Methods and systems of generating and using authentication credentials for decentralized authorization in the cloud

• US 9,397,990 B1
• Filed: 11/08/2013
• Issued: 07/19/2016
• Est. Priority Date: 11/08/2013
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Birgisson, Arnar, Politz, Joseph Gibbs, Lentczner, Mark, Taly, Ankur, Erlingsson, Ulfar
• Primary Examiner(s): Arani, Taghi
• Assistant Examiner(s): Lynch, Sharon
• Application Number:
  US14/074,941
• Time in Patent Office: 984 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

A method of controlling the sharing of data between entities that are in electronic communication with each other may include generating an authentication credential comprising an identifier for the target service and a unique signature, attenuating the authentication credential, and determining whether a client device is authorized to access the target service, and, only if so, providing the authentication credential to the client device. In an embodiment, the method may include receiving an access request from the client device, identifying that the authentication credential includes the unique signature and a third party caveat that is associated with a third party authentication service, in response to the identifying, determining whether the request also comprises a discharge credential for the third party caveat, and if the request includes the discharge credential, providing the client device with the requested service, otherwise denying the request.

Claims

1. A method of controlling the sharing of data between entities that are in electronic communication, comprising:

generating, by a cloud-based server of a target service, an authentication credential comprising;

an identifier for the target service, and

a unique signature representing a keyed-hash message authentication code generated using a key identifier and a secret key associated with the target service; and

by an intermediate service;

attenuating the authentication credential by placing one or more restrictions on a use of the authentication credential,

generating an updated unique signature for the authentication credential wherein the updated unique signature represents a keyed-hash message authentication code that is generated using the unique signature and the one or more restrictions,

replacing the unique signature of the authentication credential with the updated unique signature, and

providing the authentication credential to a client electronic device that is in electronic communication with the cloud-based server only when the client electronic device is authorized to access the target service;

by the cloud-based server of the target service;

receiving an access request from the client electronic device, wherein the request comprises the authentication credential and one or more parameters that relate to a requested service that is available from the target service,

identifying that the authentication credential includes the updated unique signature and a third party caveat that is associated with a third party authentication service,

in response to the identifying, determining whether the request also comprises a discharge credential for the third party caveat, and

in response to determining that the request includes the discharge credential;

identifying a signature for the discharge credential, and

determining whether the signature for the discharge credential corresponds to a signature for the third party authentication service, and

providing the client electronic device with the requested service only when the signature for the discharge credential corresponds to the signature for the third party authentication service, otherwise denying the request.

2. The method of claim 1, further comprising, by the cloud-based server:

identifying that the authentication credential also includes a first party caveat, wherein the first party caveat comprises a predicate;

determining whether a condition associated with the predicate is true; and

only providing the electronic client device with the requested service when the condition associated with the predicate is true, otherwise denying the request.

3. The method of claim 1, further comprising, by the electronic client device, identifying that the authentication credential includes the third party caveat, and in response:

extracting a caveat identifier from the third party caveat;

performing an action that is required by the third party caveat;

sending the caveat identifier and evidence of the action that is performed to the third party authentication service; and

receiving the discharge credential from the third party authentication service.

4. The method of claim 3, further comprising:

by the third party authentication service, returning an additional caveat with the discharge credential to the client;

by the cloud-based server;

identifying that the authentication credential includes the additional caveat,

determining whether the request also comprises an additional discharge credential for the additional caveat, and

only providing the client electronic device with the requested service when the target service has also received the additional discharge credential from the client, otherwise denying the request.

5. The method of claim 4, further comprising, by the client electronic device:

receiving the additional caveat from the third party authentication service;

extracting an additional identifier from the additional caveat;

performing an additional action that is required by the additional caveat;

sending the additional identifier and evidence of the performed additional action to an additional authentication service;

receiving the additional discharge credential from the additional authentication service; and

after receiving the additional discharge credential, providing the additional discharge credential to the target service with the request.

6. The method of claim 1, further comprising, by the cloud-based server:

determining whether the third party caveat is part of the discharge credential and whether the discharge credential is bound to the authentication credential; and

providing the client electronic device with the requested service only when the third party caveat is part of the discharge credential and the discharge credential is bound to the authentication credential, otherwise denying the request.

7. The method of claim 1, further comprising, by the cloud-based server:

determining whether the authentication credential or the discharge credential has expired;

and providing the client electronic device with the requested service only when neither the discharge credential nor the authentication credential has expired, otherwise denying the request.

8. The method of claim 1, wherein attenuating the authentication credential comprises adding one or more additional caveats to the authentication credential by the intermediate service.

9. The method of claim 8, wherein adding one or more additional caveats to the authentication credential comprises adding one or more of the following to the authentication credential:

one or more additional first-party caveats; and

one or more additional third-party caveats.

10. A method of controlling the sharing of data between entities that are in electronic communication, comprising:

generating, by a cloud-based server of a target service, a first authentication credential comprising;

an identifier for the target service, and

a unique signature representing a keyed-hash message authentication code generated using a key identifier and a secret key associated with the target service; and

by an intermediate service;

attenuating the first authentication credential by placing one or more restrictions on a use of the first authentication credential,

generating an updated unique signature for the first authentication credential wherein the updated unique signature represents a keyed-hash message authentication code that is generated using the unique signature and the one or more restrictions,

replacing the unique signature of the first authentication credential with the updated unique signature, and

providing the first authentication credential to a client electronic device in electronic communication with the cloud-based server only when the client electronic device is authorized to access the target service;

by the cloud-based server;

receiving an access request from the client electronic device, wherein the request includes the first authentication credential, one or more parameters that relate to a requested service that is available from the target service, and a plurality of disjunctive authentication credentials,

identifying that one or more of the first authentication credential and one or more of the plurality of disjunctive authentication credentials includes the updated unique signature and one or more third party caveats that are associated with one or more third party authentication services,

in response to the identifying, determining whether the request also comprises one or more discharge credentials for the one or more third party caveats,

in response to determining that the request includes the one or more discharge credentials for the one or more third party caveats;

identifying a signature for a discharge credential from the one or more discharge credentials, and

determining whether the signature for the discharge credential corresponds to a signature for a third party authentication service,

providing the client electronic device with the requested service only when the signature for the discharge credential corresponds to the signature for the third party authentication service, otherwise denying the request.

11. The method of claim 10, further comprising, by the cloud-based server:

identifying that the first authentication credential also includes a first party caveat, wherein the first party caveat comprises an identifier and a predicate;

determining whether a condition associated with the predicate is true; and

only providing the client electronic device with the requested service when the condition associated with the predicate is true, otherwise denying the request.

12. The method of claim 11, further comprising, by the client electronic device, identifying that the first authentication credential includes one or more of the third party caveats, and in response:

extracting a caveat identifier from each of the third party caveats;

performing an action that is required by each of the third party caveats;

for each third party caveat, sending the caveat identifier for the third party caveat and evidence of the action that is performed to the third party authentication service that is associated with the third party caveat; and

for each third party caveat, receiving the discharge credential for the third party caveat from the associated third party authentication service.

13. The method of claim 12, further comprising:

by a first one of the one or more third party authentication services, returning an additional caveat with the discharge credential for one of the third party caveats to the client electronic device;

by the cloud-based server;

identifying that the first authentication credential includes the additional caveat,

determining whether the access request also comprises an additional discharge credential for the additional caveat, and

only providing the client electronic device with the requested service if the target service has also received the additional discharge credential from the client electronic device, otherwise denying the access request.

14. The method of claim 13, further comprising, by the client electronic device:

receiving the additional caveat from the first one of the one or more third party authentication services;

extracting an additional identifier from the additional caveat;

performing an additional action that is required by the additional caveat;

sending the additional identifier and evidence of the additional action that is performed to a second one of the third party authentication services;

receiving the additional discharge credential from the second one of the third party authentication services; and

after receiving the additional discharge credential, providing the additional discharge credential to the target service with the request.

15. The method of claim 10, further comprising, by the cloud-based server:

determining whether the third party caveat is part of the discharge credential and whether the discharge credential is bound to the first authentication credential; and

providing the client electronic device with the requested service only when the third party caveat is part of a discharge credential that is bound to the first authentication credential, otherwise denying the request.

16. The method of claim 10, wherein attenuating the first authentication credential comprises adding one or more additional caveats to the first authentication credential by the intermediate service.

17. The method of claim 16, wherein adding one or more additional caveats to the first authentication credential comprises adding one or more of the following to the first authentication credential:

one or more additional first-party caveats; and

one or more additional third-party caveats.

18. A method of controlling the sharing of data between entities that are in electronic communication, comprising:

by an intermediate service;

generating an updated unique signature for an authentication credential, wherein the updated unique signature represents a keyed-hash message authentication code that is generated using a unique signature and one or more restrictions on the authentication credential, and

replacing the unique signature with the updated signature;

by a client electronic device;

receiving the authentication credential from the intermediate service, wherein the authentication credential comprises;

an identifier for a target service, and

a caveat that is associated with a third party authentication service;

storing the authentication credential in a non-transitory, computer-readable memory;

identifying that the authentication credential includes the caveat;

providing the authentication credential to the third party authentication service;

receiving, from the third party authentication service, a discharge credential that confirms that the caveat has been satisfied;

identifying that the third party authentication service has returned a second caveat with the discharge credential;

sending, to an additional authentication service, evidence that a condition required by the second caveat has been satisfied;

receiving, from the additional authentication service, a second discharge credential;

providing the target service with a service request for a requested service, wherein the service request comprises the authentication credential, the discharge credential and the second discharge credential; and

receiving the requested service from the target service.

19. The method of claim 18, further comprising:

by the client electronic device, identifying that the authentication credential includes a third party caveat, and in response;

performing an action that is required by the third party caveat;

sending a caveat identifier for the authentication credential and evidence of the performed action to the third party authentication service; and

receiving the discharge credential from the third party authentication service.

20. The method of claim 18, further comprising, by the client electronic device:

performing a second action that is required by the second caveat;

sending evidence wherein the evidence comprises evidence that the second action has been performed.

21. The method of claim 20, further comprising, by the client electronic device, before sending the request to the target service, binding each of the discharge credential and the second discharge credential to the authentication credential.

22. The method of claim 20, wherein binding each of the discharge credential and the second discharge credential to the authentication credential comprises:

generating a common signature for each of the discharge credential and the second discharge credential and the authentication credential; and

replacing the signatures for each of the discharge credential and the second discharge credential and the authentication credential with the common signature.

23. The method of claim 18, further comprising, by the client electronic device, identifying that the authentication credential also includes a first party caveat that is associated with the target service, and in response:

performing an action that is required by the first party caveat;

when sending the request to the target service, including evidence of the action being performed with the request.

24. The method of claim 18, wherein:

providing the authentication credential to the third party authentication service comprises providing the authentication credential to a service that is available to the client electronic device;

the discharge credential comprises a caveat that the discharge credential is only valid during a current user session of the client electronic device; and

the client electronic device will only provide the target service with the service request comprising the authentication credential and the discharge credential when the current session is still active and the discharge credential is still valid.

25. A system for controlling the sharing of data between entities that are in electronic communication, the system comprising:

a cloud-based server associated with a target service and target service programming instructions that, when executed, cause the cloud-based server to generate an authentication credential comprising an identifier for the target service, and a unique signature representing a keyed-hash message authentication code generated using a key identifier and a secret key associated with the target service; and

an intermediate service computing device and intermediate service programming instructions in communication with the target service computing device, wherein the intermediate service programming instructions, when executed, cause the intermediate service computing device to;

attenuate the authentication credential by placing one or more restrictions on a use of the authentication credential'"'"'s use,

generate an updated unique signature for the authentication credential wherein the updated unique signature represents a keyed-hash message authentication code that is generated using the unique signature and the one or more restrictions,

replace the unique signature of the authentication credential with the updated unique signature, and

provide the authentication credential to a client electronic device that is in electronic communication with the cloud-based server only when the client device is authorized to access the target service;

wherein the target service programming instructions, when executed, also cause the cloud-based server to;

receive an access request from the client electronic device, wherein the request comprises the authentication credential and one or more parameters that relate to a requested service that is available from the target service,

identify that the authentication credential includes the updated unique signature and a third party caveat that is associated with a third party authentication service,

in response to the identifying, determine whether the request also comprises a discharge credential for the third party caveat, and

in response to determining that the request includes the discharge credential;

identify a signature for the discharge credential, and

determine whether the signature for the discharge credential corresponds to a signature for the third party authentication service, and provide the client electronic device with the requested service only when the signature for the discharge credential corresponds to the signature for the third party authentication service, otherwise deny the request.

26. A system for controlling the sharing of data between entities that are in electronic communication, the system comprising:

a cloud-based server and target service programming instructions that, when executed, cause the cloud-based server to generate a first authentication credential comprising an identifier for the target service, and a unique signature representing a keyed-hash message authentication code generated using a key identifier and a secret key associated with the target service; and

an intermediate service computing device and intermediate service programming instructions that, when executed, cause the intermediate service computing device to;

attenuate the first authentication credential by placing one or more restrictions on a use of the first authentication credential,

generate an updated unique signature for the first authentication credential wherein the updated unique signature represents a keyed-hash message authentication code that is generated using the unique signature and the one or more restrictions,

replace the unique signature of the first authentication credential with the updated unique signature, and

provide the first authentication credential to a client electronic device in electronic communication with the cloud-based server only when the client device is authorized to access the target service;

wherein the target service programming instructions, when executed, also cause the cloud-based server to;

receive an access request from the client electronic device, wherein the request includes the first authentication credential, one or more parameters that relate to a requested service that is available from the target service, and a plurality of disjunctive authentication credentials,

identify that one or more of the received credentials includes the updated unique signature and a third party caveat that is associated with a third party authentication service,

in response to the identifying, determine whether the request also comprises a discharge credential for at least one of the third party caveats, and

in response to determining that the request includes [a] the discharge credential for at least one of the third party caveats;

identify a signature for the discharge credential, and

determine whether the signature for the discharge credential corresponds to a signature for the third party authentication service, and

provide the client electronic device with the requested service only when the signature for the discharge credential corresponds to the signature for the third party authentication service, otherwise deny the request.

27. A system for controlling the sharing of data between entities that are in electronic communication, the system comprising:

a computing device in electronic communication with a cloud-based server of a target service and an intermediate service computing device;

a first non-transitory computer readable storage medium in communication with the intermediate service computing device, wherein the first non-transitory computer readable storage medium comprises one or more programming instructions that, when executed, cause the intermediate service computing device to;

generate an updated unique signature for an authentication credential, wherein the updated unique signature represents a keyed-hash message authentication code that is generated using a unique signature and one or more restrictions on the authentication credential, and

replace the unique signature with the updated unique signature,

a second non-transitory, computer-readable storage medium in communication with the computing device, wherein the second computer-readable storage medium comprises one or more programming instructions that, when executed, cause the computing device to;

receive the authentication credential from the intermediate service computing device, wherein the authentication credential comprises;

an identifier for the target service, and

a caveat that is associated with a third party authentication service, store the authentication credential in the second non-transitory, computer-readable storage medium,

identify that the authentication credential includes the caveat,

provide the authentication credential to the third party authentication service,

receive, from the third party authentication service, a discharge credential that confirms that the caveat has been satisfied,

identify that the third party authentication service has returned a second caveat with the discharge credential,

send, to an additional authentication service, evidence that a condition required by the second caveat has been satisfied,

receive, from the additional authentication service, a second discharge credential,

provide the cloud-based server with a service request for a requested service, wherein the service request comprises the authentication credential, the discharge credential, and the second discharge credential, and

receive the requested service from the target service.