Session key security protocol

• US 7,971,240 B2
• Filed: 04/20/2009
• Issued: 06/28/2011
• Est. Priority Date: 05/15/2002
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Howard, John Hal, Guo, Wei-Quiang Michael, Chan, Kok Wai
• Primary Examiner(s): Simitoski; Michael J
• Assistant Examiner(s): SHAW, YIN CHEN
• Application Number:
  US12/426,726
• Publication Number:
  US 20090204808A1
• Time in Patent Office: 799 Days
• Field of Search: 713/168, 713/170, 713/176, 713/181, 380277-278, 726/10
• US Class Current: 726/10
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Exchanging information in a multi-site authentication system. A network server receives, from an authentication server, a request by a client computing device for a service provided by the network server along with an authentication ticket. The authentication ticket includes: a session key encrypted by a public key associated with the network server, message content encrypted by the session key, and a signature for the encrypted session key and the encrypted message content. The signature includes address information of the network server. The network server identifies its own address information in the signature to validate the signature included in the authentication ticket and verifies the authentication ticket content based on the signature included in the authentication ticket. The network server decrypts the encrypted session key via a private key associated with the second network server and decrypts the encrypted message content via the decrypted session key.

Claims

1. A method for exchanging information in a multi-site authentication system having a first network server and a second network server coupled to a data communication network, said method comprising:

receiving, from a client computing device via the first network server, a request for a service provided by the second network server;

receiving, from the first network server, an authentication ticket along with the request, said authentication ticket including;

a session key encrypted by a public key associated with the second network server;

message content encrypted by the session key; and

a signature generated by the first network server using a private key associated with the first network server to sign the encrypted session key and the encrypted message content, said signature including address information of the second network server;

decrypting, at the second network server, the signature included in the authentication ticket using a public key associated with the first network server that corresponds to the private key used to generate the signature;

identifying, at the second network server, the address information for the second network server in the verified signature to validate the signature included in the authentication ticket;

verifying, at the second network server, the authentication ticket content based on the validated signature included in the authentication ticket;

decrypting, at the second network server, the encrypted session key included in the authentication ticket via a private key associated with the second network server; and

decrypting, at the second network server, the encrypted message content included in the authentication ticket via the decrypted session key.

2. The method of claim 1 wherein the first network server is an authentication server associated with the multi-site authentication system and wherein the message content includes login information retrieved from a user of the client computing device by said authentication server.

3. The method of claim 2 wherein the login information includes a login ID and a password associated with the login ID.

4. The method of claim 1 wherein the second network server is a portal for providing the client computing device with a gateway to services provided by another network server coupled to the data communication network.

5. The method of claim 1 wherein the first and second network servers are web servers and the data communication network is the Internet.

6. The method of claim 1 wherein the address information of the second network server includes the domain name of the second network server.

7. The method of claim 1 wherein the session key is randomly generated, single-use session key.

8. The method of claim 1 wherein the second network server includes one or more computer-readable storage media having computer-executable instructions executed by said second network server to implement said receiving a request for a service, said receiving an authentication ticket, said identifying, said verifying, said decrypting the encrypted session key, and said decrypting the encrypted message content.

9. A system for exchanging in a multi-site authentication system having an authentication server coupled to a data communication network, said system comprising:

a network server coupled to the data communication network, wherein said network server includes a processor executing instructions stored on one or more computer-readable storage media to perform the following operations;

receiving, from a client computing device via the authentication server, a request for a service provided by the network server;

receiving, from the authentication server, an authentication ticket along with the request, said authentication ticket including a session key encrypted by a public key associated with the network server, message content encrypted by the session key, and a signature generated by the authentication server using a private key associated with the authentication server to sign the encrypted session key and the encrypted message content, said signature including address information of the network server;

decrypting the signature included in the authentication ticket using a public key associated with the authentication server that corresponds to the private key used to generate the signature;

identifying the address information of the network server in the signature to validate the signature included in the authentication ticket;

verifying the authentication ticket content based on the validated signature included in the authentication ticket;

decrypting the encrypted session key included in the authentication ticket via a private key associated with the network server; and

decrypting the encrypted message content included in the authentication ticket via the decrypted session key.

10. The system of claim 9 wherein the message content includes login information retrieved from a user of the client computing device by the authentication server.

11. The system of claim 10 wherein the login information includes a login ID and a password associated with the login ID.

12. The system of claim 9 wherein the network server is a portal for providing the client computing device with a gateway to services provided by another network server coupled to the data communication network.

13. The system of claim 9 wherein the address information of the network server includes the domain name of the network server.

14. The system of claim 9 wherein the session key is a randomly generated, single-use session key.

15. A method of exchanging information on a data communication network, said data communication network having at least a client computing device, a network server, and an authentication server coupled thereto, said method comprising:

receiving, by the network server, a request for a service provided by the network server;

redirecting, by the network server, the client computing device from the network server to the authentication server, wherein the authentication server receives message content from the client computing device, said message content including authenticating information obtained from a user of the client computing device via a sign-in interface generated in response to the request;

receiving, from the authentication server, an authentication ticket along with the request, said authentication ticket including;

a session key encrypted by a public key associated with the network server, wherein the session key is a randomly generated, single-use session key;

the message content encrypted by the session key; and

a signature generated by the authentication server using a private key associated with the authentication server to sign the encrypted session key and the encrypted message content, said signature including address information of the network server;

decrypting, by the network server, the signature included in the authentication ticket using a public key associated with the authentication server that corresponds to the private key used to generate the signature;

identifying, by the network server, the address information for the network server in the signature to validate the signature included in the authentication ticket;

verifying, by the network server, the authentication ticket content based on the validated signature included in the authentication ticket;

decrypting, by the network server, the encrypted session key included in the authentication ticket via a private key associated with the network server that corresponds to the public key used to encrypt the session key;

decrypting the encrypted message content included in the authentication ticket via the decrypted session key; and

providing the service to the client computing device.

16. The method of claim 15 wherein the network server provides a portal service for providing the client computing device with a gateway to services provided by another network server coupled to the data communication network, and wherein said receiving a request comprises receiving a request for one of said services provided by the another network server.

17. The method of claim 15 wherein the message content includes login information retrieved from a user of the client computing device by the authentication server.

18. The method of claim 17 wherein the wherein the login information includes a login ID and a password associated with the login ID.

19. The method of claim 15 wherein the network server includes one or more computer-readable storage media having computer-executable instructions executed by said network server to implement said receiving a request for a service, said redirecting, said receiving an authentication ticket, said decrypting the generated signature, said identifying, said verifying, said decrypting the encrypted session key, said decrypting the encrypted message content, and said providing.