USER AUTHENTICATION IN A CLOUD ENVIRONMENT

• US 20140373126A1
• Filed: 06/14/2013
• Published: 12/18/2014
• Est. Priority Date: 06/14/2013
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Hussain, Amjad, Sampath, Sriram, Ben-Shachar, Ido Miles, Eremenko, Andrew, Alladi, Mahadeva Kumar, Scott, Tristan William, Howe, Travis Michael
• Granted Patent: US 9,124,569 B2
• Time in Patent Office: Days
• US Class Current: 726/9
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: H04L 2463/062 applying encryption of the keys cryptographic mechanisms or cryptographic arrangements for key distribution using key encryption key H04L9/0822
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

Embodiments are directed to authenticating a user to a remote application provisioning service. In one scenario, a client computer system receives authentication credentials from a user at to authenticate the user to a remote application provisioning service that provides virtual machine-hosted remote applications. The client computer system sends the received authentication credentials to an authentication service, which is configured to generate an encrypted token based on the received authentication credentials. The client computer system then receives the generated encrypted token from the authentication service, stores the received encrypted token and the received authentication credentials in a data store, and sends the encrypted token to the remote application provisioning service. The encrypted token indicates to the remote application provisioning service that the user is a valid user.

Claims

1. A client computer system comprising the following:

one or more processors;

system memory;

one or more computer-readable storage media having stored thereon computer-executable instructions that, when executed by the one or more processors, causes the computing system to perform a method for authenticating a user to a remote application provisioning service, the method comprising the following;

an act of receiving one or more authentication credentials from a user at the client computing system to authenticate the user to a remote application provisioning service that provides virtual machine-hosted remote applications;

an act of sending the received authentication credentials to an authentication service, the authentication service being configured to generate an encrypted token based on the received authentication credentials;

an act of receiving the generated encrypted token from the authentication service;

an act of storing the received encrypted token and the received authentication credentials in a data store; and

an act of sending the encrypted token to the remote application provisioning service, the encrypted token indicating to the remote application provisioning service that the user is a valid user.

2. The client computer system of claim 1, further comprising:

an act of receiving from the remote application provisioning service an indication of one or more remote applications the user is allowed to access;

an act of receiving from the user an indication indicating that at least one of the remote applications is to be instantiated;

an act of sending the user'"'"'s stored authentication credentials and the stored encrypted token to the virtual machine that is hosting the specified remote application; and

upon being authenticated to the virtual machine that is hosting the specified remote application, an act of accessing the specified instantiated remote application.

3. The client computer system of claim 2, wherein the token is encrypted such that it is only decryptable by the virtual machine that is hosting the specified remote application.

4. The client computer system of claim 3, wherein the specified remote application is accessed using a remote desktop protocol (RDP) session established between the virtual machine and the client computer system.

5. The client computer system of claim 1, wherein a previously generated, cached encrypted token is sent with the user'"'"'s authentication credentials to the remote application provisioning service.

6. The client computer system of claim 1, wherein one or more portions of connection data are sent to the remote application provisioning service in addition to the encrypted token, the connection data indicating how the connection between the client computer system and the remote application provisioning service is to be established.

7. The client computer system of claim 1, wherein the authentication service further verifies that the user is a member of an organization that is providing the virtual machine-hosted remote applications.

8. The client computer system of claim 1, wherein the authentication credentials are received at a web page provided by the remote application provisioning service.

9. The client computer system of claim 1, wherein the authentication credentials are received from a remote application that was presented in a list of remote applications to which the user is subscribed.

10. The client computer system of claim 1, further comprising:

an act of determining that a specified period of time has elapsed since the encrypted token was generated; and

an act of resending the user'"'"'s authentication credentials to the authentication service for reissuance of the token.

11. The client computer system of claim 1, wherein the token is sent to the remote application provisioning service in a hypertext transfer protocol (HTTP) header.

12. The client computer system of claim 1, wherein only the encrypted token is sent to the authentication service, such that the user'"'"'s credentials are not sent to the authentication service.

13. A computer system comprising the following:

one or more processors;

system memory;

one or more computer-readable storage media having stored thereon computer-executable instructions that, when executed by the one or more processors, causes the computing system to perform a method for authenticating a user at a remote application provisioning service, the method comprising the following;

an act of receiving, at a remote application provisioning service, an encrypted token from a client computer system, the encrypted token being generated based on authentication credentials provided by a user;

an act of the remote application provisioning service decrypting the received encrypted token;

an act of determining the user'"'"'s identity from the decrypted token;

an act of determining, based on the user'"'"'s identity, which remote applications the user is authorized to access; and

an act of providing to the user an indication of those remote applications that are available for use.

14. The computer system of claim 13, wherein the encrypted token was generated using a cloud-based authentication service.

15. The computer system of claim 13, wherein the remote applications are provided to the user in a web interface.

16. The computer system of claim 13, wherein the remote applications are provided to the user in an operating system folder.

17. The computer system of claim 16, wherein the operating system folder includes those remote applications to which the user is subscribed.

18. A computer system comprising the following:

one or more processors;

system memory;

one or more computer-readable storage media having stored thereon computer-executable instructions that, when executed by the one or more processors, causes the computing system to perform a method for authenticating a user to a remote application provisioning service, the method comprising the following;

an act of receiving, at a remote application provisioning service, an indication from a user indicating that a specified remote application is to be instantiated, the indication including an encrypted token that was generated based on authentication credentials received from the user;

an act of decrypting the received encrypted token to determine the user'"'"'s identity;

an act of verifying that the user has permission to access the specified remote application; and

an act of the remote application provisioning service sending the encrypted token to a remote application virtual machine host that provides access to the specified remote application using the encrypted token and the user'"'"'s authentication credentials.

19. The computer system of claim 18, wherein the virtual machine host provides access to one or more private resources.

20. The computer system of claim 18, wherein the user'"'"'s authentication credentials are used to both determine which applications are available to the user and to log the user in to the virtual machine host that provides the specified remote application.