Protecting user credentials using an intermediary component

• US 8,984,597 B2
• Filed: 05/27/2010
• Issued: 03/17/2015
• Est. Priority Date: 05/27/2010
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Hatlelid, Kristjan E., Barbour, Marc R., Nystrm, Magnus Bo Gustaf
• Primary Examiner(s): Hoffman, Brandon
• Assistant Examiner(s): Anderson, Michael D
• Application Number:
  US12/789,160
• Publication Number:
  US 20110296510A1
• Time in Patent Office: 1,755 Days
• Field of Search: 726/5, 726/8, 713/176
• US Class Current: 726/5
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6263 during internet communication, e.g. revealing personal data from cookies
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 67/142 Managing session states for stateless protocols; Signalling session states; State transitions; Keeping-state mechanisms
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

An access component sends an access request to an intermediary component, the access request being a request to access a service or resource without credentials of a current user of the intermediary component being revealed to the access component. The intermediary component obtains user credentials, for the current user, that are associated with the service or resource. The access request and the user credentials are sent to the service or resource, and in response session state information is received from the service or resource. The session state information is returned to the access component, which allows the access component and the service or resource to communicate with one another based on the session state information and independently of the first component.

Claims

1. A method implemented by an intermediary component, the method comprising:

receiving, by the intermediary component and from an access component, a first request to access a service or resource without user credentials of a current user of the access component being revealed to the access component;

receiving, by the intermediary component, the user credentials of the current user of the access component, the intermediary component comprising a user credential management module and a user authentication module;

obtaining, by the intermediary component and in response to the first request, the user credentials for the current user, wherein the user credentials are associated with the service or resource, and the user credentials are managed by the user credential management module;

identifying, by the user authentication module, the user credentials to provide to the service;

sending, by the user authentication module of the intermediary component and to the service or resource, both a second request to access the service or resource and the user credentials;

receiving, by the intermediary component and in response to the second request, session state information from the service or resource; and

returning, by the intermediary component, the session state information to the access component so that the access component and the service or resource can communicate with each other independently of the intermediary component.

2. A method as recited in claim 1, wherein the session state information allows the access component and the service or resource to communicate with one another without the user credentials being revealed to the access component.

3. A method as recited in claim 1, further comprising:

checking whether a user authorization to send the user credentials to the service or resource is received at the intermediary component; and

sending the user credentials to the service or resource only if the user authorization to send the user credentials to the service or resource is received at the intermediary component, otherwise returning an indication to the access component that the first request is denied.

4. A method as recited in claim 1, further comprising:

checking a user credential store of the intermediary component to determine whether user credentials associated with the service or resource are present in the user credential store; and

sending the user credentials to the service or resource only if user credentials associated with the service or resource are present in the user credential store, otherwise returning an indication to the access component that the first request is denied.

5. A method as recited in claim 4, wherein the user credential store is implemented as part of the intermediary component.

6. A method as recited in claim 1, wherein the user credentials were previously stored, in a user credential store of the intermediary component, as associated with the service or resource prior to receiving the first request.

7. A method as recited in claim 1, further comprising:

saving the session state information at the intermediary component;

receiving, from the access component, a third request to access the service or resource without the credentials of the current user of the access component being revealed to the access component;

retrieving the saved session state information; and

returning the retrieved session state information to the access component.

8. A method as recited in claim 1, further comprising:

saving the session state information at the intermediary component;

receiving, from a third component, a third request to access the service or resource without the credentials of the current user being revealed to the third component, wherein the third component and the access component are two different components;

retrieving the saved session state information; and

returning the retrieved session state information to the third component, wherein the returned session state information allows the third component and the service or resource to communicate with each other independently of the intermediary component.

9. A method as recited in claim 1, wherein the service or resource comprises a Web site.

10. A method as recited in claim 1, wherein the session state information comprises a cookie.

11. A method as recited in claim 1, wherein the session state information comprises a secure socket layer (SSL) session state or a transport layer security (TLS) session state.

12. A method as recited in claim 1, wherein the intermediary component, the access component, and the service or resource are each implemented by different computing devices.

20. A method as recited in claim 1, wherein the access component is implemented on a separate device from the intermediary component, the method further comprising:

displaying, at the intermediary component, a user interface identifying the service or resource and prompting the current user to authorize sending of the user credentials to the service or resource, the service or resource being implemented on a separate device from the access and intermediary components;

if the current user does not authorize sending of the user credentials to the service or resource then denying the first request; and

if the current user does authorize sending of the user credentials to the service or resource then performing the sending, the receiving the session state information, and the returning the session state information to the access component.

13. A method implemented by an access component, the method comprising:

receiving, by the access component, a first request from a user of the access component to access a service or resource without user credentials of the user being revealed to the access component;

sending, by the access component, to an intermediary component and in response to the first request, a second request to access the service or resource based on the user credentials for the user, the intermediary component comprising a user credential management module configured to manage the user credentials, a user authentication module, and an I/O module configured to receive the user credentials via user input to the intermediary component;

receiving, by the access component, from the user authentication module of the intermediary component and in response to the second request, session state information received by the intermediary component from the service or resource; and

communicating, by the access component and using the session state information, with the service or resource.

14. A method as recited in claim 13, wherein the second request includes an indication of the service or resource.

15. A method as recited in claim 13, wherein the session state information allows the access component and the service or resource to communicate with one another without the user credentials being revealed to the access component.

16. A method as recited in claim 15, wherein the session state information comprises a cookie.

17. A method as recited in claim 13, further comprising receiving the session state information and communicating with the service or resource using the session state information only if both the user credentials associated with the service or resource are present in a user credential store of the intermediary component and the user credentials are authenticated by the service or resource.

18. A method as recited in claim 13, wherein the communicating comprises communicating with the service or resource independently of the intermediary component.

19. One or more computer storage media having stored thereon multiple instructions that, responsive to execution by one or more processors of an intermediary component, cause the one or more processors to perform acts comprising:

receiving, from an access component, a first request to access a service, wherein each of the access component and the service and the intermediary component are implemented by different computing devices, and wherein credentials of a user of the access component are not revealed to the access component;

receiving, by the intermediary component, the user credentials of the user of the access component, the intermediary component comprising a user credential management module for managing the user credentials and a user authentication module;

displaying, in response to the first request, a user interface prompting the user to authorize sending of user credentials to the service;

checking whether the user authorizes sending of the user credentials to the service at the user authentication module of the intermediary component;

if the user does not authorize sending of the user credentials to the service then denying the first request; and

if the user authorizes sending of the user credentials to the service then;

obtaining, from a credential store of the intermediary component, previously stored user credentials for the user of the access component, wherein the user credentials are associated with the service;

sending, to the service, both a second request to access the service and the user credentials;

receiving, in response to the second request, session state information;

returning the session state information to the access component, wherein the session state information allows the access component and the service to communicate with each other independently of the intermediary component and without the user credentials being revealed to the access component.

21. A computing device implementing an intermediary component, the computing device comprising:

one or more processors; and

one or more computer storage media having stored thereon multiple instructions that, responsive to execution by the one or more processors, cause the one or more processors to perform acts comprising;

receiving, by the intermediary component and from an access component, a first request to access a service or resource without user credentials of a current user of the access component being revealed to the access component;

receiving, by the intermediary component, the user credentials of the current user of the access component, the intermediary component comprising a user credential management module and a user authentication module;

obtaining, by the intermediary component and in response to the first request, the user credentials for the current user, wherein the user credentials are associated with the service or resource, and the user credentials are managed by the user credential management module;

identifying, by the user authentication module, the user credentials to provide to the service;

sending, by the user authentication module of the intermediary component and to the service or resource, both a second request to access the service or resource and the user credentials;

receiving, by the intermediary component and in response to the second request, session state information from the service or resource; and

returning, by the intermediary component, the session state information to the access component so that the access component and the service or resource can communicate with each other independently of the intermediary component.

22. A computing device as recited in claim 21, the acts further comprising:

checking whether a user authorization to send the user credentials to the service or resource is received at the intermediary component; and

sending the user credentials to the service or resource only if the user authorization to send the user credentials to the service or resource is received at the intermediary component, otherwise returning an indication to the access component that the first request is denied.

23. A computing device as recited in claim 21, the acts further comprising:

checking a user credential store of the intermediary component to determine whether user credentials associated with the service or resource are present in the user credential store; and

sending the user credentials to the service or resource only if user credentials associated with the service or resource are present in the user credential store, otherwise returning an indication to the access component that the first request is denied.

24. A computing device implementing an access component, the computing device comprising:

one or more processors; and

one or more computer storage media having stored thereon multiple instructions that, responsive to execution by the one or more processors, cause the one or more processors to perform acts comprising;

receiving, by the access component, a first request from a user of the access component to access a service or resource without user credentials of the user being revealed to the access component;

sending, by the access component, to an intermediary component and in response to the first request, a second request to access the service or resource based on the user credentials for the user, the intermediary component comprising a user credential management module configured to manage the user credentials, a user authentication module, and an I/O module configured to receive the user credentials via user input to the intermediary component;

receiving, by the access component, from the user authentication module of the intermediary component and in response to the second request, session state information received by the intermediary component from the service or resource;

and

communicating, by the access component and using the session state information, with the service or resource.

25. A computing device as recited in claim 24, wherein the session state information allows the access component and the service or resource to communicate with one another without the user credentials being revealed to the access component.

26. A computing device as recited in claim 24, the acts further comprising receiving the session state information and communicating with the service or resource using the session state information only if both the user credentials associated with the service or resource are present in a user credential store of the intermediary component and the user credentials are authenticated by the service or resource.