowing a client access based on an authenticated connection between the client and an intermediary, the method comprising:

receiving, at a secured service and from an intermediary that has established an authenticated connection with a client, notification of a request by the client to access the secured service;

electronically negotiating constrained authorization information with the intermediary in response to receiving the notification;

receiving, from the client, the constrained authorization information that has been submitted to the client by the intermediary, and

establishing a direct authenticated connection with the client independent of the authenticated connection between the client and the intermediary based on the received constrained authorization information.

46. The method of claim 45 wherein the client comprises one or more of a web browser, an e-mail client, a synchronization client, an instant messaging client, a software productivity application, an operating system, and an operating system kernel.

47. The method of claim 45 wherein the intermediary comprises one or more of an instant messaging service, an e-mail service, a login service, an authentication service, an authorization service, a persistent connection service, and a broker service.

48. The method of claim 45 wherein the secured service comprises one or more of an e-mail service, a synchronization service, a print service, a file access service, an instant messaging service, an operating system, an operating system kernel, an authentication service, an authorization service, and a persistent connection service.

49. The method of claim 45 wherein the client request for access to the secured service comprises an explicit request for access by the client.

50. The method of claim 45 wherein the client request for access to the secured service comprises a communication sent by the client to the intermediary via the secured service.

51. The method of claim 45 wherein the secured service is available for direct authentication by a user without the user establishing an authenticated connection between the user and the intermediary.

52. The method of claim 45 wherein the direct authenticated connection between the client and the secured service is established by leveraging a connection other than the authenticated connection between the client and the intermediary.

53. The method of claim 45 wherein electronically negotiating constrained authorization information with the intermediary in response to receiving the notification comprises electronically negotiating constrained authorization information through an exchange of electronic messages between the secured service and the intermediary.

54. The method of claim 53 wherein electronically negotiating constrained authorization information through an exchange of electronic messages between the secured service and the intermediary comprises generating constrained authorization information and sending the constrained authorization information to the intermediary in an electronic message.

55. The method of claim 53 wherein electronically negotiating constrained authorization information through an exchange of electronic messages between the secured service and the intermediary comprises receiving an electronic message form the intermediary including constrained authorization information generated by the intermediary, accepting the constrained authorization information, and sending an electronic message to the intermediary indicating that the constrained authorization information has been accepted.

56. The method of claim 45 further comprising storing the electronically negotiated constrained authorization information in electronic storage.

57. The method of claim 56 wherein establishing a direct authenticated connection with the client independent of the authenticated connection between the client and the intermediary based on the received constrained authorization information comprises establishing a direct authenticated connection with the client by comparing the received constrained authorization information with the stored constrained authorization information.

58. The method of claim 45 wherein electronically negotiating constrained authorization information with the intermediary in response to receiving the notification comprises electronically negotiating constrained authorization information and a target connection point.

59. The method of claim 58 wherein receiving, from the client, the constrained authorization information that has been submitted to the client by the intermediary comprises receiving, from the client, the constrained authorization information at the target connection point.

60. The method of claim 45 wherein the constrained authorization information comprises a constraint that the authorization information be used within a predetermined time.

61. The method of claim 45 wherein the constrained authorization information comprises a constraint that the authorization information has been used no more than a predetermined number of times.

62. The method of claim 45 wherein the constrained authorization information comprises a constraint that the authorization information be received from only the client.