Connecting and Retrieving Security Tokens Based on Context

• US 20170171211A1
• Filed: 04/22/2016
• Published: 06/15/2017
• Est. Priority Date: 12/13/2015
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Natarajan, Shriram, Tsurbeleu, Pavel, Pogrebinsky, Vladimir
• Granted Patent: US 10,084,785 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

An application may be configured with two or more cloud contexts and one or more identity Systems. Using this information, the application has the ability to identify the remote cloud environment that a particular subsystem needs to interact with. The application communicates with the appropriate identity system to retrieve tokens dynamically for targeting that remote cloud.

Claims

1. A system comprising:

a first cloud system hosting a first resource having a first extension, the first cloud system having a first identity system and first API layer used by the first resource and the first extension; and

the resource having a second extension loaded from a second cloud system having a second identity system and second API layer, wherein the first cloud system loads security tokens from the second identity system to allow the second extension to communicate using the second API layer.

2. The system of claim 1, wherein the resource is a website.

3. The system of claim 1, wherein the first cloud is a public cloud and the second cloud is a private cloud.

4. The system of claim 1, wherein the first cloud is a private cloud and the second cloud is a public cloud.

5. The system of claim 1, wherein a user may be connected to both the first and second clouds simultaneously from the same browser in the same session.

6. The system of claim 1, wherein an application on the first cloud fetches security tokens from an authentication system of the second cloud on behalf of a current user.

7. The system of claim 1, wherein the first cloud system maintains a chain of security tokens for a user, and wherein the security tokens target different clouds.

8. The system of claim 7, wherein the security tokens are issued to the UI components of first cloud based upon an associated remote cloud.

9. The system of claim 1, further comprising:

a browser, wherein content from a website hosted on the first cloud and content from a website hosted on the second cloud is rendered in the same inline frame in the browser.

10. A method for accessing resources across a plurality of distributed computing networks, comprising:

providing a resource on a first computing network, the resource comprising a first extension associated with a first identity system and a second extension associated with a second identity system, wherein the first identify system is hosted on the first computing network and the second identity system is hosted on a remote computing network;

loading one or more first security tokens from the first identity system to allow a user on the first computing network to access the first extension; and

loading one or more second security tokens from the remote computing network to allow the user on the first computing network to access the second extension.

11. The method of claim 10, further comprising:

identifying the user on the first computing network; and

retrieving security tokens from the remote computing network based upon the user'"'"'s identity.

12. The method of claim 10, wherein the second identity system is an authentication system.

13. The method of claim 10, wherein the user access both the first extension and the second extension on the resource.

14. The method of claim 10, wherein the resource is a website and the extensions correspond to windows displayed on the website.

15. The method of claim 10, wherein one of the first computing network and the remote computing network is a private cloud service and the other computing network is a public cloud service.

16. A system comprising:

a first distributed computing network hosting a resource having a first extension, the first distributed computing network having a first identity system used by the resource and the first extension;

the resource having a second extension loaded from a second distributed computing network having a second identity system, wherein the first distributed computing network loads security tokens from the second identity system to allow users to access the second extension; and

storage for maintaining a plurality of security tokens associated with a user, the group of tokens allowing the user to access extensions from a plurality of distributed computing networks.

17. The system of claim 16, further comprising

the resource having one or more additional extensions loaded from one or more additional distributed computing networks each having its own identity system and API layer, wherein the first system loads security tokens from the identity systems on the one or more additional distributed computing network to allow users to access the one or more additional extensions.

18. The system of claim 17, wherein the distributed computing networks include both one or more public cloud service and one or more private cloud service.

19. The system of claim 16, wherein a user may be connected to both the first and second distributed computing networks simultaneously from the same resource in the same session.

20. The system of claim 16, wherein an application on the first distributed computing network fetches security tokens from an authentication system of the second distributed computing network on behalf of a current user.