Elevating trust in user identity during RESTful authentication and authorization

• US 10,110,584 B1
• Filed: 09/15/2016
• Issued: 10/23/2018
• Est. Priority Date: 08/20/2012
• Status: Active Grant

• Current Assignee: Crowdstrike, Inc. (CrowdStrike Holdings Incorporated)
• Original Assignee: Jericho Systems Corporation
• Inventors: Schmoyer, Timothy, Dufel, Michael, Staggs, David, Subramanium, Vijayababu
• Primary Examiner(s): Mehedi, Morshed
• Assistant Examiner(s): Lakhia, Viral S
• Application Number:
  US15/266,096
• Time in Patent Office: 768 Days
• Field of Search: 726 1, 726 7, 726 14, 713180-182, 455558
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/01 Protocols

Abstract

Credentials sent over a back channel during the authentication of a user to a RESTful service can elevate the trust the recipient system can place in the user'"'"'s identity. The addition of an identity credential of higher strength can increase confidence in user identities electronically presented with a lower strength credential. Attributes from either credential can be used to determine authorization to a protected resource.

Claims

1. A computer-implemented method for authorizing an entity to access a protected resource, said method comprising:

receiving at a RESTful service implemented at a first server having a first processor and first memory a request by the entity to access the protected resource;

providing an indication of the request to a relying party implemented at a second server having a second processor and second memory that facilitates entity authentication;

receiving, at the RESTful service, a first credential transmitted upon a front channel;

receiving, at the RESTful service, a second credential comprising a SAML credential transmitted upon a back channel;

authenticating the entity based upon the first and second credentials, respectively; and

authorizing the entity, once authenticated, to access the protected resource based upon attributes contained in the SAML credential that comprises the second credential.

2. The method of claim 1 wherein said authenticating comprises authenticating the entity based upon credential strengths of the first and second credentials.

3. The method of claim 1 wherein said providing the indication comprises redirecting the request to the relying party.

4. The method of claim 1 further comprising storing the first credential and the second credential at the relying party.

5. The method of claim 4 wherein said receiving the first credential comprises receiving the first credential from the relying party.

6. The method of claim 4 wherein said receiving the second credential comprises receiving the second credential from the relying party.

7. The method of claim 1 wherein the second credential transmitted upon the back channel is transmitted in encrypted form.

8. The method of claim 1 wherein the first credential comprises a CAS credential.

9. A computer-implemented system for authorizing an entity to access a protected resource, said system comprising:

a RESTful service implemented at a first server having a first processor and first memory and operable to;

receive a request by the entity to access the protected resource;

provide an indication of the request to a relying party implemented at a second server having a second processor and second memory that facilitates entity authentication;

receive a first credential transmitted upon a front channel;

receive a second credential comprising a SAML credential transmitted upon a back channel;

authenticate the entity based upon the first and second credentials, respectively; and

authorize the entity to access the protected resource based upon attributes contained in the SAML credential that comprises the second credential.

10. The system of claim 9 wherein said RESTful service is operable to authenticate the entity based upon credential strengths of the first and second credentials.

11. The system of claim 9 wherein said RESTful service is operable to provide the indication by redirecting the request to the relying party.

12. The system of claim 9 wherein said RESTful service is further operable to store the first credential and the second credential at the relying party.

13. The system of claim 12 wherein said RESTful service is operable to receive the first credential from the relying party.

14. The system of claim 12 wherein said RESTful service is operable to receive the second credential from the relying party.

15. The system of claim 9 wherein the second credential transmitted upon the back channel is transmitted in encrypted form.

16. The system of claim 9 wherein the first credential comprises a CAS credential.