Request-specific authentication for accessing web service resources

• US 9,590,994 B2
• Filed: 11/09/2015
• Issued: 03/07/2017
• Est. Priority Date: 04/20/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: McMurtry, Craig V., Weinert, Alexander T., Meleshuk, Vadim, Gabarra, Mark E.
• Primary Examiner(s): Okeke, Izunna
• Assistant Examiner(s): Shayanfar, Ali
• Application Number:
  US14/936,362
• Publication Number:
  US 20160191528A1
• Time in Patent Office: 484 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

Requests for access to Web service resources are evaluated based on the type of request that is received. Requests are not granted unless sufficient proof of authentication is provided to grant that request. An authentication service evaluates one or more factors to determine whether or not to authenticate the client. After being authenticated by the authentication service, proof of authentication is provided to the Web service, which grants access to the Web service resource.

Claims

1. A computing system for controlling access to a protected Web service resource, the computing system comprising:

a communication device for communicating across a communication network;

an interface configured to receive a first request from a client to access the protected Web service resource from the communication network;

the interface configured to generate a fault on a condition that the first request fails to indicate that at least one message-specific authentication protocol process has been completed; and

a transmitter configured to transmit the fault to the client, the fault including;

an identifier of the first request;

an identifier of one or more authentication processes associated with the first request;

an address to an authentication service that can issue an encrypted token; and

an identifier of the client on behalf of whom the first request was made;

the interface further configured to receive a second request from the client to access the protected Web service resource from the communication network, the second request including the encrypted token obtained from the authentication service identified in the fault, wherein the encrypted token includes;

the identifier of the first request; and

an indication of successful completion of the one or more authentication processes associated with the first request;

the interface further configured to grant the second request to access the protected Web service resource based on validation of the encrypted token, the validation comprising decryption of the encrypted token with a public key of the authentication service by the processing unit.

2. A method of authenticating a client for access to a Web service resource, the method comprising:

(i) receiving a first request from the client to be authenticated;

(ii) sending a challenge message to the client;

(iii) receiving a confirmation response to the challenge message from the client;

(iv) determining that the confirmation response meets a first predetermined criterion;

(v) determining that the confirmation response requires further authentication in that the confirmation response fails to indicate that at least one message-specific authentication protocol process has been completed;

(vi) repeating (ii) through (iv) with;

a second challenge message that includes;

an identifier of the first request, an identifier of one or more authentication processes associated with the first request, an address to an authentication service that can issue an encrypted token, and an identifier of the client on behalf of whom the first request was made;

a second confirmation response that includes an encrypted token obtained from the authentication service, the encrypted token including an identifier of the first request and an indication of successful completion of one or more authentication processes associated with the first request; and

a second predetermined criterion met by decrypting the encrypted token with a public key of the authentication service; and

(vii) sending an authentication message to the client based on the decryption.

3. The method of claim 2, wherein determining that the request to be authenticated requires further authentication comprises reading data from the request and comparing the data from the request with an authentication level associated with the challenge message.

4. The method of claim 2, further comprising repeating (ii) through (iv) with a third challenge message, a third confirmation response, and a third identified authentication information, prior to sending the authentication message to the client.

5. A computer readable storage device containing computer executable instructions which when executed by a computer perform a method of controlling access to a protected resource, the method comprising:

receiving a request from a client identifying the protected resource of a Web service,

determining that the request fails to indicate that at least one message-specific authentication protocol process has been completed

sending a response to the client requesting authentication from an authentication service that can issue an encrypted token, wherein the response includes;

(a) an identifier of the request;

(b) an identifier of one or more authentication processes associated with the request; and

(c) an address to the authentication service; and

(d) an identifier of the client on behalf of whom the request was made;

receiving an authentication from the client after being authenticated from the authentication service, the authentication comprising an encrypted token that includes the identifier of the request and an indication of successful completion of the one or more authentication processes associated with the request;

determining whether the authentication is of at least a first level to grant the request, authentication of at least the first level including decryption of the encrypted token with a public key of the authentication service; and

sending an authentication message to grant the request when the authentication is of at least the first level.

6. The computer readable storage device of claim 5, the method further comprising granting access to the protected resource of the Web service after granting the request if the authentication is of at least the first level.

7. The computer readable storage device of claim 5, wherein denying the request comprises communicating the denial to the client with a message, the message including information about the authentication service configured to authenticate the client.

8. The computer readable storage device of claim 5, the method further comprising:

receiving a second request from the client identifying the protected resource of the Web service, the second request including the authentication;

determining whether the authentication is of at least a first level to grant the second request;

granting the second request if the authentication is of at least the first level to grant the second request; and

denying the second request if the authentication is not of at least the first level to grant the second request.

9. The computer readable storage device of claim 5, wherein denying the request comprises sending a fault message according to a Simple Object Access Protocol, and wherein receiving an authentication comprises receiving a Web Services Trust Request Security Token Response Message according to a Web Services Trust specification.