Fast-reconnection of negotiable authentication network clients

• US 8,555,069 B2
• Filed: 03/06/2009
• Issued: 10/08/2013
• Est. Priority Date: 03/06/2009
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Zhu, Liqiang, Leach, Paul J., Damour, Kevin Thomas, McPherson, David, Dutta, Tanmoy
• Primary Examiner(s): McNally, Michael S
• Application Number:
  US12/399,615
• Publication Number:
  US 20100228982A1
• Time in Patent Office: 1,677 Days
• Field of Search: 713/175, 726/2, 726/7, 726/12
• US Class Current: 713/175
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04W 12/062 Pre-authentication

Abstract

Modern network communications often require a client application requesting data to authenticate itself to an application providing the data. Such authentication requests can be redundant, especially in the case of stateless network protocols. When a full authentication is performed, a conversation identifier and one or more encryption keys can be agreed upon. Subsequent authentication requests can be answered with a fast reconnect token comprising the conversation identifier and a cryptographically signed version of it using the one or more encryption keys. Should additional security be desirable, a sequence number can be established and incremented in a pre-determined or a random manner to enable detection of replayed fast reconnect tokens. If the recipient can verify the fast reconnect token, the provider can be considered to have been authenticated based on the prior authentication. If an aspect of the fast re-authentication should fail, recourse can be had to the original full authentication process.

Claims

1. One or more computer-readable memory comprising computer-executable instructions for accelerating subsequent authentications of a client application program to a server application program, the computer-executable instructions directed to steps comprising:

performing an initial authentication of a client application program executing on a client computing device executing the computer-executable instructions to a server application program executing on a server computing device remote from the client computing device, the initial authentication comprising agreeing on a fast reconnect mechanism for subsequent authentications within a single conversation, the single conversation comprising the initial authentication, the agreeing on the fast reconnect mechanism comprising both the client computing device and the server computing device selecting a same identifier of the single conversation and a same set of one or more encryption keys;

receiving, from the client application program, within the single conversation, a request to subsequently authenticate the client application program to the server application program;

cryptographically signing, at the client computing device, the identifier of the single conversation using at least one encryption key from among the set of one or more encryption keys; and

providing the identifier and the cryptographically signed identifier together to the server computing device in response to the receiving the request.

2. The computer-readable memory of claim 1, further comprising computer-executable instructions for obtaining a sequence number utilized for an immediately preceding communication within the single conversation;

and incrementing the sequence number;

wherein the computer-executable instructions for providing the identifier and the cryptographically signed identifier together to the server computing device further comprise computer-executable instructions for providing the identifier, cryptographically signed identifier and the incremented sequence number to the server computing device in response request.

3. The computer-readable memory of claim 2, wherein the computer-executable instructions for performing the initial authentication further comprise computer-executable instructions for agreeing upon a formula for incrementing the sequence number;

and wherein further the incrementing the sequence number is performed in accordance with the formula.

4. One or more computer-readable memory comprising computer-executable instructions for accelerating subsequent authentications of a client application program to a server application program, the computer-executable instructions directed to steps comprising:

performing an initial authentication of a client application program executing on a client computing device executing the computer-readable instructions to a server application program executing on a server computing device remote from the client computing device, the initial authentication comprising agreeing on a fast reconnect mechanism for subsequent authentications within a single conversation, the single conversation comprising the initial authentication, the agreeing on the fast reconnect mechanism comprising both the client computing device and the server computing device selecting a same identities of the single conversation and a same set of one or more encryption keys

receiving, from the client application program, a received identifier and a received signed identifier together, both provided to the server application program, by the client application program, to subsequently authenticate the client application program to the server application program;

obtaining at least one encryption key from among the set of one or more encryption keys that are associated with the received identifier, the received identifier purporting to identify the single conversation within which the subsequent authentication is being performed;

verifying, at the server computing device, the received cryptographically signed identifier using the obtained at least one encryption key;

requesting a full authentication if the received cryptographically signed identifier was not verified; and

generating an authentication of the client application program to the server application program if the cryptographically signed identifier was verified, the verification proving that the client application program is a same client application program that was initially authenticated within the same conversation.

5. The computer-readable memory of claim 4, further comprising computer-executable instructions for determining if an elapsed time since the previous authentication exceeds a predetermined threshold;

wherein the computer-executable instructions for requesting the full authentication comprise computer-executable instructions for requesting the full authentication if either the cryptographically signed identifier of the conversation was not verified using the obtained one or more encryption keys or if the elapsed time since the previous authentication exceeds the predetermined threshold; and

wherein further the computer-executable instructions for generating the authentication of the client application program to the server application program comprise computer-executable instructions for generating the authentication of the client application program to the server application program if both the cryptographically signed identifier of the conversation was verified using the obtained one or more encryption keys and if the elapsed time since the previous authentication does not exceed the predetermined threshold.

6. The computer-readable memory of claim 4, further comprising computer-executable instructions for determining if a communicational connection between the client application program and the server application program was interrupted;

wherein the computer-executable instructions for requesting the full authentication comprise computer-executable instructions for requesting the full authentication if either the received cryptographically signed identifier of the conversation was not verified or if the communicational connection was interrupted; and

wherein further the computer-executable instructions for generating the authentication of the client application program to the server application program comprise computer-executable instructions for generating the authentication of the client application program to the server application program if both the received cryptographically signed identifier of the conversation was verified and if the communicational connection was not interrupted.

7. The computer-readable memory of claim 4, wherein the receiving and the generating are performed through a pre-existing, standardized interface.

8. The computer-readable memory of claim 4, further comprising computer-executable instructions for receiving an incremented sequence number from the client application program;

comparing the incremented sequence number to a sequence number utilized for an immediately preceding communication; and

determining if the incremented sequence number is appropriate based on the comparing;

wherein the computer-executable instructions for requesting the full authentication comprise computer-executable instructions for requesting the full authentication if the received cryptographically signed identifier of the conversation was not verified, or if the determining determined that the incremented sequence number is not appropriate; and

wherein further the computer-executable instructions for generating the authentication of the client application program to the server application program comprise computer-executable instructions for generating the authentication of the client application program to the server application program if both the cryptographically signed identifier of the conversation was verified and if the determining determined that the incremented sequence number is appropriate.

9. The computer-readable memory of claim 8, wherein the computer-executable instructions for determining if the incremented sequence number is appropriate comprise computer-executable instructions for determining that the incremented sequence is appropriate if the comparing indicates that the incremented sequence number is appropriately greater than a sequence number utilized for the immediately preceding communication.

10. The computer-readable memory of claim 8, wherein the computer-executable instructions for performing the initial authentication further comprise computer-executable instructions for agreeing upon a formula for incrementing the sequence number;

and wherein further the computer-executable instructions for comparing the incremented sequence number to the sequence number utilized for the immediately preceding communication comprise computer-executable instructions for independently generating another incremented sequence number from the sequence number utilized for the immediately preceding communication based on the agreed upon formula, and comparing the other incremented sequence number to the incremented sequence number; and

wherein still further the computer-executable instructions for determining if the incremented sequence number is appropriate comprise computer-executable instructions for determining that the incremented sequence is appropriate if the other incremented sequence number is equivalent to the incremented sequence number.

11. A system for reducing authentication overhead in network communications comprising:

a client computing device comprising;

a client application program, a client security package performing a full authentication of the client application program to a server application program and agreeing on a fast reconnect mechanism for subsequent authentications within a single conversation, the single conversation comprising the full authentication, and a client fast reconnect component associated with the agreed-upon fast reconnect mechanism, the client fast reconnect component selecting, in combination with server fast connect component, a same identifier of the single conversation and a same of one or more encryption keys, the client fast reconnect component generating, on the client computing device, using at least one encryption key from among the same set of one or more encryption keys, a cryptographic signature of the same identifier of the single conversation for each subsequent communication that requires authentication within the singe conversation between the client application program and the server application program; and

a server computing device communicationally coupled to the client computing device, the server computing device comprising;

the server application program, a server security package for performing the full authentication of the client application program to the server application program, and the server fast reconnect component selecting, in combination with the client fast reconnect component, the same identifier of the single conversation and the same set of one or more encryption keys, the server fast reconnect component validating, on the server computing device, the cryptographic signature of the same identifier of the same conversation that was generated by the client fast reconnect component for each subsequent communication within the single conversation between the client application program and the server application program that requires authentication of the client application program to the server application program.

12. The system of claim 11, wherein the client fast reconnect component is an extension to a client security package negotiation component and wherein the server fast reconnect component is an extension to a server security package negotiation component.

13. The system of claim 11, wherein the cryptographic signature of the identifier of the single conversation is generated by the client fast reconnect component using one or more encryption keys agreed upon with the server fast reconnect component as part of the full authentication;

and wherein further the validating the cryptographic signature of the same identifier of the single conversation comprises using at least one of the same set of one or more encryption keys.

14. The system of claim 11, wherein the client fast reconnect component further generates on the client computing device, an incremented sequence number from an immediately preceding sequence number;

and wherein further the server fast reconnect component validates, on the server computing device, the generated incremented sequence number if the generated incremented sequence number is appropriate.

15. The system of claim 14, wherein the incremented sequence number is generated by the client fast reconnect component in accordance with a formula agreed upon with the server fast reconnect component;

and wherein further the determining, by the server fast reconnect component, if the incremented sequence number is appropriate is performed with reference to the agreed upon formula.

16. The system of claim 11, wherein the server fast reconnect component requires another full authentication of the client application program to the server application program if the server fast reconnect component does not validate the cryptographic signature of the same identifier of the single conversation.