Client authentication distributor

• US 20090007250A1
• Filed: 06/27/2007
• Published: 01/01/2009
• Est. Priority Date: 06/27/2007
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Pouzin, Dominic J., Lu, Michael James
• Application Number:
  US11/823,386
• Publication Number:
  US 20090007250A1
• Time in Patent Office: Days
• US Class Current: 726/10
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807

Abstract

The claimed method and system provides a client authentication distributor component (CAD) that handles multiple client application requests for authentication to a common authentication provider. In one embodiment, only a single user sign on process may be required after which the CAD manages future authentication processes on behalf of the user without the user requiring to provide credentials.

Claims

1. A method of managing client requests for authentication from an authentication provider comprising:

receiving a client authentication request from a first client for a first authentication provider at a client authentication distributor (CAD);

determining a first authentication state between the client authentication distributor (CAD) and the first authentication provider, wherein if the CAD is authenticated to the first authentication provider, the CAD provides to the first client a reference to an authentication ticket for communication with a first server authenticated by the first authentication provider;

and if the CAD is not authenticated to the first authentication provider, determining whether first credentials for the first authentication provider are cached, and if the first credentials are cached, performing a sign in with the first authentication provider using the cached first credentials, and if the first credentials are not cached, receiving credentials from a user for the first authentication provider and performing a login with the first authentication provider using the received credentials for the first authentication provider.

2. The method of claim 1, further comprising caching the credentials received from the user and periodically renewing, before expiration of the ticket, the authentication state with the first authentication provider using the cached credentials, thereby generating a renewed ticket.

3. The method of claim 1, further comprising maintaining the credentials in running program memory of the CAD and periodically renewing, before expiration of the ticket, the authentication state with the first authentication provider using the credentials in the CAD running program memory, thereby generating a renewed ticket.

4. The method of claim 1, wherein the credentials are received from the first client using a secure channel.

5. The method of claim 1, wherein the CAD periodically monitors at least one of a connection state and an authentication state.

6. The method of claim 5, wherein authentication state is monitored by checking the expiration of each ticket against a current time.

7. The method of claim 6, wherein the period of monitoring is adapted based on the state of the first client.

8. The method of claim 5, wherein a thread used to monitor connection state is placed in a sleep or hibernation state when the first client is offline and wherein the thread used to monitor connection state is run at an accelerated rate when the first client comes online or transitions out of a hibernation or sleep state.

9. The method of claim 5, further comprising generating notification events wherein the notification events comprise at least one of a current connection state, a current authentication state, or a state change.

10. The method of claim 9, wherein the notification events are received by a process for the first client that displays a status message based on the notification event.

11. The method of claim 1, further comprising receiving a client authentication request from a second client for the first authentication provider.

12. The method of claim 11, wherein a notification event is transmitted from the CAD to the first and second client indicating at least one of an authentication state, a connection state, or a state change.

13. The method of claim 1, further comprising receiving a second client authentication request for a second authentication provider at the client authentication distributor (CAD),

determining a second authentication state between the client authentication distributor (CAD) and the second authentication provider, wherein if the CAD is authenticated to the second authentication provider, the CAD provides to the client a reference to a second authentication ticket for communication with a server authenticated by the second authentication provider;

and if the CAD is not authenticated to the second authentication provider, determining whether second credentials for the second authentication provider are cached, and if the second credentials are cached, performing a sign in with the second authentication provider using the cached second credentials, and if the second credentials are not cached, receiving credentials for the second authentication provider from a user and performing a login with the first authentication provider using the received credentials for the second authentication provider.

14. A system of managing authentication state for a plurality of clients comprising:

a first client application;

a second client application;

a first authentication provider providing an authentication service for a first server application.

a client authentication distributor (CAD) that receives an authentication request from at least one of the first and second client application for the first authentication provider and provides a first authentication ticket to the at least one of the first and second client application if the CAD is authenticated by the first authentication provider, otherwise the CAD determines whether client credentials for the first authentication provider are cached, and if the client credentials for the first authentication provider are cached, performing a login process with the first authentication provider and providing a first generated authentication ticket to the at least one of the first and second client application.

15. The system of claim 14, wherein the first client application, the second client application, and the CAD are run on a first computing device.

16. The system of claim 14, further comprising a third client application, a fourth client application, and a second authentication provider providing an authentication service for a second server application,

wherein the CAD receives authentication requests from at least one of the third and fourth client application for the second authentication provider and provides a second authentication ticket to the at least one of the third and fourth client application if the client authentication distributor is authenticated by the second authentication provider, otherwise the CAD determines whether client credentials for the second authentication provider are cached, and if the client credentials for the second authentication provider are cached, performing a login process with the second authentication provider and providing a second generated authentication ticket to the at least one of the third and fourth client application.

17. A computing apparatus comprising:

a display unit that is capable of generating video images;

an input device;

a processing apparatus operatively coupled to the display unit and the input device, the processing apparatus comprising a processor and a memory operatively coupled to the processor;

a network interface connected to a network and to the processing apparatus;

the processing apparatus being programmed to;

run a first client application requiring access to a first server application;

run a second client application requiring access to the first server application;

receive an authentication request from the first and second client application for a first authentication provider and if an authentication ticket exists in a cache providing authentication to the first authentication provider, providing the cached ticket to the first and second client application, otherwise, determining whether client credentials for the first authentication provider are cached, and if the client credentials are cached, performing a login process with the first authentication provider and providing an authentication ticket generated by the login process to the first and second client application.

18. The computing apparatus of claim 17, wherein the processing apparatus is further programmed to display on the display unit an indication of at least one of a connection state, an authentication state, or a state change.

19. The computer apparatus of claim 17, wherein the processing apparatus is further programmed to maintain credential information in a running program memory of a client authentication distributor instance.

20. The computer apparatus of claim 19, wherein the processing apparatus is further programmed to renew authentication state using the cached credentials or, if the credentials are not cached, using the credential information in running program memory.