Leveraging a persistent connection to access a secured service

• US 7,707,627 B2
• Filed: 06/25/2007
• Issued: 04/27/2010
• Est. Priority Date: 04/11/2001
• Status: Expired due to Term

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: AOL Inc. (Apollo Global Management, Inc.)
• Inventors: Hirsh, Robert B.
• Primary Examiner(s): CERVETTI, DAVID GARCIA
• Application Number:
  US11/767,680
• Publication Number:
  US 20080010667A1
• Time in Patent Office: 1,037 Days
• Field of Search: 726/8, 726/10, 726/11, 726/22
• US Class Current: 726/10
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 67/55 Push-based network services

Abstract

Leveraging a persistent connection to provide a client access to a secured service may include establishing a persistent connection with a client in response to a first request from the client, and brokering a connection between the client and a secured service based on a second request from the client by leveraging the persistent connection with the client. The brokering may occur before the client attempts to connect to the secured service directly and the connection may be established between the client and the secured service without provision by the client of authentication information duplicative or additional to authentication information provided by the client to establish the persistent connection.

Claims

1. A method of leveraging a connection with a client to provide the client with access to a service, the method comprising;

establishing an authenticated connection with the client;

receiving, from the client, a request for access to a service;

in response to receiving the request for access to the service, sending, to a computer system associated with the service, a request for temporary access information for the service based on the established authenticated connection with the client;

receiving, from the computer system associated with the service, the temporary access information for the service; and

transmitting the temporary access information to the client to enable the client to provide the temporary access information to the computer system associated the service to establish an authenticated connection between the client and the service.

2. The method of claim 1 wherein receiving, from the computer system associated with the service, the temporary access information for the service includes receiving, from the computer system associated with the service, temporary access information that includes a constraint that the temporary access information be used within a predetermined time.

3. The method of claim 1 wherein receiving, from the computer system associated with the service, the temporary access information for the service includes receiving, from the computer system associated with the service, temporary access information that includes a target connection point.

4. The method of claim 3 wherein transmitting the temporary access information to the client to enable the client to provide the temporary access information to the computer system associated the service to establish an authenticated connection between the client and the service includes transmitting the temporary access information including the target connection point to the client to enable the client to provide the temporary access information to the computer system associated the service at the target connection point to establish an authenticated connection between the client and the service.

5. The method of claim 1 wherein receiving, from the computer system associated with the service, the temporary access information for the service includes receiving, from the computer system associated with the service, temporary access information that includes a constraint that the temporary access information be used no more than a predetermined number of times.

6. The method of claim 1 wherein receiving, from the computer system associated with the service, the temporary access information for the service includes receiving, from the computer system associated with the service, temporary access information that includes a constraint that the authorization information be received from only the client.

7. The method of claim 1 wherein receiving, from the computer system associated with the service, the temporary access information for the service includes receiving, from the computer system associated with the service, a temporary password.

8. The method of claim 1 wherein receiving, from the computer system associated with the service, the temporary access information for the service includes receiving, from the computer system associated with the service, temporary access information issued by the computer system associated with the service.

9. The method of claim 1 wherein:

sending, to the computer system associated with the service, the request for temporary access information for the service based on the established authenticated connection with the client includes sending, to the computer system associated with the service, proposed temporary access information in the request, and

receiving, from the computer system associated with the service, the temporary access information for the service includes receiving, from the computer system associated with the service, the proposed temporary access information included in the request and authenticated by the service.

10. The method of claim 1 wherein the service is available for direct authentication by a user without the user establishing an authenticated connection between the user and the intermediary.

11. At least one computer readable medium storing one or more computer programs including instructions that, when executed, perform operations comprising:

establishing an authenticated connection with a client;

receiving, from the client, a request for access to a service;

in response to receiving the request for access to the service, sending, to a computer system associated with the service, a request for temporary access information for the service based on the established authenticated connection with the client;

receiving, from the computer system associated with the service, the temporary access information for the service; and

transmitting the temporary access information to the client to enable the client to provide the temporary access information to the computer system associated the service to establish an authenticated connection between the client and the service.

12. The at least one medium of claim 11 wherein the instructions that, when executed, perform receiving, from the computer system associated with the service, the temporary access information for the service include instructions that, when executed, perform receiving, from the computer system associated with the service, temporary access information that includes a constraint that the temporary access information be used within a predetermined time.

13. The at least one medium of claim 11 wherein the instructions that, when executed, perform receiving, from the computer system associated with the service, the temporary access information for the service include instructions that, when executed, perform receiving, from the computer system associated with the service, temporary access information that includes target connection point.

14. The at least one medium of claim 11 wherein the instructions that, when executed, perform transmitting the temporary access information to the client to enable the client to provide the temporary access information to the computer system associated the service to establish an authenticated connection between the client and the service include instructions that, when executed, perform transmitting the temporary access information including the target connection point to the client to enable the client to provide the temporary access information to the computer system associated the service at the target connection point to establish an authenticated connection between the client and the service.

15. The at least one medium of claim 11 wherein the instructions that, when executed, perform receiving, from the computer system associated with the service, the temporary access information for the service include instructions that, when executed, perform receiving, from the computer system associated with the service, temporary access information that includes a constraint that the temporary access information be used no more than a predetermined number of times.

16. The at least one medium of claim 11 wherein the instructions that, when executed, perform receiving, from the computer system associated with the service, the temporary access information for the service include instructions that, when executed, perform receiving, from the computer system associated with the service, temporary access information that includes a constraint that the authorization information be received from only the client.

17. The at least one medium of claim 11 wherein the instructions that, when exeucted, perform receiving, from the computer system associated with the service, the temporary access information for the service include instructions that, when executed, perform receiving, from the computer system associated with the service, a temporary password.

18. The at least one medium of claim 11 wherein the instructions that, when exeucted, perform receiving, from the computer system associated with the service, the temporary access information for the service include instructions that, when executed, perform receiving, from the computer system associated with the service, temporary access information issued by the computer system associated with the service.

19. The at least one medium of claim 11 wherein:

the instructions that, when executed, perform sending, to the computer system associated with the service, the request for temporary access information for the service based on the established authenticated connection with the client include instructions that, when executed, perform sending, to the computer system associated with the service, proposed temporary access information in the request, and

the instructions that, when executed, perform receiving, from the computer system associated with the service, the temporary access information for the service include instructions that, when executed, perform receiving, from the computer system associated with the service, the proposed temporary access information included in the request and authenticated by the service.

20. A system comprising:

a client device;

an intermediary server; and

a service system, wherein;

the client device is configured to send, to the intermediary server, authentication information,

the intermediary server is configured to;

receive, from the client device, the authentication information, and

establish an authenticated connection with the client device based on the authentication information,

the client device is further configured to send, to the intermediary server, a request for access to a service,

the intermediary server is further configured to;

receive, from the client device, the request for access to the service, and

in response to receiving the request for access to the service, send, to the service system, a request for temporary access information for the service based on the established authenticated connection with the client,

the service system is configured to;

receive, from the intermediary server, the request for temporary access information for the service, and

in response to receiving the request for temporary access information for the service, send, to the intermediary server, the temporary access information for the service,

the intermediary server is further configured to;

receive, from the service system, the temporary access information for the service, and

in response to receiving the temporary access information for the service, send, to the client device, the temporary access information for the service,

the client device is further configured to;

receive, from the intermediary server, the temporary access information for the service, and

in response to receiving the requested temporary access information for the service, send, to the service system, the temporary access information for the service,

the service system is further configured to;

receive, from the client device, the temporary access information for the service, and

establish an authenticated connection with the client device based on receiving, from the client device, the temporary access information for the service.