Protecting user credentials using an intermediary component
First Claim
1. A method implemented by an intermediary component, the method comprising:
- receiving, by the intermediary component and from an access component, a first request to access a service or resource without user credentials of a current user of the access component being revealed to the access component;
receiving, by the intermediary component, the user credentials of the current user of the access component, the intermediary component comprising a user credential management module and a user authentication module;
obtaining, by the intermediary component and in response to the first request, the user credentials for the current user, wherein the user credentials are associated with the service or resource, and the user credentials are managed by the user credential management module;
identifying, by the user authentication module, the user credentials to provide to the service;
sending, by the user authentication module of the intermediary component and to the service or resource, both a second request to access the service or resource and the user credentials;
receiving, by the intermediary component and in response to the second request, session state information from the service or resource; and
returning, by the intermediary component, the session state information to the access component so that the access component and the service or resource can communicate with each other independently of the intermediary component.
2 Assignments
0 Petitions
Accused Products
Abstract
An access component sends an access request to an intermediary component, the access request being a request to access a service or resource without credentials of a current user of the intermediary component being revealed to the access component. The intermediary component obtains user credentials, for the current user, that are associated with the service or resource. The access request and the user credentials are sent to the service or resource, and in response session state information is received from the service or resource. The session state information is returned to the access component, which allows the access component and the service or resource to communicate with one another based on the session state information and independently of the first component.
-
Citations
26 Claims
-
1. A method implemented by an intermediary component, the method comprising:
-
receiving, by the intermediary component and from an access component, a first request to access a service or resource without user credentials of a current user of the access component being revealed to the access component; receiving, by the intermediary component, the user credentials of the current user of the access component, the intermediary component comprising a user credential management module and a user authentication module; obtaining, by the intermediary component and in response to the first request, the user credentials for the current user, wherein the user credentials are associated with the service or resource, and the user credentials are managed by the user credential management module; identifying, by the user authentication module, the user credentials to provide to the service; sending, by the user authentication module of the intermediary component and to the service or resource, both a second request to access the service or resource and the user credentials; receiving, by the intermediary component and in response to the second request, session state information from the service or resource; and returning, by the intermediary component, the session state information to the access component so that the access component and the service or resource can communicate with each other independently of the intermediary component. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 20)
-
-
13. A method implemented by an access component, the method comprising:
-
receiving, by the access component, a first request from a user of the access component to access a service or resource without user credentials of the user being revealed to the access component; sending, by the access component, to an intermediary component and in response to the first request, a second request to access the service or resource based on the user credentials for the user, the intermediary component comprising a user credential management module configured to manage the user credentials, a user authentication module, and an I/O module configured to receive the user credentials via user input to the intermediary component; receiving, by the access component, from the user authentication module of the intermediary component and in response to the second request, session state information received by the intermediary component from the service or resource; and communicating, by the access component and using the session state information, with the service or resource. - View Dependent Claims (14, 15, 16, 17, 18)
-
-
19. One or more computer storage media having stored thereon multiple instructions that, responsive to execution by one or more processors of an intermediary component, cause the one or more processors to perform acts comprising:
-
receiving, from an access component, a first request to access a service, wherein each of the access component and the service and the intermediary component are implemented by different computing devices, and wherein credentials of a user of the access component are not revealed to the access component; receiving, by the intermediary component, the user credentials of the user of the access component, the intermediary component comprising a user credential management module for managing the user credentials and a user authentication module; displaying, in response to the first request, a user interface prompting the user to authorize sending of user credentials to the service; checking whether the user authorizes sending of the user credentials to the service at the user authentication module of the intermediary component; if the user does not authorize sending of the user credentials to the service then denying the first request; and if the user authorizes sending of the user credentials to the service then; obtaining, from a credential store of the intermediary component, previously stored user credentials for the user of the access component, wherein the user credentials are associated with the service; sending, to the service, both a second request to access the service and the user credentials; receiving, in response to the second request, session state information; returning the session state information to the access component, wherein the session state information allows the access component and the service to communicate with each other independently of the intermediary component and without the user credentials being revealed to the access component.
-
-
21. A computing device implementing an intermediary component, the computing device comprising:
-
one or more processors; and one or more computer storage media having stored thereon multiple instructions that, responsive to execution by the one or more processors, cause the one or more processors to perform acts comprising; receiving, by the intermediary component and from an access component, a first request to access a service or resource without user credentials of a current user of the access component being revealed to the access component; receiving, by the intermediary component, the user credentials of the current user of the access component, the intermediary component comprising a user credential management module and a user authentication module; obtaining, by the intermediary component and in response to the first request, the user credentials for the current user, wherein the user credentials are associated with the service or resource, and the user credentials are managed by the user credential management module; identifying, by the user authentication module, the user credentials to provide to the service; sending, by the user authentication module of the intermediary component and to the service or resource, both a second request to access the service or resource and the user credentials; receiving, by the intermediary component and in response to the second request, session state information from the service or resource; and returning, by the intermediary component, the session state information to the access component so that the access component and the service or resource can communicate with each other independently of the intermediary component. - View Dependent Claims (22, 23)
-
-
24. A computing device implementing an access component, the computing device comprising:
-
one or more processors; and one or more computer storage media having stored thereon multiple instructions that, responsive to execution by the one or more processors, cause the one or more processors to perform acts comprising; receiving, by the access component, a first request from a user of the access component to access a service or resource without user credentials of the user being revealed to the access component; sending, by the access component, to an intermediary component and in response to the first request, a second request to access the service or resource based on the user credentials for the user, the intermediary component comprising a user credential management module configured to manage the user credentials, a user authentication module, and an I/O module configured to receive the user credentials via user input to the intermediary component; receiving, by the access component, from the user authentication module of the intermediary component and in response to the second request, session state information received by the intermediary component from the service or resource; and communicating, by the access component and using the session state information, with the service or resource. - View Dependent Claims (25, 26)
-
Specification