Adaptive HTTP authentication scheme selection

• US 8,347,356 B2
• Filed: 03/31/2009
• Issued: 01/01/2013
• Est. Priority Date: 03/31/2009
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: James, Richard Keith, Silvera, Jonathan
• Primary Examiner(s): LEMMA, SAMSON B
• Application Number:
  US12/415,817
• Publication Number:
  US 20100251345A1
• Time in Patent Office: 1,372 Days
• Field of Search: 726/3, 726/4, 726/5, 726/6, 713/168, 713/160, 713/161, 709/203, 709/227, 709/229
• US Class Current: 726/3
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24

Abstract

A method is presented for selecting an HTTP authentication scheme at a client computer. A request message is sent from the client computer to a server computer to access information on the server computer. In response, the client computer receives a response message from the server computer. The response message includes an HTTP header that includes a first scheme identifier, indicating a first HTTP authentication scheme and a second scheme identifier, indicating a second HTTP authentication scheme. If the client computer does not support the second HTTP authentication scheme, the client computer uses the first HTTP authentication scheme when sending another HTTP message to the server computer. If the client computer supports the second HTTP authentication scheme, the client computer uses the second HTTP authentication scheme when sending another HTTP message to the server computer.

Claims

1. A method for selecting a Hypertext Transfer Protocol (HTTP) authentication scheme at a client computer, the method comprising:

sending a first request message from the client computer to a server computer, the first request message requesting information stored on the server computer;

receiving an HTTP response message from the server computer, the response message including an HTTP header with a first scheme identifier and a second scheme identifier, the first scheme identifier indicating a first HTTP authentication scheme and the second scheme identifier indicating a second HTTP authentication scheme;

determining whether the client computer supports the second HTTP authentication scheme;

in response to determining that the client computer does not support the second HTTP authentication scheme, selecting the first HTTP authentication scheme and sending an HTTP message to the server computer using the first HTTP authentication scheme; and

in response to determining that the client computer does support the second HTTP authentication scheme, selecting the second HTTP authentication scheme and sending an HTTP message to the server computer using the second HTTP authentication scheme, wherein the first scheme identifier indicates a Negotiate HTTP authentication scheme and the second scheme identifier indicates a Nego2 HTTP authentication scheme.

2. The method of claim 1, wherein the HTTP header further includes a data block immediately following the second scheme identifier in the response message.

3. The method of claim 2, further comprising processing the data block at the client computer when the client computer supports the second HTTP authentication scheme.

4. The method of claim 3, further comprising obtaining, at the client computer, authentication policy information from the data block, the authentication policy information including one or more names of authentication protocols that the server computer accepts.

5. The method of claim 1, wherein sending an HTTP message to the server computer using the first HTTP authentication scheme further comprises including a data block following the first scheme identifier.

6. The method of claim 1, wherein sending an HTTP message to the server computer using the second HTTP authentication scheme further comprises including a data block following the second scheme identifier.

7. The method of claim 1, further comprising in response determining that the client computer does not support the second HTTP authentication scheme, determining whether first HTTP authentication scheme or the second HTTP authentication scheme is the Negotiate HTTP authentication scheme.

8. The method of claim 1, further comprising in response determining that the client computer does support the second HTTP authentication scheme, determining whether the second HTTP authentication scheme is the Nego2 HTTP authentication scheme.

9. A server computer comprising:

a processing unit; and

a computer-readable data storage medium, the a computer-readable data storage medium comprising instructions that when executed by the processing unit cause the server computer to;

receive a first request message from a client computer, the first request message requesting information stored on the server computer;

in response to receiving the first request message from the client computer, send a first response message to the client computer, the first response message including an HTTP header, the HTTP header including a first scheme identifier and a second scheme identifier, the first scheme identifier indicating a first HTTP authentication scheme and the second scheme identifier indicating a second HTTP authentication scheme;

receive a second request message from the client computer;

in response to receiving the second request message from the client computer, determine whether the second request message includes the second scheme identifier;

in response to determining the second request message includes the second scheme identifier, send a second response message to the client computer, the second response message including the second scheme identifier; and

in response to determining that the second request message does not include the second scheme identifier, send a second response message to the client computer, the second response message including the first scheme identifier, wherein the first scheme identifier indicates a Negotiate HTTP authentication scheme and the second scheme identifier indicates a Nego2 HTTP authentication scheme.

10. The server computer of claim 9, wherein the HTTP header further includes a data block immediately following the second scheme identifier in the first response message, the data block including authentication policy information.

11. The server computer of claim 10, wherein the data block identifies one or more authentication protocols that the server computer accepts.

12. The server computer of claim 9, wherein the second request message further includes a data block immediately following the second scheme identifier in the second request message.

13. The server computer of claim 12, further comprising instructions that when executed by the processing unit cause the server computer to use the data block to identify authentication protocols supported by the client computer.

14. The server computer of claim 9, further comprising instructions that when executed by the processing unit cause the server computer to include in the second response message a data block immediately following the second scheme identifier in the second response message when the determination is made that the second request message includes the second scheme identifier.

15. The server computer of claim 14, further comprising instructions that when executed by the processing unit cause the server computer to include authentication policy information in the data block.

16. The server computer of claim 9, further comprising instructions that when executed by the processing unit cause the server computer to include in the second response message a data block immediately following the first scheme identifier in the second response message when the determination is made that the second request message includes the first scheme identifier.

17. The server computer of claim 16, further comprising instructions that when executed by the processing unit cause the server computer to include authentication policy information in the data block.

18. A computer-readable data storage medium not consisting of a propagated data signal, the computer-readable data storage medium comprising instructions that, when executed by a processing unit of a server computer, cause the server computer to:

receive a first request message from a client computer, the first request message requesting information stored on the server computer;

in response to the first request message, send a reply message to the client computer, the reply message including an HTTP header, the HTTP header including a first scheme identifier and a second scheme identifier, the first scheme identifier being “

Negotiate” and

the second scheme identifier being “

Nego2”

, the reply message also including a first data block following the second scheme identifier, the first data block including one or more identifiers of authentication protocols that the server computer accepts;

receive a second request message from the client computer, the second request message including a second HTTP header, the second HTTP header including a third scheme identifier;

determine whether the third scheme identifier matches the first scheme identifier;

in response to determining that the third scheme identifier matches the first scheme identifier, select an HTTP authentication scheme indicated by the first scheme identifier;

determine whether the third scheme identifier matches the second scheme identifier;

in response to determining that the third scheme identifier matches the second scheme identifier, select an HTTP authentication scheme indicated by the second scheme identifier;

in response to determining that the third scheme identifier matches the second scheme identifier, identify a client-accepted authentication protocol by processing a second data block included in the second request message, the client-accepted authentication protocol being an authentication protocol accepted by the client computer; and

use the client-accepted authentication protocol to authenticate the client computer at the server computer.