Federated realm discovery

• US 9,935,936 B2
• Filed: 06/27/2017
• Issued: 04/03/2018
• Est. Priority Date: 06/19/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Guo, Wei-Qiang, Ayres, Lynn, Chen, Rui, Faulkner, Sarah, Rouskov, Yordan
• Primary Examiner(s): Wang, Harris C
• Application Number:
  US15/634,899
• Publication Number:
  US 20170295166A1
• Time in Patent Office: 280 Days
• Field of Search: 726 4
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853

Abstract

A federated realm discovery system within a federation determines a “home” realm associated with a portion of the user'"'"'s credentials before the user'"'"'s secret information (such as a password) is passed to a non-home realm. A login user interface accepts a user identifier and, based on the user identifier, can use various methods to identify an account authority service within the federation that can authenticate the user. In one method, a realm list of the user device can be used to direct the login to the appropriate home realm of the user. In another method, an account authority service in a non-home realm can look up the user'"'"'s home realm and provide realm information directing the user device to login at the home realm.

Claims

1. A computing system including:

one or more processor; and

one or more storage device having stored computer-executable instructions which, when executed by the one or more processors, cause the computing system to perform a computer process that includes;

receiving, at a user device and via a non-home security authority login user interface implemented at the user device, user credentials of a user, the user credentials comprising at least an identifier of the user and a password;

requesting, by the user device, identification of a home security authority of the user based on the user credentials by accessing a realm list datastore of the user device, the user device having an account with the home security authority but not with the non-home security authority;

responsive to said requesting, receiving the identification of the home security authority of the user; and

requesting authentication for the user to access the non-home security authority from the identified home security authority of the user without sending the user credentials to the non-home security authority.

2. The computing system of claim 1, wherein the non-home security authority and the home security authority are members of a federation.

3. The computing system of claim 1, wherein the computing system includes the user device.

4. The computing system of claim 1, further comprising receiving a security token from the identified home security authority for access by the user to a network service.

5. The computing system of claim 1, wherein requesting identification further comprises sending a request via a communications network to the non-home security authority, the request not including a secret credential of the user credentials of the user, the request requesting the non-home security authority to identify the home security authority of the user.

6. The computing system of claim 1, wherein the requesting identification further comprises sending a request via a communications network to the non-home security authority, prior to receipt of all of characters of the user credentials.

7. The computing system of claim 1, wherein the requesting comprises sending a request via a communications network to the non-home security authority, prior to receipt of a secret credential of the user credentials by the login user interface.

8. The computing system of claim 1, wherein requesting authentication further comprises requesting authentication from the identified home security authority of the user without presenting the user with a separate login user interface from the home security authority.

9. A computing system comprising:

one or more processor; and

one or more storage device having stored computer-executable instructions which, when executed by the one or more processors, cause the computing system to perform a computer process that includes;

presenting to a user a login user interface for a non-home security authority within a federation, the non-home security authority and a home security authority being members of the federation, the user having an account with the home security authority but not with the non-home security authority;

receiving, via the login user interface for the non-home security authority, user credentials of the user, the user credentials comprising at least a portion of a user identifier unique to the user, said receiving performed independent of transmitting the user credentials to the non-home security authority;

requesting identification of the home security authority of the user based on the user credentials from a realm list datastore;

responsive to the requesting, receiving identification of the home security authority of the user; and

transmitting the user credentials of the user, including the user identifier and associated secret information of the user, to the identified home security authority to request authentication for the user to access the non-home security authority without transmitting the associated secret information of the user to the non-home security authority.

10. The computing system of claim 9, wherein the receiving operation receives the user credentials of the user through the login user interface from the non-home security authority but does not transmit the associated secret information of the user to the non-home security authority.

11. The computing system of claim 9, wherein the computer process further comprises receiving a security token from the identified home security authority for access by the user to a network service.

12. The computing system of claim 9, wherein the requesting further comprises sending a request via a communications network to the non-home security authority, the request including the at least a portion of the user identifier and not including the associated secret information of the user, the request requesting the non-home security authority to identify the home security authority of the user.

13. The computing system of claim 9, wherein the requesting further comprises sending a request via a communications network to the non-home security authority, prior to receipt of all of characters of the user identifier.

14. The computing system of claim 9, wherein the requesting further comprises sending a request via a communications network to the non-home security authority, prior to receipt of a secret credential of the user by the login user interface.

15. The computing system of claim 9, wherein transmitting the user credentials further comprises transmitting the user credentials of the user to the identified home security authority without presenting the user with a separate login user interface from the home security authority.