Authenticated credential-based multi-tenant access to a service

• US 8,201,231 B2
• Filed: 02/21/2007
• Issued: 06/12/2012
• Est. Priority Date: 02/21/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Williams, Juanya Davon, Badwe, Ashutosh, Edwards, Adam Patrick
• Primary Examiner(s): Flynn, Nathan
• Assistant Examiner(s): Vaughan, Michael R
• Application Number:
  US11/677,332
• Publication Number:
  US 20080201767A1
• Time in Patent Office: 1,938 Days
• Field of Search: None
• US Class Current: 726/7
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

Associating a computing device with a group of other computing devices. A service receives a common credential from the computing device and associates the computing device with the other computing devices also associated with the common credential. The service generates a machine-specific credential for use by the computing device in subsequent communications with the service. The machine-specific credential is used to authenticate, identify, and group the computing device with the other computing devices in the subsequent communications.

Claims

1. A method comprising:

receiving, by a first computing device, a first credential from a second computing device associated with a user and an identifier associated with the second computing device, said received first credential being associated with a plurality of computing devices associated with other users to which the first computing device exposes services and the identifier being calculated based on hardware in the second computing device, wherein the first credential is not unique to the second computing device associated with the user;

associating the second computing device with the plurality of computing devices having the same received first credential, such that associating the second computing device with the plurality of computing devices associates the second computing device and the plurality of computing devices as both devices belonging to a particular account for accessing the exposed services on the first computing device based on a list of preauthorized computing devices and their associated calculated identifiers specified for the particular account;

generating a second credential based on the received first credential and the received calculated identifier, said generated second credential being particular to the second computing device; and

transmitting the generated second credential to the second computing device, wherein the second computing device includes the second credential in subsequent communications with the first computing device for authentication by the first computing device of the second computing device, wherein the first computing device exposes the services particular to the second computing device as a function of the particular account and the association between the second computing device and the plurality of computing devices based on the second credential received in the subsequent communications.

2. The method of claim 1, wherein a list of hardware assets only includes the identifier for each the plurality of computing devices, and wherein associating the second computing device with the plurality of computing devices comprises adding the identifier associated with the second computing device to the list of hardware assets.

3. The method of claim 1, further comprising encrypting the generated second credential prior to transmitting the generated second credential to the second computing device.

4. The method of claim 1, wherein receiving the first credential comprises receiving a request to register a software product from the second computing device, wherein the request comprises the first credential.

5. The method of claim 1, wherein receiving the first credential, associating the second computing device, generating the second credential, and transmitting the generated second credential occur without human intervention.

6. The method of claim 1, further comprising:

issuing the first credential;

including the issued first credential in a software product; and

distributing the software product with the issued first credential to the plurality of computing devices.

7. The method of claim 1, further comprising disabling the first credential whereby the second credential is disabled as a function of the association between the second computing device and the plurality of computing devices.

8. The method of claim 1, wherein the services comprise one or more of the following:

data formats, report types, report frequency, and access to particular servers.

9. The method of claim 1, wherein one or more computer-readable storage devices media have stored thereon computer-executable instructions for performing the steps of receiving, associating, determining, generating and transmitting.

10. A system comprising:

a memory area for storing a first credential; and

a processor configured to execute computer-executable instructions for;

receiving, by the first computing device, the first credential from a second computing device associated with a user and an identifier associated with the second computing device upon registration of a software product by the user on the second computing device, said received first credential being associated with a plurality of computing devices associated with other users to which the first computing device exposes services and the identifier being calculated based on hardware in the second computing device, wherein the first credential is not unique to the second computing device associated with the user, and wherein the first credential represents an account credential associated with a particular account for accessing the exposed services on the first computing device for use with the plurality of computing devices, said particular account indicating that the second computing device and the plurality of computing devices on the account are in a group of authorized computing devices;

associating the second computing device with the plurality of computing devices, wherein associating the second computing device with the plurality of computing devices indicates that the second computing device and the plurality of computing devices belong to the account based on a list of preauthorized computing devices and their associated calculated identifiers specified for the particular account;

generating a second credential based on the received first credential, the received calculated identifier, and a user identifier associated with the user, said generated second credential being particular to the second computing device and particular to the user associated with the second computing device;

generating, particular to the user, an installation package for the generated second credential; and

transmitting the generated second credential and generated installation package to the second computing device, wherein the second computing device executes the installation package to install the second credential on the second computing device, wherein the second computing device includes the second credential in subsequent communications with the first computing device for authentication by the first computing device of the second computing device, wherein the first computing device exposes the services particular to the second computing device as a function of the particular account and the association between the second computing device and the plurality of computing devices based on the second credential received in the subsequent communications.

11. The system of claim 10, wherein the second computing device automatically executes the installation package to install the second credential on the second computing device without human intervention.

12. The system of claim 10, wherein the processor is further configured to execute computer-executable instructions for exposing, to the second computing device, the services particular to the second computing device as a function of the association between the second computing device and the plurality of computing devices.

13. The system of claim 12, wherein the services particular to the second computing device comprise one or more of the following:

data formats, report types, report frequency, and access to particular servers.

14. The system of claim 10, further comprising means for automatically provisioning the second credential as a function of the first credential upon receipt of the first credential from the second computing device.

15. The system of claim 10, wherein the second credential represents an agent credential for use only with the second computing device.

16. The system of claim 10, wherein the processor is configured to execute the computer-executable instructions without human intervention.

17. One or more computer-readable tangible storage media not including a carrier wave or carrier signal having computer-executable components stored thereon, said components comprising:

an interface component for receiving, by a first computing device, a first credential from a second computing device associated with a user and an identifier associated with the second computing device, said received first credential being associated with a plurality of computing devices associated with other users to which the first computing device exposes services and the identifier being calculated based on hardware in the second computing device, wherein the first credential is not unique to the second computing device associated with the user;

a credential component for;

associating the second computing device with the plurality of computing devices having the same received first credential, wherein associating the second computing device with the plurality of computing devices indicates that the second computing device and the plurality of computing devices belong to a particular account for accessing the exposed services on the first computing device based on a list of preauthorized computing devices and their associated calculated identifiers specified for the particular account; and

generating a second credential based on the received first credential and the received calculated identifier, said generated second credential being particular to the second computing device;

a chain component for associating the second credential with the first credential, wherein the first computing device transmits the generated second credential to the second computing device, wherein the second computing device includes the second credential in subsequent communications with the first computing device for authentication by the first computing device of the second computing device; and

a de-authorization component for revoking the first credential which thereby revokes the second credential as a function of the association between the first credential and the second credential to prevent access by the second computing device to the services exposed by the first computing device.

18. The computer-readable storage media not including a carrier wave or carrier signal of claim 17, wherein the chain component enables the first computing device to expose the services to the second computing device as a function of the association between the second computing device and the plurality of computing devices in the list of hardware assets based on the second credential received in the subsequent communications.

19. The computer-readable storage media not including a carrier wave or carrier signal of claim 17, wherein the interface component, the credential component, the chain component, and the de-authorization component execute without human intervention.