Methods and systems for single sign-on while protecting user privacy

• US 10,693,863 B2
• Filed: 05/04/2018
• Issued: 06/23/2020
• Est. Priority Date: 06/07/2013
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Huhn, Derrick S., Werner, Jeremy M., Pattekar, Amol V.
• Primary Examiner(s): Desrosiers, Evans
• Application Number:
  US15/972,076
• Publication Number:
  US 20180359243A1
• Time in Patent Office: 781 Days
• Field of Search: 726 8
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

A method of enabling applications to reference user information is provided, including receiving a request for a user identifier that references a user of the application and sending a second request for the user identifier to a server. The second request may include a second user identifier that references the user and a second authentication token for the second user identifier. Furthermore, the second user identifier and the second authentication token are not accessible by the user. The method includes receiving the user identifier and an authentication token for the first user identifier. The user identifier corresponds to the second identifier; and providing the user identifier and authentication token to the application. A method of enabling an application to identify users associated with a user of the application is provided; the method may include receiving, from the server, user identifiers that reference one or more users scoped to the application.

Claims

1. A method for enabling an application executing on a computing device to identify a user of the application, the method comprising, at a server computing device:

receiving, from the computing device, a request for a first user identifier that is known to the application, wherein the request includes;

(1) a second user identifier that references the user, and

(2) an application identifier associated with the application;

retrieving the first user identifier based on the second user identifier and the application identifier; and

providing a package to the computing device, wherein;

the package includes the first user identifier and an authentication token, and

the package causes the computing device to provide the first user identifier to the application in response to verifying the authentication token.

2. The method of claim 1, wherein the application is associated with a container, and the container is associated with at least one other application that is distinct from the application.

3. The method of claim 1, wherein retrieving the first user identifier based on the second user identifier and the application identifier comprises:

determining that an association exists between the second user identifier and the application identifier, and

retrieving the first user identifier from a mapping table associated with the application identifier.

4. The method of claim 3, wherein the mapping table includes an entry that associates the first user identifier with the second user identifier.

5. The method of claim 3, further comprising:

generating the authentication token in conjunction with retrieving the first user identifier from the mapping table.

6. The method of claim 1, wherein:

the first user identifier references the user only within a scope of the application, and

the second user identifier is not accessible to the application.

7. The method of claim 1, wherein the computing device utilizes the authentication token to verify an identity of the user.

8. At least one non-transitory computer readable storage medium configured to store instructions that, when executed by at least one processor included in a server computing device, cause the server computing device to enable an application executing on a computing device to identify a user of the application, by carrying out steps that include:

receiving, from the computing device, a request for a first user identifier that is known to the application, wherein the request includes;

(1) a second user identifier that references the user, and

(2) an application identifier associated with the application;

retrieving the first user identifier based on the second user identifier and the application identifier; and

providing a package to the computing device, wherein;

the package includes the first user identifier and an authentication token, and

the package causes the computing device to provide the first user identifier to the application in response to verifying the authentication token.

9. The at least one non-transitory computer readable storage medium of claim 8, wherein the application is associated with a container, and the container is associated with at least one other application that is distinct from the application.

10. The at least one non-transitory computer readable storage medium of claim 8, wherein retrieving the first user identifier based on the second user identifier and the application identifier comprises:

determining that an association exists between the second user identifier and the application identifier, and

retrieving the first user identifier from a mapping table associated with the application identifier.

11. The at least one non-transitory computer readable storage medium of claim 10, wherein the mapping table includes an entry that associates the first user identifier with the second user identifier.

12. The at least one non-transitory computer readable storage medium of claim 10, wherein the steps further include:

generating the authentication token in conjunction with retrieving the first user identifier from the mapping table.

13. The at least one non-transitory computer readable storage medium of claim 8, wherein:

the first user identifier references the user only within a scope of the application, and

the second user identifier is not accessible to the application.

14. The at least one non-transitory computer readable storage medium of claim 8, wherein the computing device utilizes the authentication token to verify an identity of the user.

15. A server computing device configured to enable an application executing on a computing device to identify a user of the application, the server computing device comprising:

at least one processor; and

at least one memory storing instructions that, when executed by the at least one processor, cause the server computing device to;

receive, from the computing device, a request for a first user identifier that is known to the application, wherein the request includes;

(1) a second user identifier that references the user, and

(2) an application identifier associated with the application;

retrieve the first user identifier based on the second user identifier and the application identifier; and

provide a package to the computing device, wherein;

the package includes the first user identifier and an authentication token, and

the package causes the computing device to provide the first user identifier to the application in response to verifying the authentication token.

16. The server computing device of claim 15, wherein the application is associated with a container, and the container is associated with at least one other application that is distinct from the application.

17. The server computing device of claim 15, wherein retrieving the first user identifier based on the second user identifier and the application identifier comprises:

determining that an association exists between the second user identifier and the application identifier, and

retrieving the first user identifier from a mapping table associated with the application identifier.

18. The server computing device of claim 17, wherein the mapping table includes an entry that associates the first user identifier with the second user identifier.

19. The server computing device of claim 17, wherein the at least one processor further causes the server computing device to:

generate the authentication token in conjunction with retrieving the first user identifier from the mapping table.

20. The server computing device of claim 15, wherein:

the first user identifier references the user only within a scope of the application, and

the second user identifier is not accessible to the application.