Elevating trust in user identity during RESTful authentication and authorization

• US 9,485,248 B2
• Filed: 10/06/2014
• Issued: 11/01/2016
• Est. Priority Date: 08/20/2012
• Status: Active Grant

• Current Assignee: Crowdstrike, Inc. (CrowdStrike Holdings Incorporated)
• Original Assignee: Jericho Systems Corporation
• Inventors: Schmoyer, Timothy, Dufel, Michael, Staggs, David, Subramanium, Vijayababu
• Primary Examiner(s): Zecher, Dede
• Assistant Examiner(s): LAKHIA, VIRAL S
• Application Number:
  US14/506,825
• Publication Number:
  US 20150058960A1
• Time in Patent Office: 757 Days
• Field of Search: 726/1, 726/7, 726/8, 713150-151, 455/558
• US Class Current: 1/1
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/01 Protocols

Abstract

Credentials sent over a back channel during the authentication of a user to a RESTful service can elevate the trust the recipient system can place in the user'"'"'s identity. The addition of an identity credential of higher strength can increase confidence in user identities electronically presented with a lower strength credential. Attributes from either credential can be used to determine authorization to a protected resource.

Claims

1. A computer-implemented method of authenticating and authorizing an entity, comprising:

receiving, by a RESTful service, a request from an entity, wherein the request is for access to a protected resource;

redirecting the entity to a relying party, wherein the relying party facilitates the authentication of the entity and stores a first credential and a SAML credential;

receiving, by the RESTful service, the first credential from the relying party, wherein the first credential is received through a front channel;

receiving, by the RESTful service, the SAML credential from the relying party, wherein the SAML credential is received through a back channel;

authenticating the entity at a level of confidence based on the credential strength of the first credential and based on the credential strength of the SAML credential; and

authorizing the entity'"'"'s access to the protected resource, wherein the authorization is based on attributes contained in the SAML credential.

2. The method of claim 1, wherein the relying party facilitates the authentication of the entity using an OpenID identity provider.

3. The method of claim 1, wherein the SAML credential has a credential strength of DoDI 8520.03 level C.

4. The method of claim 1, wherein the SAML credential has an SP 800-63 level of assurance 3.

5. The method of claim 1, wherein the SAML credential has an SP 800-63 level of assurance 4.

6. The method of claim 1, wherein the SAML credential passed by the relying party contains X.509 attributes.

7. The method of claim 1, wherein information passed on the back channel is encrypted using SSL protocol.

8. The method of claim 1, wherein information passed on the back channel is encrypted using TLS protocol.

9. The method of claim 1, wherein information passed on the back channel is exchanged using SOAP protocol.

10. The method of claim 1, wherein the first credential is a CAS credential.

11. A computer-implemented system, comprising:

a computer having a processor and a memory, and

a RESTful service operable to;

receive, from an entity via an entity agent, a request to access a protected resource,

redirect the entity agent to a relying party,

receive a first credential related to the request, wherein the first credential is received from the relying party and through a front channel,

receive a SAML credential related to the request, wherein the SAML credential is received from the relying party and through a back channel,

authenticate the entity at a level of confidence based on the credential strength of the first credential and based on the credential strength of the SAML credential, and

authorize the entity'"'"'s access to the protected resource, wherein the authorization is based on attributes contained in the SAML credential;

a relying party operable to;

facilitate the authentication of the entity,

store the first credential and the SAML credential,

send, through the front channel, the first credential to the RESTful service, and

send, through the back channel, the SAML credential to the RESTful service.

12. The method of claim 11, wherein the relying party is further operable to facilitate authentication by using an OpenID profile.

13. The method of claim 11, wherein the SAML assertion has the credential strength of DoDI 8520.03 level C.

14. The method of claim 11, wherein the SAML assertion has an SP 800-63 level of assurance 3.

15. The method of claim 11, wherein the SAML assertion has an SP 800-63 level of assurance 4.

16. The method of claim 11, wherein the SAML assertion contains X.509 attributes.

17. The method of claim 11, wherein the relying party is further operable to encrypt the back channel using SSL protocol.

18. The method of claim 11, wherein the relying party is further operable to encrypt the back channel using TLS protocol.

19. The method of claim 11, wherein the relying party is further operable to use SOAP protocol on the back channel.

20. A computer-implemented system, comprising:

a computer having a processor and a memory and operable to;

receive, from an entity via an entity agent, a request to access a protected resource,

redirect the entity agent to a relying party,

receive a first credential related to the request, wherein the first credential is received from the relying party and through a front channel,

receive a SAML credential related to the request, wherein the SAML credential is received from the relying party and through a back channel,

authenticate the entity at a level of confidence based on the credential strength of the first credential and based on the credential strength of the SAML credential, and

authorize the entity'"'"'s access to the protected resource, wherein the authorization is based on attributes contained in the SAML credential;

a relying party operable to;

facilitate the authentication of the entity,

store the first credential and the SAML credential,

send, through the front channel, the first credential to the RESTful service, and

send, through the back channel, the SAML credential to the RESTful service.