Constraining a login to a subset of access rights

• US 8,381,279 B2
• Filed: 02/13/2009
• Issued: 02/19/2013
• Est. Priority Date: 02/13/2009
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Michener, John R., Ferguson, Niels T, Ellison, Carl M., Benaloh, Josh, LaMacchia, Brian A
• Primary Examiner(s): Pwu, Jeffrey
• Assistant Examiner(s): JHAVERI, JAYESH M
• Application Number:
  US12/371,464
• Publication Number:
  US 20100212002A1
• Time in Patent Office: 1,467 Days
• Field of Search: 726/4, 726/5, 726/7, 726 17- 19, 726/21
• US Class Current: 726/7
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 30/0603 Catalogue ordering
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/88 Medical equipments
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions

Abstract

This document describes tools that constrain a login to a subset of access rights. In one embodiment, the tools generate a constrained password by executing a cryptographic algorithm on a user ID, general password, and one or more desired constraints. The constrained password is used in place of the general password to gain access rights that are a subset of the access rights that would be granted if the general password were used instead.

Claims

1. A computer-implemented method comprising:

generating, by a first computing device, a constrained password by at least executing a one-way-transformation algorithm on a product of a cryptographic algorithm executed on a general password that is associated with a user account, the execution of the one-way-transformation algorithm providing an output that includes the constrained password, the constrained password being based on one or more constraints defining a subset of access rights of a full set of access rights associated with the user account;

sending an authentication request including the constrained password to a second computing device capable of authenticating the user account; and

receiving, from the second computing device, access to the subset of access rights.

2. The method as recited in claim 1, wherein the access to the subset of access rights grants access to a resource, the access to the resource based on the one or more constraints.

3. The method as recited in claim 1, wherein the one-way-transformation algorithm comprises a cryptographic hash.

4. The method as recited in claim 1, wherein the authentication request includes a user identifier (ID) and wherein the act of generating comprises executing the one-way-transformation algorithm also on the user ID and one or more of a time stamp, a random number or bit string, user information, or version information.

5. The method as recited in claim 1, wherein the general password is plain text.

6. The method as recited in claim 1, further comprising receiving the general password and the one or more constraints from a remote device.

7. The method as recited in claim 6, wherein the one or more constraints define access rights that are limited by a time or date range in which access is valid, a system or subsystem to which access is limited, a feature of the system or subsystem to which access is limited, or a limitation on the feature to which access is limited.

8. The method as recited in claim 6, wherein the one or more constraints are described in plain text, described in a constraint specification language, an index to another constraint, a handle to another constraint, or a pointer to another constraint.

9. The method as recited in claim 1, wherein the subset of access rights is configured to give at least partial access to one or more protected entities, each of the one or more protected entities being a local site, service, or system.

10. The method as recited in claim 9, wherein the second computing device is a local authentication module and the one or more protected entities are local.

11. The method as recited in claim 1, wherein the subset of access rights is configured to give at least partial access to one or more protected entities, each of the one or more protected entities being a network-accessible site, service, or system.

12. The method as recited in claim 11, wherein the second computing device is a local authentication module and the one or more protected entities are remote.

13. A computer-implemented method comprising:

receiving, by a computing device, an authentication request comprising;

a user identifier (ID) associated with a user account; and

a constrained password that is based on one or more constraints defining a subset of access rights of a full set of access rights associated with the user account;

determining that the constrained password is valid by at least;

performing a cryptographic algorithm on at least the user ID to generate a new constrained password; and

comparing the new constrained password to the constrained password received in the authentication request to determine a match; and

responsive to determining that the constrained password is valid based on the match, granting the subset of access rights.

14. The method as recited in claim 13, wherein the authentication request further comprises one or more constraints defining the subset of access rights.

15. The method as recited in claim 13, wherein the subset of access rights grant at least partial access to one or more protected entities.

16. The method as recited in claim 15, wherein the one or more protected entities comprise a local site, service, or system.

17. The method as recited in claim 15, wherein the one or more protected entities comprise a network-accessible site, service, or system.

18. The method as recited in claim 13, wherein the authentication request is received from a remote computing device.

19. A computer-implemented method comprising:

receiving input at a computing device, the input comprising;

a user ID;

a general password that is;

associated with a user account represented by the user ID; and

configured to give access to a full set of access rights associated with the user account; and

one or more desired constraints that, when applied to the full set of access rights associated with the user account, define a subset of the full set of access rights;

executing a first one-way cryptographic algorithm on the input to provide a result;

generating a constrained password that is based on the one or more desired constraints, the generating comprising;

executing a second one-way cryptographic algorithm on the result of the first one-way cryptographic algorithm; and

receiving the constrained password as output from the second one-way cryptographic algorithm;

sending an authentication request, the authentication request including the user ID, the one or more desired constraints, and the constrained password; and

receiving access to the subset of the full set of access rights, the subset of the full set of access rights configured to give at least partial access to one or more protected entities.

20. A computer-implemented method as recited in claim 19, further comprising executing an additional cryptographic algorithm on the input prior to generating the constrained password.