Multiple user authentication for online console-based gaming

• US 7,512,235 B2
• Filed: 09/08/2006
• Issued: 03/31/2009
• Est. Priority Date: 03/09/2001
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Chen, Ling Tony, Multerer, Boyd C., Anderson, Darren L.
• Primary Examiner(s): Dada; Beemnet W
• Application Number:
  US11/530,373
• Publication Number:
  US 20070010334A1
• Time in Patent Office: 935 Days
• Field of Search: 380/251, 713/150, 713/168, 713/169, 713/170, 725/138, 726/5, 726/9, 726/10, 463/43
• US Class Current: 380/251
• CPC Class Codes: A63F 13/12 involving interaction between a plurality of game devices, e.g. transmisison or distribution systems protocols for networked virtual reality, networked games H04L29/06034
• CPC Class Codes: A63F 13/30 Interconnection arrangements between game servers and game devices; Interconnection arrangements between game devices; Interconnection arrangements between game servers
• CPC Class Codes: A63F 13/71 using secure communication between game devices and game servers, e.g. by encrypting game data or authenticating players
• CPC Class Codes: A63F 13/843 involving concurrently two or more players on the same game device, e.g. requiring the use of a plurality of controllers or of a specific view of game data for each player
• CPC Class Codes: A63F 2300/401 Secure communication, e.g. using encryption or authentication
• CPC Class Codes: A63F 2300/532 using secure communication, e.g. by encryption, authentication
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807

Abstract

A console-based multi-user authentication process allows multiple users of a game console to be authenticated together in a single request/reply exchange with an authentication entity. The results of which is the possession of a single ticket that can be used to prove authenticity of multiple authentication principals to one or more online services. Also described is a handshake process that can be used to initially establish an authentication account for each game console, in which the account creation server can trust that a genuine game console is making the request.

Claims

1. A computer-readable storage medium for a game console comprising computer-executable instructions that, when executed, direct the game console to:

create multiple validated user identities (U1, H1), (U2, H2), . . . , (UU, HU) composed of the multiple user identities U1, U2, . . . , UU and associated values H1, H2, . . . , HU calculated from each user'"'"'s key;

form a single request containing a game console identity X, a game title identity G, the multiple validated user identities, and an identity A of an online service, as follows;

Request=[X, G, A, (U1, H1), (U2, H2), . . . , (UU, HU)]; and

submit the request to a ticket issuing entity over a network, whereby the ticket issuing entity simultaneously authenticates each of the identities contained in the request.

2. A computer-readable storage medium as recited in claim 1, further comprising computer-executable instructions that, when executed, direct the game console to compute cryptographic hash digests of user keys associated with the multiple users, each user identity being a combination of the user identity and the cryptographic hash digest of an associated user key.

3. A computer-readable storage medium as recited in claim 1, further comprising computer-executable instructions that, when executed, direct the game console to encrypt a time value using keys associated with the multiple user identities, each user identity being a combination of the user identity and the encrypted time value.

4. A computer-readable storage medium as recited in claim 1, further comprising computer-executable instructions that, when executed, direct the game console to form the request to further include at least one of an identity of the game console, a random nonce, or a checksum value to ensure receipt of all contents of the request.

5. A computer-readable storage medium as recited in claim 1, further comprising computer-executable instructions that, when executed, direct the game console to:

receive a ticket from the ticket issuing entity, the ticket containing the game console identity X, the game title identity G, the multiple validated user identities, the online service identity A, and a session key KXA together encrypted with an additional key KA associated with the online service;

receive the session key KXA from the ticket issuing entity; and

pass the ticket from the game console to the online service along with some information encrypted using the session key KXA.

6. A computer-readable storage medium for a game console comprising computer-executable instructions that, when executed, direct the game console to:

create multiple validated user identities composed of multiple user identities and associated values calculated from each user'"'"'s key, wherein the multiple user identities are playing at the same game console;

form a single request containing a game console identity, a game title identity, the multiple user identities, and an identity of an online service; and

submit the request to a ticket issuing entity over a network, whereby the ticket issuing entity simultaneously authenticates each of the identities contained in the request via issuance of one ticket covering all of the multiple user identities.

7. A computer-readable storage medium as recited in claim 6, further comprising computer-executable instructions that, when executed, direct the game console to compute cryptographic hash digests of user keys associated with the multiple users, each user identity being a combination of the user identity and the cryptographic hash digest of an associated user key.

8. A computer-readable storage medium as recited in claim 6, further comprising computer-executable instructions that, when executed, direct the game console to encrypt a time value using keys associated with the multiple user identities, each user identity being a combination of the user identity and the encrypted time value.

9. A computer-readable storage medium as recited in claim 6, further comprising computer-executable instructions that, when executed, direct the game console to form the request to further include at least one of an identity of the game console, a random nonce, or a checksum value to ensure receipt of all contents of the request.

10. A computer-readable storage medium as recited in claim 6, further comprising computer-executable instructions that, when executed, direct the game console to:

receive a ticket from the ticket issuing entity, the ticket containing the game console identity, the game title identity, the multiple validated user identities, the online service identity, and a session key together encrypted with an additional key associated with the online service;

receive the session key from the ticket issuing entity; and

pass the ticket from the game console to the online service along with some information encrypted using the session key.

11. A method implemented via a game console, the method comprising:

creating multiple validated user identities (U1, H1), (U2, H2), . . . , (UU, HU) composed of the multiple user identities U1, U2, . . . , UU and associated values H1, H2, . . . , HU calculated from each user'"'"'s key;

forming a single request containing a game console identity X, a game title identity G, the multiple validated user identities, and an identity A of an online service, as follows;

Request=[X, G, A, (U1, H1), (U2, H2), . . . , (UU, HU)]; and

submitting the request to a ticket issuing entity over a network, whereby the ticket issuing entity simultaneously authenticates each of the identities contained in the request.

12. A method as recited in claim 11, further comprising computing cryptographic hash digests of user keys associated with the multiple users, each user identity being a combination of the user identity and the cryptographic hash digest of an associated user key.

13. A method as recited in claim 11, further comprising encrypting a time value using keys associated with the multiple user identities, each user identity being a combination of the user identity and the encrypted time value.

14. A method as recited in claim 11, further comprising forming the request to further include at least one of an identity of the game console, a random nonce, or a checksum value to ensure receipt of all contents of the request.

15. A method as recited in claim 11, further comprising:

passing a ticket from the game console to the online service along with some information encrypted using a session key KXA;

the passing being responsive to;

receiving the ticket from the ticket issuing entity, the ticket containing the game console identity X, the game title identity G, the multiple validated user identities, the online service identity A, and the session key KXA together encrypted with an additional key KA associated with the online service; and

receiving the session key KXA from the ticket issuing entity.

16. A gaming console configured to implement the method as recited in claim 11.