Distributed single sign on technologies including privacy protection and proactive updating

• US 9,118,463 B2
• Filed: 02/29/2012
• Issued: 08/25/2015
• Est. Priority Date: 11/24/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Zhu, Bin Benjamin, Feng, Min
• Primary Examiner(s): Chao, Michael
• Assistant Examiner(s): MEJIA, FELICIANO S
• Application Number:
  US13/408,434
• Publication Number:
  US 20120174207A1
• Time in Patent Office: 1,273 Days
• Field of Search: 709/229, 380/28, 726/2, 726/8, 726/9
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/3218 using proof of knowledge, e.g. Fiat-Shamir, GQ, Schnorr, ornon-interactive zero-knowledge proofs
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

Technologies for distributed single sign-on operable to provide user access to a plurality of services via authentication to a single entity. The distributed single sign-on technologies provide a set of authentication servers and methods for privacy protection based on splitting secret keys and user profiles into secure shares and periodically updating shares among the authentication servers without affecting the underlying secrets. The correctness of the received partial token or partial profiles can be verified with non-interactive zero-knowledge proofs.

Claims

1. A method comprising:

sending, by a computing device, a request for access;

receiving, by the computing device in response to the sent request, a list of t authentication devices, a unique service identifier, and a value;

sending, by the computing device for each j where 1<

j≦

t, data comprising a user identifier of a user, the unique service identifier, the value, and a random number;

receiving, by the computing device in response to the sent data for each j, a partial authentication token based on the sent user identifier, the sent unique service identifier, the sent value, and the sent random number;

computing, by the computing device, an authentication token based on j of the received partial authentication tokens, where 1≦

j≦

t;

sending, by the computing device, the authentication token;

receiving, by the computing device in response to the sent authentication token, the requested access.

2. The method of claim 1 further comprising receiving, in response to any of the received partial authentication tokens being incorrect, a denial to the requested access.

3. The method claim 1 wherein j is the number of partial authentication tokens required for the computing the authentication token.

4. The method of claim 1 wherein each correct partial authentication ken represents a share of a secret key required for the requested access.

5. The method of claim 1 wherein the authentication token represents a secret key required for the requested access.

6. The method of claim 1 wherein the user is a user of the computing device.

7. The method of claim 1 wherein the receiving the requested access is dependent on a session key based on a random number.

8. At least one computer-readable media storing computer-readable instructions that, when executed by a computing device, cause the computing device to perform a method comprising:

sending a request for access;

receiving, in response to the sent request, a list of t authentication devices, a unique service identifier, and a value;

sending, for each j where 1<

j≦

t, data comprising a user identifier of a user, the unique service identifier, the value, and a random number;

receiving, in response to the sent data for each j, a partial authentication token based on the sent user identifier, the sent unique service identifier, the sent value, and the sent random number;

computing an authentication token based on j of the received partial authentication tokens, where 1<

j≦

t;

sending, by the computing device, the authentication token;

receiving, in response to the sent authentication token, the requested access.

9. The at least one computer-readable media of claim 8, the method further comprising receiving, in response to any of the received partial authentication tokens being incorrect, a denial to the requested access.

10. The at least one computer-readable media claim 8 wherein j is a number of partial authentication tokens required for the computing the authentication token.

11. The at least one computer-readable media of claim 8 wherein each correct partial authentication token of the received partial authentication tokens represents a share of a secret key required for the requested access.

12. The at least one computer-readable media of claim 8 wherein the authentication token represents a secret key required for the requested access.

13. The at least one computer-readable media of claim 8 wherein the user is a user of the computing device.

14. The at least one computer-readable media of claim 8 wherein the receiving the requested access is dependent on a session key based on a random number.

15. A system comprising:

a computing device configured for sending a request for access;

the computing device further configured for receiving, in response to the sent request, a list of t authentication devices, a unique service identifier, and a value;

the computing device further configured for sending, for each j where 1<

j≦

t, data comprising a user identifier of a user, the unique service identifier, the value, and a random number;

the computing device further configured for receiving, in response to the sent data for each j, a partial authentication token based on the sent user identifier, the sent unique service identifier, the sent value, and the sent random number;

the computing device further configured for computing an authentication token based on j of the received partial authentication tokens, where 1<

j≦

t;

the computing device further configured for sending, by the computing device, the authentication token;

the computing device further configured for receiving, in response to the sent authentication token, the requested access.

16. The system of claim 15, the computing device further configured for receiving, in response to any of the received partial authentication tokens being incorrect, a denial to the requested access.

17. The system claim 15 wherein j is a number of partial authentication tokens required for the computing the authentication token.

18. The system of claim 15 wherein each correct partial authentication token of the received partial authentication tokens represents a share of a secret key required for the requested access.

19. The system of claim 15 wherein the authentication token represents a secret key required for the requested access.

20. The system of claim 15 wherein the receiving the requested access s dependent on a session key based on a random number.