Self-describing authorization policy for accessing cloud-based resources

• US 8,196,175 B2
• Filed: 03/05/2008
• Issued: 06/05/2012
• Est. Priority Date: 03/05/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Reed, David R., Fleischman, Eric S., Gbadegesin, Abolade, Shukla, Dharma, Smolyanskiy, Nikolay, Galvin, Thomas A.
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Getachew, Abiy
• Application Number:
  US12/042,637
• Publication Number:
  US 20090228950A1
• Time in Patent Office: 1,553 Days
• Field of Search: 726/2, 726/3, 726/4, 726/10, 709/219
• US Class Current: 726/1
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A ticketing system adapted for use with a cloud-based services platform is provided by a ticket-based authorization model in which the authorization requirements for traversing one or more meshes of resources associated with a cloud service are annotated in links included in a resource that refer to other resources. The meshes are thus self-describing with respect to the association among the resources (i.e., the links) as well as the authorization required to access resources. Resource access requires a principal ticket which asserts that a caller at a client (e.g., a security principal representing a device or identity associated with a user) is authenticated, plus zero or more claim tickets. The claim tickets make additional assertions about the caller that the cloud service may use to check that the caller is authorized to access the resource.

Claims

1. A method for implementing a self-describing authorization policy for resources provided by a cloud service, the method comprising:

exposing resources provided by the cloud service as one of a plurality of resource meshes, each resource mesh including a plurality of resources that require authenticating credentials associated with a particular client device to access the resources;

providing a principal ticket including a link to a particular resource in a mesh and credentials for authenticating a client device to the particular resource in the mesh associated with the client device to permit the client device to access the resource;

annotating the link to the particular resource with authorization credentials required by at least one other resource in the resource mesh associated with the particular client device to permit the client device to access the other resource, the authorization credentials for the other resource comprising a claim ticket containing at least one assertion providing access to the other resource; and

accessing the particular resource by using the principal ticket included in the link to the particular resource, the link being annotated with at least one claim ticket required by another resource to permit the client device to directly access the other resource when accessing the particular resource.

2. The method of claim 1 in which the annotating includes expressing the credentials by including a URI for a claim ticket as an attribute on the link.

3. The method of claim 2 further including providing an inline value of the claim ticket as an attribute on the link.

4. The method of claim 3 in which at least one resource mesh includes at least one resource that does not require a claim ticket.

5. The method of claim 4 further including permitting access to a resource with only the principal ticket when the resource does not require a claim ticket to access another resource.

6. The method of claim 5 in which plural client devices comprise a single identity authenticated by the same principal ticket.

7. The method of claim 6 in which principal tickets and claim tickets are signed by an authority and are each expressed using SAML.

8. The method of claim 7 in which the authority is an owner or member of the resources associated with the principal tickets and claim tickets.

9. The method of claim 1 in which at least one resource included in at least two resource meshes can be accessed by a plurality of different client devices having different authenticating credentials.

10. A computer-readable medium not comprising a propagated signal and containing instructions which, when implemented by one or more processors disposed in an electronic device, implements a client device for navigating between resources provided by a cloud service as one of a plurality of resource meshes, each resource mesh including a plurality of resources that require authenticating credentials associated with a particular client to access the resources, wherein the instructions provide a runtime for accessing a particular resource in a resource mesh associated with the client device by using an attribute of the particular resource and for checking the attribute to determine if the particular resource requires access to another resource in the mesh, the runtime comprising a ticket manager configured for:

checking a ticket cache associated with the ticket manager to determine the availability in the ticket cache of a claim ticket with authorization credentials required for the client device to access the other resource in the resource mesh,

if the claim ticket is not available in the cache, fetching the claim ticket from a ticket resource handler provided by the cloud service using an attribute in a link to the particular resource, and

storing the fetched claim ticket in the ticket cache, wherein the runtime is configured to obtain from the cloud service a principal ticket usable by the runtime for authenticating the particular client device to access the particular resource, wherein the principal ticket includes a link to the particular resource and the ticket manager annotates the link with the claim ticket required by the other resource.

11. The computer-readable medium of claim 10 in which the runtime is a mesh operating environment runtime, and the ticket manager and the mesh operating environment runtime are instantiated in one of a client device operated by a user and a platform in the cloud.

12. The computer-readable medium of claim 11 in which the cached claim tickets are identified by URI.

13. The computer-readable medium of claim 12 in which the principal ticket and specified claim tickets populate an HTTP authorization header.

14. The computer-readable medium of claim 13 in which the runtime performs HTTP CRUD operations on the particular resource through a resource handler.

15. The computer-readable medium of claim 14 in which the attribute includes a URI where the client can retrieve a list of claim tickets.

16. The computer-readable medium of claim 15 in which the attribute includes claim ticket values that are usable for accessing the other resource.

17. The method of claim 12 in which claim tickets include expiration information and access to other resources is denied when a received claim ticket is expired.

18. The method of claim 17 in which the client device is selected from one of a thick client having resident thereon a ticket manager for interacting with the resource mesh for fetching tickets and a thin client having resident thereon an application for fetching tickets using a remote mesh operating environment runtime.

19. The method of claim 18 further including a plurality of resource meshes, each including a plurality of resources, wherein at least one claim ticket is specified by the URI for a common resource located in more than one mesh and access is provided to the common resource by different client devices having different authentication credentials associated with each mesh by respective principal tickets using peer connectivity.

20. The computer-readable medium of claim 10 in which the runtime obtains a principal ticket from an account service by presenting thereto authenticating credentials of the particular client device.