Brokering a connection to access a secured service

• US 8,769,645 B2
• Filed: 09/15/2012
• Issued: 07/01/2014
• Est. Priority Date: 04/11/2001
• Status: Expired due to Term

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Inventors: Hirsh, Robert Bruce
• Primary Examiner(s): Cervetti, David Garcia
• Application Number:
  US13/620,822
• Publication Number:
  US 20130174226A1
• Time in Patent Office: 654 Days
• Field of Search: 726/3, 726/4, 726/6, 726 10- 12
• US Class Current: 726/6
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 67/55 Push-based network services

Abstract

Leveraging a persistent connection to provide a client access to a secured service may include establishing a persistent connection with a client in response to a first request from the client, and brokering a connection between the client and a secured service based on a second request from the client by leveraging the persistent connection with the client. The brokering may occur before the client attempts to connect to the secured service directly and the connection may be established between the client and the secured service without provision by the client of authentication information duplicative or additional to authentication information provided by the client to establish the persistent connection.

Claims

1. A method, comprising:

sending, to a server, a first request to connect with a secured service that is separate from the server;

receiving, from the server, negotiated authorization information generated by the secured service;

generating, using at least one processor, a second request to connect with the secured service, the second request to connect comprising the negotiated authorization information generated by the secured service;

sending the second request to connect to the secured service; and

synchronizing local data with remote data stored by the secured service.

2. The method as recited in claim 1, further comprising establishing a persistent connection with the server.

3. The method as recited in claim 1, further comprising receiving, from the server, a target connection point to the secured service, wherein the second request to connect to the secured service is sent to the target connection point.

4. The method as recited in claim 3, wherein the target connection point comprises an Internet Protocol address.

5. The method as recited in claim 1, further comprising selecting the secured service from a plurality of acceptable secured services.

6. The method as recited in claim 5, further comprising validating the negotiated authorization information for one of a predetermined number of uses.

7. The method as recited in claim 5, further comprising validating the negotiated authorization information within a predetermined time window.

8. The method as recited in claim 1, further comprising determining whether the negotiated authorization information satisfies a connection constraint.

9. The method as recited in claim 8, wherein the connection constraint comprises at least one of a password, a timestamp, a screen name, a login name, a biometric signature, or a digital signature.

10. A method, comprising:

receiving, at a secured service, first authentication information from a client, the first authentication information used to temporarily authenticate the client with the secured service;

receiving, at the secured service, a request from the client for second authentication information from the secured service, the second authentication information used to enable the client to access a resource of the secured service;

generating, using at least one processor, the second authentication information at the secured service based on a determination by the secured service that the client is authorized to access the resource of the secured service;

sending the second authentication information from the secured service to the client;

receiving, at the secured service, a request from the client for the resource of the secured service, the request comprising the second authentication information; and

providing the client with access to the resource of the secured service.

11. The method as recited in claim 10, further comprising requesting, in response to receiving the first authentication information from the client, that a user authenticate with the secured service in order to authorize the client to access the resource of the secured service.

12. The method as recited in claim 11, further comprising:

providing the user with an indication of the client;

providing the user with an indication of the resource of the secured service; and

prompting the user to authorize the client to access the resource of the secured service.

13. The method as recited in claim 10, wherein the resource of the secured service comprises a file associated with a user that has an account with the secured service.

14. The method as recited in claim 10, wherein providing the client with access to the resource of the secured service comprises sending the resource of the secured service to the client.

15. The method as recited in claim 10, further comprising sending the first authentication information to the client.

16. The method as recited in claim 15, further comprising determining that the second authentication information has been used for less than or equal to a predetermined number of uses.

17. The method as recited in claim 15, further comprising determining that the second authentication information has been used during a predetermined time window.

18. The method as recited in claim 10, further comprising synchronizing the resource of the secured service with the client.

19. The method as recited in claim 10, further comprising:

determining that the second authentication information is invalid; and

sending, to the client, a request to reauthenticate with the secured service.

20. The method as recited in claim 19, wherein the secured service comprises one or more of an e-mail service, a synchronization service, a print service, a file access service, an instant messaging service, an operating system, an operating system kernel, an authentication service, an authorization service, and a persistent connection service.