Method and apparatus for communicating authorization data

• US 7,444,518 B1
• Filed: 09/29/2003
• Issued: 10/28/2008
• Est. Priority Date: 06/16/2003
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Paya, Cem, Mathew, Ashvin, Dharmarajan, Baskaran
• Primary Examiner(s): Truong; Thanhnga B.
• Assistant Examiner(s): SHAN, APRIL YING
• Application Number:
  US10/674,105
• Time in Patent Office: 1,856 Days
• Field of Search: 726/27, 726/4, 726/2, 726/3, 726/9, 726/10, 713/182, 713/185
• US Class Current: 713/185
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/166 at the transport layer

Abstract

A permission level associated with a child'"'"'s access to a Web server is identified. A relationship ticket is obtained from an authentication server and a request is generated to set the identified permission level. The request and the relationship ticket are sent to the Web server and a success code is received from the Web server if the requested permission level is established.

Claims

1. A method comprising:

communicating, by a first entity via a client computing device, a first entity'"'"'s identity to an authentication server for verification;

receiving a relationship ticket from the authentication server after the first entity'"'"'s identity has been successfully verified, wherein the relationship ticket received from the authentication server is encrypted so that the relationship ticket cannot be decrypted by the client computing device which receives the relationship ticket, and wherein the relationship ticket includes the first entity'"'"'s identity and identifies a second entity who'"'"'s access to a web server is to be limited;

generating, by the first entity via the client computing device, a request to establish a selected permission level for the second entity which will limit the second entity'"'"'s access to the web server;

sending, by the first entity via the client computing device, the request and the relationship ticket to the web server to;

decrypt the relationship ticket;

perform an integrity check of the relationship ticket using a message authentication code contained within the relationship ticket;

authenticate the first entity'"'"'s identity, wherein the web server authenticates the first entity'"'"'s identity with the authentication server using contents of the relationship ticket; and

establish the selected permission level for the second entity; and

receiving, by the first entity via the client computing device, a success code from the web server if the selected permission level is established for the second entity; and

wherein the method does not require use of secure communications protocols including SSL (Security Socket Layer) and the client computing device, the web server and the authentication server communicate using an unsecure or untrusted communication link.

2. A method as recited in claim 1 further including receiving a failure notification from the web server if the selected permission level is not established.

3. A method as recited in claim 1 wherein sending the request to the web server includes using an untrusted connection with the web server.

4. A method as recited in claim 1 wherein the request to the web server is sent using an unsecure connection with the web server.

5. A method as recited in claim 1 wherein the relationship ticket is encrypted by the authentication server.

6. A method as recited in claim 1 wherein the selected permission level is established if the relationship ticket is authenticated.

7. A method as recited in claim 1 wherein the authentication server is a .NET Passport server.

8. A method as recited in claim 1 wherein selecting a permission level associated with a second entity'"'"'s usage of a web site is performed by a first entity that has authority to select the permission level associated with the second entity'"'"'s usage of the web site.

9. A computer program stored in one or more computer storage media to execute the method recited in claim 1.