Multiple user authentication for online console-based gaming

• US 7,218,739 B2
• Filed: 03/09/2001
• Issued: 05/15/2007
• Est. Priority Date: 03/09/2001
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Chen, Ling Tony, Multerer, Boyd C., Anderson, Darren L.
• Primary Examiner(s): Vu; Kim
• Assistant Examiner(s): KLIMACH, PAULA W
• Application Number:
  US09/802,795
• Publication Number:
  US 20020126846A1
• Time in Patent Office: 2,258 Days
• Field of Search: 463/29, 463 42- 43, 463/26, 463/46, 380/251, 380/44, 380/23, 713/150, 713/168, 713/175, 713/169, 725/109, 273/138
• US Class Current: 380/251
• CPC Class Codes: A63F 13/12 involving interaction between a plurality of game devices, e.g. transmisison or distribution systems protocols for networked virtual reality, networked games H04L29/06034
• CPC Class Codes: A63F 13/30 Interconnection arrangements between game servers and game devices; Interconnection arrangements between game devices; Interconnection arrangements between game servers
• CPC Class Codes: A63F 13/71 using secure communication between game devices and game servers, e.g. by encrypting game data or authenticating players
• CPC Class Codes: A63F 13/843 involving concurrently two or more players on the same game device, e.g. requiring the use of a plurality of controllers or of a specific view of game data for each player
• CPC Class Codes: A63F 2300/401 Secure communication, e.g. using encryption or authentication
• CPC Class Codes: A63F 2300/532 using secure communication, e.g. by encryption, authentication
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807

Abstract

A console-based multi-user authentication process allows multiple users of a game console to be authenticated together in a single request/reply exchange with an authentication entity. The results of which is the possession of a single ticket that can be used to prove authenticity of multiple authentication principals to one or more online services. Also described is a handshake process that can be used to initially establish an authentication account for each game console, in which the account creation server can trust that a genuine game console is making the request.

Claims

1. A method comprising:

initiating an online gaming activity from a gaming console with multiple users; and

authenticating the multiple users of the gaming console, the gaming console, a game title, and an online service together in a single request/reply exchange between an authentication entity and the gaming console, the authenticating comprising;

submitting a request from the gaming console to the authentication entity, the request containing identities of the multiple users, a gaming console identity, a game title identity, and an identity of the online service; and

returning a reply from the authentication entity to the gaming console that can be used to authenticate the multiple users, the gaming console, and the game title in the online gaming activity, the reply containing a session key for communication between the gaming console and the online service, and the reply being encrypted with a key associated with the online service.

2. A method as recited in claim 1, wherein the authenticating further comprises:

forming, at the gaming console, the request containing an identity string that includes the gaming console identity, the game title identity, the identities of the multiple users, and the identity of the online service; and

creating, at the authentication entity, the reply containing the identity string along with the session key.

3. A method as recited in claim 1, wherein the authenticating comprises exchanging messages specified in the Kerberos protocol, the response message containing a ticket having a authorization data field which acknowledges that multiple identities have been authenticated.

4. One or more computer-readable media comprising computer-executable instructions that, when executed, perform the method as recited in claim 1.

5. A method comprising:

submitting a request from a game console to a ticket issuing entity, the request containing a game console identity, multiple user identities identifying multiple users of the game console, and an identity of an online service;

returning a ticket from the ticket issuing entity to the game console, the ticket containing the game console identity and the multiple user identities encrypted with a key associated with the online service, said returning including sending an attached session message along with the ticket from the ticket issuing entity to the game console, the attached session message including a randomly generated session key for communication between the game console and the online service;

passing the ticket from the game console to the online service; and

decrypting the ticket at the online service, wherein after the decrypting the authenticity of the multiple users contained in the ticket is trusted.

6. A method as recited in claim 5, wherein the single request further includes an identity of the game console, and wherein the identity of the game console is included in the ticket issued from the ticket issuing entity.

7. A method as recited in claim 5, further comprising sending some cryptographical information to prove knowledge of the user'"'"'s key while submitting the request.

8. A method as recited in claim 5, wherein the ticket further includes at least one of the online service identity, a time that the ticket is generated, a second time parameter indicative of when the ticket expires, and the randomly generated session key to be used in communication between the game console and the online service.

9. A method as recited in claim 5, wherein the attached session message is encrypted with a key associated with the game console.

10. A method as recited in claim 5, wherein the passing comprises sending a second message with a current time encrypted with the randomly generated session key.

11. A method as recited in claim 10, wherein the ticket further includes the randomly generated session key and the decrypting, at the online service, further comprises:

decrypting the ticket using the key associated with the online service to recover the session key;

decrypting the second message with the session key to recover the current time; and

authenticating the multiple users and the game console in an event that the recovered current time is within an acceptable time window from the current time.

12. A method as recited in claim 5, further comprising:

sending a reply from the online service to the game console; and

verifying, at the game console, an authenticity of the reply.

13. One or more computer-readable media comprising computer-executable instructions that, when executed, perform the method as recited in claim 5.

14. A method comprising:

creating, at a game console, multiple validated user identities (U₁, H₁), (U₂, H₂), . . . , (U_u, H_u) identifying multiple users of the game console composed of user identities U₁, U₂, . . . , U_u and associated values H₁, H₂, . . . , H_u derived from the user'"'"'s key;

forming, at the game console, a request containing an identity string that includes a game console identity X, a game title identity G, the multiple validated user identities, and an identity A of an online service, as follows;

Request=[X,G,A,(U₁,H₁), . . . ,(U_u,H_u)];

submitting the request from the game console to a ticket issuing entity;

creating, at the ticket issuing entity, a ticket containing the identity string and a session key K_XA encrypted with a key K_A associated with the online service, as follows;

Ticket=E_KA[K_XA,X,G,A,U₁,U₂,U₃,U₄];

sending the ticket along with the session key K_XA from the ticket issuing entity to the game console;

passing the ticket from the game console to the online service along with data encrypted using the session key K_XA; and

verifying the ticket at the online service by decrypting the ticket using the online service key K_A, extracting the session key K_XA from the decrypted ticket, and decrypting the data from the game console using the session key K_XA.

15. A method as recited in claim 14, wherein the creating comprises computing cryptographic hash digests of user keys associated with the multiple users, each user identity being a combination of the user identity and the cryptographic hash of an associated user key.

16. A method as recited in claim 14, wherein the creating comprises encrypting a time value using keys associated with the multiple users, each user identity being a combination of the user identity and the current time encrypted with the user key.

17. A method as recited in claim 14, wherein the request further includes an identity of the game console.

18. A method as recited in claim 14, wherein the ticket further includes at least one of a time that the ticket is generated and a second time parameter indicative of when the ticket expires.

19. A method as recited in claim 14, further comprising encrypting the session key K_XA with a key associated with the game console before said sending of the session key to the game console.

20. A method as recited in claim 14, wherein the data comprises a time value representative of a current time.

21. A method as recited in claim 14, wherein the data comprises a time value representative of a current time, and the verifying comprises authenticating the game console and the multiple users in an event that the time value received from the game console is within an acceptable time window from a current time.

22. A method as recited in claim 21, further comprising:

sending a reply from the online service to the game console, the reply containing the time value encrypted using the session key K_XA; and

verifying, at the game console, an authenticity of the online service in an event that the game console successfully decrypts the time value using the session key K_XA, and the time value returned matches the time value sent to the online service.

23. One or more computer-readable media comprising computer-executable instructions that, when executed, perform the method as recited in claim 14.

24. A method for operating a game console, comprising:

submitting a request to a ticket issuing entity, the request containing multiple user identities identifying multiple users of the game console, a game title, an identity of the game console, and an identity of an online service; and

receiving a single ticket from the ticket issuing entity that can be used to authenticate the multiple user identities and the game title to the online service, the single ticket including a randomly generated session key to be used in communication between the game console and the online service.

25. A method as recited in claim 24, further comprising cryptographically deriving the user identifies from information associated with the users.

26. A method as recited in claim 24, wherein the ticket includes at least one of (1) the multiple user identities, (2) the identity of the online service, (3) an identity of the game console, (4) an identity of a game title being played in the game console, (5) a time that the ticket is generated, and (6) a second time parameter indicative of when the ticket expires.

27. A method as recited in claim 24, further comprising sending the ticket to the online service.

28. One or more computer-readable media comprising computer-executable instructions that, when executed, perform the method as recited in claim 24.

29. A method comprising:

receiving a request from a game console, the request containing multiple user identities of multiple users at the game console, a game console identity, a game title identity, and an identity of a third party;

generating a single ticket that can be used to authenticate the multiple user identities, the game console identity, and the game title identity to the third party, the single ticket including a randomly generated session key to be used in communication between the game console and the third party; and

returning the ticket to the game console.

30. A method as recited in claim 29, wherein the ticket includes at least one of (1) the multiple user identities, (2) the identity of the third party, (3) the game console identity, (4) the game title identity being played in the game console, (5) a time that the single ticket is generated, and (6) a second time parameter indicative of when the single ticket expires.

31. A method as recited in claim 29, further comprising encrypting the ticket with a key associated with the third party prior to said returning the ticket.

32. A method as recited in claim 29, further comprising:

sending the session key to the game console.

33. One or more computer-readable media comprising computer-executable instructions that, when executed, perform the method as recited in claim 29.

34. A game console, comprising:

a memory; and

a processor coupled to the memory, the processor being configured to obtain authentication of multiple users of the game console together in a single request/reply exchange with an authentication entity, wherein the single request/reply exchange identifies the multiple users, the game console, a game title, and an online service;

the processor being further configured to process a reply from the authentication entity that can be used to authenticate the multiple users, the game console, and the game title, the reply containing a session key for communication between the game console and the online service where the reply is encrypted with a key associated with the online service.

35. A game console as recited in claim 34 wherein the memory comprises a hard disk drive with an associated hard disk ID and the processor has an associated processor ID, and the processor is configured to submit at least one of the hard disk ID, the CPU ID, and a value derived from the CPU ID to a third party as part of a process to obtain the game console identity.

36. A system, comprising:

a ticketing issuing entity;

a game console configured to submit a request to the ticket issuing entity, the request containing multiple user identities identifying multiple users of the game console, a game console identity, a game title identity, and an identity of an online service; and

the ticket issuing entity being configured to generate a single ticket that can be used by the game console to authenticate the multiple user identities, the game console identity, and the game title identity to the online service, the single ticket including a randomly generated session key for communication between the game console and the online service when the single ticket is received at the game console.