Leveraging a persistent connection to access a secured service

• US 8,176,541 B1
• Filed: 03/10/2010
• Issued: 05/08/2012
• Est. Priority Date: 04/11/2001
• Status: Expired due to Term

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: AOL Inc. (Apollo Global Management, Inc.)
• Inventors: Hirsh, Robert B.
• Primary Examiner(s): CERVETTI, DAVID GARCIA
• Application Number:
  US12/720,959
• Time in Patent Office: 790 Days
• Field of Search: 726/10, 726/8
• US Class Current: 726/10
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 67/55 Push-based network services

Abstract

Leveraging a persistent connection to provide a client access to a secured service may include establishing a persistent connection with a client in response to a first request from the client, and brokering a connection between the client and a secured service based on a second request from the client by leveraging the persistent connection with the client. The brokering may occur before the client attempts to connect to the secured service directly and the connection may be established between the client and the secured service without provision by the client of authentication information duplicative or additional to authentication information provided by the client to establish the persistent connection.

Claims

1. A method, performed by an intermediary system, of leveraging a persistent connection with a client to provide the client with access to a secured service, the method comprising:

receiving a first request from a client system at an intermediary system, the first request relating to a request for access to the intermediary system;

establishing a persistent connection between the client system and the intermediary system in response to the first request from the client system;

receiving a second request from the client system at the intermediary system, the second request relating to a request for access to a secured service that is physically distinct of the intermediary system;

authenticating the intermediary system to the secured service responsive to the second request; and

brokering a direct authenticated connection between the client system and the secured service based on the authentication of the intermediary system to the secured service, the direct authenticated connection between the client system and the secured service being independent of the persistent connection between the client system and the intermediary system.

2. The method of claim 1 wherein brokering a direct authenticated connection between the client system and the secured service comprises:

receiving, from the secured service, temporary access information that includes a constraint that the temporary access information be used within a predetermined time; and

sending, to the client system, the temporary access information to enable the client system to use the temporary access information within the predetermined time to establish the direct authenticated connection with the secured service.

3. The method of claim 1 wherein brokering a direct authenticated connection between the client system and the secured service comprises:

receiving, from the secured service, temporary access information that includes a target connection point; and

sending, to the client system, the temporary access information to enable the client system to send, to the target connection point, the temporary access information and thereby establish the direct authenticated connection with the secured service.

4. The method of claim 1 wherein brokering a direct authenticated connection between the client system and the secured service comprises:

receiving, from the secured service, temporary access information that includes a constraint that the temporary access information be used no more than a predetermined number of times; and

sending, to the client system, the temporary access information to enable the client system to use the temporary access information to establish the direct authenticated connection with the secured service.

5. The method of claim 1 wherein brokering a direct authenticated connection between the client system and the secured service comprises:

receiving, from the secured service, temporary access information that includes a constraint that the authorization information be received from only the client system; and

sending, to the client system, the temporary access information to enable the client system to use the temporary access information to establish the direct authenticated connection with the secured service.

6. The method of claim 1 wherein brokering a direct authenticated connection between the client system and the secured service comprises:

receiving, from the secured service, a temporary password; and

sending, to the client system, the temporary password to enable the client system to use the temporary password to establish the direct authenticated connection with the secured service.

7. The method of claim 1 wherein brokering a direct authenticated connection between the client system and the secured service comprises:

receiving, from the secured service, temporary access information issued by the secured service; and

sending, to the client system, the temporary access information to enable the client system to use the temporary access information to establish the direct authenticated connection with the secured service.

8. The method of claim 1 wherein brokering a direct authenticated connection between the client system and the secured service comprises:

sending, to the secured service, proposed temporary access information; and

receiving, from the secured service, an acceptance of the proposed temporary access information.

9. The method of claim 8 wherein brokering a direct authenticated connection between the client system and the secured service further comprises sending, to the client system, the proposed temporary access information accepted by the secured service to enable the client system to use the proposed temporary access information accepted by the secured service to establish the direct authenticated connection with the secured service.

10. The method of claim 1 wherein the secured service is available for direct authentication by the client system without the client system establishing the persistent connection between the client system and the intermediary system.

11. A method, performed by a client system, of establishing a connection with a secured service, the method comprising:

sending, to an intermediary system from a client system, a first request for access to the intermediary system;

establishing a persistent connection with the intermediary system in response to the first request from the client system;

sending, to the intermediary system from the client system, a second request for access to a secured service that is physically distinct of the intermediary system; and

establishing a direct authenticated connection with the secured service based on an authentication of the intermediary system to the secured service, the direct authenticated connection with the secured service being independent of the persistent connection with the intermediary system.

12. The method of claim 11 wherein establishing a direct authenticated connection with the secured service comprises:

receiving, from the intermediary system, temporary access information that includes a constraint that the temporary access information be used within a predetermined time; and

sending, to the secured service, the temporary access information within the predetermined time to establish the direct authenticated connection with the secured service.

13. The method of claim 11 wherein establishing a direct authenticated connection with the secured service comprises:

receiving, from the intermediary system, temporary access information that includes a target connection point; and

sending, to the secured service at the target connection point, the temporary access information to establish the direct authenticated connection with the secured service.

14. The method of claim 11 wherein establishing a direct authenticated connection with the secured service comprises:

receiving, from the intermediary system, temporary access information that includes a constraint that the temporary access information be used no more than a predetermined number of times; and

sending, to the secured service, the temporary access information to establish the direct authenticated connection with the secured service.

15. The method of claim 11 wherein establishing a direct authenticated connection with the secured service comprises:

receiving, from the intermediary system, temporary access information that includes a constraint that the authorization information be received from only the client system; and

sending, to the secured service, the temporary access information to establish the direct authenticated connection with the secured service.

16. The method of claim 11 wherein establishing a direct authenticated connection with the secured service comprises:

receiving, from the intermediary system, a temporary password; and

sending, to the secured service, the temporary password to establish the direct authenticated connection with the secured service.

17. The method of claim 11 wherein establishing a direct authenticated connection with the secured service comprises:

receiving, from the intermediary system, temporary access information issued by the secured service; and

sending, to the secured service, the temporary access information issued by the secured service to establish the direct authenticated connection with the secured service.

18. The method of claim 11 wherein the secured service is available for direct authentication by the client system without the client system establishing the persistent connection with the intermediary system.

19. An intermediary system comprising:

at least one computer; and

at least one computer-readable medium coupled to the at least one computer having instructions stored thereon which, when executed by the at least one computer, causes the at least one computer to perform operations comprising;

receiving a first request from a client system, the first request relating to a request for access to the intermediary system;

establishing a persistent connection with the client system in response to the first request from the client system;

receiving a second request from the client system, the second request relating to a request for access to a secured service that is physically distinct of the intermediary system;

authenticating the intermediary system to the secured service responsive to the second request; and

brokering a direct authenticated connection between the client system and the secured service based on the authentication of the intermediary system to the secured service, the direct authenticated connection between the client system and the secured service being independent of the persistent connection between the client system and the intermediary system.

20. The intermediary system of claim 19 wherein the secured service is available for direct authentication by the client system without the client system establishing the persistent connection between the client system and the intermediary system.