Request-specific authentication for accessing web service resources

• US 9,832,185 B2
• Filed: 01/23/2017
• Issued: 11/28/2017
• Est. Priority Date: 04/20/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: McMurtry, Craig V., Weinert, Alexander T., Meleshuk, Vadim, Gabarra, Mark E.
• Primary Examiner(s): Shayanfar, Ali
• Application Number:
  US15/412,866
• Publication Number:
  US 20170134368A1
• Time in Patent Office: 309 Days
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

Requests for access to Web service resources are evaluated based on the type of request that is received. Requests are not granted unless sufficient proof of authentication is provided to grant that request. An authentication service evaluates one or more factors to determine whether or not to authenticate the client. After being authenticated by the authentication service, proof of authentication is provided to the Web service, which grants access to the Web service resource.

Claims

1. A computing system for controlling access to a protected Web service resource, the computing system comprising:

a communication device for communicating across a communication network;

a processor communicatively connected to the communication device; and

memory storing program instructions, which when executed by the processor cause the computing system to;

receive a first request from a client to access the protected Web service resource from the communication network;

determine that the client has been authenticated according to a first factor;

grant the first request to access the protected Web service resource based on authentication according to the first factor;

receive a second request from the client to access the protected Web service resource from the communication network;

deny the second request to access the protected Web service resource based on the authentication according to the first factor being insufficient to grant the second request, including to send a message to the client directing the client to an authentication service to be authenticated according to a second factor;

determine that the client has been authenticated according to the second factor, and

grant the second request to access the protected Web service resource based on authentication according to the second factor including an evaluation of an authentication token.

2. The computing system of claim 1, wherein the first factor is selected from the group comprising:

a password, an answer to a security question, a biometric identifier, an object, and client specific information.

3. The computing system of claim 1, wherein the second factor is different from the first factor.

4. The computing system of claim 1, wherein the program instructions further cause the computing system to:

receive a first authentication token from the client after the client has been authenticated by an authentication service according to the first factor and use the first authentication token to determine that the client has been authenticated according to the first factor.

5. The computing system of claim 4, wherein the program instructions that determine that the client has been authenticated further causes the computing system to:

decrypt the first authentication token with a public key of the authentication service; and

determine that a claim made by the authentication service in the first authentication token satisfies a condition for access.

6. The computing system of claim 1, wherein the instructions that cause the computing system to determine that the client has been authenticated according to the second factor further cause the computing system to receive the authentication token from the client after being authenticated by the authentication service according to the second factor.

7. A method of controlling access to a protected Web service resource, the method comprising:

receiving at a processing device a first request from a client to access the protected Web service resource from the communication network;

determining, using the processing device, that the client has been authenticated according to a first factor;

granting the first request to access the protected Web service resource, using the processing device, based on authentication according to the first factor;

receiving a second request from the client to access the protected Web service resource from the communication network;

denying the second request to access the protected Web service resource, using the processing device, based on the authentication according to the first factor being insufficient to grant the second request, wherein denying the second request further comprises sending a message to the client directing the client to an authentication service to be authenticated according to a second factor;

determining that the client has been authenticated according to the second factor; and

granting the second request to access the protected Web service resource based on authentication according to the second factor including an evaluation of an authentication token.

8. The method of claim 7, wherein the first factor is selected from the group comprising:

a password, an answer to a security question, a biometric identifier, an object, and client specific information.

9. The method of claim 7, wherein the second factor is different from the first factor.

10. The method of claim 7, wherein the method further comprises receiving a first authentication token from the client after the client has been authenticated by an authentication service according to the first factor and using the first authentication token to determine that the client has been authenticated according to the first factor.

11. The method of claim 10, wherein determining that the client has been authenticated comprises:

decrypting the first authentication token with a public key of the authentication service; and

determining that a claim made by the authentication service in the first authentication token satisfies a condition for access.

12. The method of claim 7, wherein determining that the client has been authenticated according to a second factor comprises receiving an authentication token from the client after being authenticated by the authentication service according to the second factor.

13. A computing system for controlling access to a protected Web service resource, the computing system comprising:

a communication device for communicating across a communication network;

a processor communicatively connected to the communication device; and

memory storing program instructions, which when executed by the processor cause the computing system to;

receive a first request from a client to access the protected Web service resource from the communication network;

receive a first authentication token from the client after the client has been authenticated by an authentication service according to the first factor;

determine that the client has been authenticated according to a first factor using the first authentication token, wherein the program instructions that determine that the client has been authenticated according to the first factor further causes the computing system to;

decrypt the first authentication token with a public key of the authentication service; and

determine that a claim made by the authentication service in the first authentication token satisfies a condition for access;

grant the first request to access the protected Web service resource based on authentication according to the first factor;

receive a second request from the client to access the protected Web service resource from the communication network;

deny the second request to access the protected Web service resource based on the authentication according to the first factor being insufficient to grant the second request;

determine that the client has been authenticated according to the second factor; and

grant the second request to access the protected Web service resource based on authentication according to the second factor.

14. The computing system of claim 13, wherein the first factor is selected from the group comprising:

a password, an answer to a security question, a biometric identifier, an object, and client specific information.

15. The computing system of claim 13, wherein the second factor is different from the first factor.

16. The computing system of claim 13, wherein the program instructions that deny the second request further causes the computing system to send a message to the client directing the client to an authentication service to be authenticated according to the second factor.

17. The computing system of claim 13, wherein determining that the client has been authenticated according to a second factor comprises receiving the authentication token from the client after being authenticated by the authentication service according to the second factor.

18. The computing system of claim 13, wherein the program instructions that cause the computing system to grant the second request to access the protected Web services resource do so based on an evaluation of an authentication token.

19. A method of controlling access to a protected Web service resource, the method comprising:

receiving at a processing device a first request from a client to access the protected Web service resource from the communication network;

receiving at the processing device a first authentication token from the client after the client has been authenticated by an authentication service according to the first factor;

determining, using the processing device, that the client has been authenticated according to a first factor using the first authentication token, by;

decrypting the first authentication token with a public key of the authentication service; and

determining that a claim made by the authentication service in the first authentication token satisfies a condition for access;

granting the first request to access the protected Web service resource, using the processing device, based on authentication according to the first factor;

receiving a second request from the client to access the protected Web service resource from the communication network;

denying the second request to access the protected Web service resource, using the processing device, based on the authentication according to the first factor being insufficient to grant the second request;

determining that the client has been authenticated according to a second factor; and

granting the second request to access the protected Web service resource based on authentication according to the second factor.

20. The method of claim 19, wherein the first factor is selected from the group comprising:

a password, an answer to a security question, a biometric identifier, an object, and client specific information.

21. The method of claim 19, wherein the second factor is different from the first factor.

22. The method of claim 19, wherein determining that the client has been authenticated according to a second factor comprises receiving an authentication token from the client after being authenticated by the authentication service according to the second factor.