Persistent uniform resource locators (URLs) for client applications acting as web services

• US 9,756,020 B2
• Filed: 04/27/2015
• Issued: 09/05/2017
• Est. Priority Date: 04/27/2015
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Kaufman, Matthew T.
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): WRIGHT, BRYAN F
• Application Number:
  US14/697,161
• Publication Number:
  US 20160315910A1
• Time in Patent Office: 862 Days
• Field of Search: 726 10
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

Techniques to provide persistent uniform resource locators (URLs) for client applications acting as web services are described herein. In one or more implementations, the techniques utilize standard protocols and libraries (e.g., standard HTTP) without relying upon custom/propriety plug-ins. An intermediary server functions as a tunnel service is configured to provide functionality for handling communications between endpoints on behalf of client applications. Additionally, the tunnel service provides a mechanism to generate and assign persistent URLs (or comparable addresses) to client applications. Entities seeking to interact with the client applications use corresponding URLs to direct requests via the tunnel service and down to the appropriate client application. Local storage associated with the client application is employed to store the credentials, such that the URL persists across multiple sessions and the same URL is generated repeatedly by the tunnel service each time corresponding and valid credentials are supplied by a client.

Claims

1. A method implemented by a client device comprising:

requesting access to a tunnel service implemented via an intermediary server including communicating a digital certificate for a client application to the tunnel service to get a persistent URL that enables the client application to operate as a web service through the tunnel service, the tunnel service configured to derive the same persistent URL from the digital certificate each time the digital certificate is presented for access to the tunnel service during a validity period of the digital certificate;

responsive to requesting access, acquiring the persistent URL from the tunnel service, the persistent URL configured by the tunnel service as a publicly addressable identifier for the client application as the web service that is derived from information contained in the digital certificate; and

communicating as the web service with one or more endpoints through the tunnel service using the persistent URL.

2. The method of claim 1, wherein communicating comprises publishing the persistent URL with a directory service to enable endpoints to resolve the persistent URL for the client application and direct requests using the persistent URL.

3. The method of claim 2, wherein the directory service comprises a dynamic domain name system (DNS) component configured to map the persistent URL to a DNS name associated with the web service and an IP address of a corresponding server of the tunnel service that is hosting the web service.

4. The method of claim 1, wherein the persistent URL is valid across multiple sessions between the client application and the tunnel service.

5. The method of claim 1, wherein the digital certificate is signed by a certificate authority associated with a public-private key pair assigned to the client application.

6. The method of claim 1, wherein the digital certificate is associated with credentials, the credentials further comprising a username and password combination for access to the tunnel service.

7. The method of claim 1, wherein the digital certificate enables negotiation of a secure session between the client application and an endpoint using the tunnel service as a proxy, such that the tunnel service does not possess security parameters for the session and traffic directed via the tunnel service for the secure session is not visible to the tunnel service as clear-text traffic.

8. The method of claim 1, wherein the persistent URL is generated to incorporate an identifying string extracted from the digital certificate as a domain identifier.

9. The method of claim 1, wherein the persistent URL enables the client application to engage in asynchronous web communications with other web services using the tunnel service to route traffic for the asynchronous web communications.

20. The method of claim 1, wherein the validity period of the digital certificate is at least one day.

10. A computing device comprising:

a processing system; and

one or more computer readable media storing instructions which, when executed, cause the computing device to perform operations comprising;

requesting access to a tunnel service implemented via an intermediary server including communicating a digital certificate for a client application to the tunnel service to get a persistent URL that enables the client application to operate as a web service through the tunnel service, the tunnel service configured to derive the same persistent URL from the digital certificate each time the digital certificate is presented for access to the tunnel service during a validity period of the digital certificate;

responsive to requesting access, acquiring the persistent URL from the tunnel service, the persistent URL configured by the tunnel service as a publicly addressable identifier for the client application as the web service that is derived from information contained in the digital certificate; and

communicating as the web service with one or more endpoints through the tunnel service using the persistent URL.

11. The computing device of claim 10, further comprising local storage associated with the client application in which the digital certificate is stored to enable repeated use of the digital certificate to access the tunnel service and get the same persistent URL derived from the digital certificate.

12. The computing device of claim 10, wherein the validity period of the digital certificate is at least one day.

13. The computing device of claim 10, further comprising causing negotiation of a secure session between the web service and one or more endpoints using the digital certificate for communications engaged in via the tunnel service with the persistent URL, the secure session negotiated with the tunnel service acting as a proxy for establishment of the secure session such that the tunnel service in unaware of security parameters for the session and traffic directed via the tunnel service for the secure session is not visible to the tunnel service as clear-text traffic.

14. A system to facilitate provision of web services by client applications comprising:

a processing system including one or more hardware elements;

one or more computer-readable media storing computer readable instructions which, when executed via the processing system, implement a tunnel service configured to perform operations including;

receiving credentials supplied by a client application to establish communication sessions through the tunnel service;

ascertaining validity of the credentials supplied by the client application;

when the credentials are valid;

extracting an identifying string indicated by the credentials;

generating a persistent uniform resource locator (URL) for use by the client application that incorporates the identifying string that is extracted; and

returning the persistent URL to the client application effective to enable the client application to operate through the tunnel service as a web service using the persistent URL, wherein the client application comprises an application having associated local storage in which credentials used to obtain the persistent URL are stored across multiple sessions, such that the credentials are usable to obtain the same persistent URL derived from the credentials by the tunnel service when the credentials are supplied to the tunnel service for validation.

15. The system of claim 14, further comprising routing communications between endpoints for communication sessions established through the tunnel service the tunnel service using an encapsulated request and response structure.

16. The system of claim 15, wherein routing communications between endpoints comprises acting as a proxy for a secure session previously negotiated between the client application and another endpoint using the credentials, such that traffic directed via the tunnel service for the secure session is not visible to the tunnel service as clear-text traffic.

17. The system of claim 16, wherein the credentials comprise a digital certificate and the identifying string used to generate the persistent URL comprises a certificate name extracted from the certificate.

18. The system of claim 14, wherein tunnel service is configured to derive the same persistent URL from the credentials across multiple sessions as long as the credentials are valid when supplied to the tunnel service.

19. The system of claim 18, wherein credentials are valid for at least one day.