Leveraging a persistent connection to access a secured service

• US 9,197,627 B2
• Filed: 12/30/2014
• Issued: 11/24/2015
• Est. Priority Date: 04/11/2001
• Status: Expired due to Fees

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Inventors: Hirsh, Robert Bruce
• Primary Examiner(s): CERVETTI, DAVID GARCIA
• Application Number:
  US14/586,833
• Publication Number:
  US 20150113611A1
• Time in Patent Office: 329 Days
• Field of Search: 726/10
• US Class Current: 1/1
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 67/55 Push-based network services

Abstract

Leveraging a persistent connection to provide a client access to a secured service may include establishing a persistent connection with a client in response to a first request from the client, and brokering a connection between the client and a secured service based on a second request from the client by leveraging the persistent connection with the client. The brokering may occur before the client attempts to connect to the secured service directly and the connection may be established between the client and the secured service without provision by the client of authentication information duplicative or additional to authentication information provided by the client to establish the persistent connection.

Claims

1. A method comprising;

establishing an authenticated connection with a client;

receiving, from the client, a request for authorization to access a service;

in response to receiving the request for authorization, allowing the client to request access to the service from a computer system associated with the service;

in response to the client requesting access to the service, receiving from the computer system associated with the service temporary access information for the service; and

transmitting the temporary access information to the client to enable the client to provide the temporary access information to the computer system associated with the service to establish an authorized connection between the client and the service.

2. The method of claim 1 wherein transmitting the temporary access information to the client to enable the client to provide the temporary access information to the computer system associated with the service to establish an authenticated connection between the client and the service comprises transmitting the temporary access information including a target connection point to the client to enable the client to provide the temporary access information to the computer system associated with the service at the target connection point to establish an authenticated connection between the client and the service.

3. The method of claim 1 wherein receiving, from the computer system associated with the service, the temporary access information for the service includes receiving, from the computer system associated with the service, temporary access information that includes a constraint that the temporary access information be used within a predetermined time.

4. The method of claim 1 wherein receiving, from the computer system associated with the service, the temporary access information for the service includes receiving, from the computer system associated with the service, temporary access information that includes a constraint that the temporary access information be used no more than a predetermined number of times.

5. The method of claim 1 wherein receiving, from the computer system associated with the service, the temporary access information for the service includes receiving, from the computer system associated with the service, temporary access information that includes a constraint that the temporary access information be received from only the client.

6. The method of claim 1 wherein receiving, from the computer system associated with the service, the temporary access information for the service includes receiving, from the computer system associated with the service, a temporary password.

7. The method of claim 1 wherein:

the computer system associated with the service comprises a separate computer system, and

receiving, from the computer system associated with the service, the temporary access information for the service includes receiving, from the separate computer system associated with the service, temporary access information issued by the separate computer system associated with the service.

8. An apparatus comprising:

one or more processors; and

one or more memories operatively coupled to at least one of the one or more processors and having instructions stored thereon that, when executed by at least one of the one or more processors, cause the apparatus to;

establish an authenticated connection with a client;

receive, from the client, a request for authorization to access a service;

in response to receiving the request for authorization, allow the client to request access to the service from a computer system associated with the service;

in response to the client requesting access to the service, receive from the computer system associated with the service temporary access information; and

transmit the temporary access information to the client to enable the client to provide the temporary access information to the computer system associated with the service to establish an authorized connection between the client and the service.

9. The apparatus of claim 8 wherein the temporary access information includes a target connection point to enable the client to provide the temporary access information to the computer system associated the service at the target connection point to establish an authenticated connection between the client and the service.

10. The apparatus of claim 8 wherein the temporary access information for the service includes a constraint that the temporary access information be used within a predetermined time.

11. The apparatus of claim 8 wherein the temporary access information for the service includes a constraint that the temporary access information be used no more than a predetermined number of times.

12. The apparatus of claim 8 wherein the temporary access information for the service includes a constraint that the temporary access information be received from only the client.

13. The apparatus of claim 8 wherein the temporary access information for the service includes a temporary password.

14. The apparatus of claim 8 wherein the temporary access information for the service includes temporary access information issued by the computer system associated with the service.

15. At least one non-transitory computer-readable medium storing computer-readable instructions that, when executed by one or more computing devices, cause at least one of the one or more computing devices to:

establish an authenticated connection with a client;

receive, from the client, a request for authorization to access a service;

in response to receiving the request for authorization, allow the client to request access to the service from a computer system associated with the service;

in response to the client requesting access to the service, receive from the computer system associated with the service temporary access information, and

transmit the temporary access information to the client to enable the client to provide the temporary access information to the computer system associated with the service to establish an authorized connection between the client and the service.

16. The non-transitory computer-readable medium of claim 15 wherein the temporary access information includes a target connection point to enable the client to provide the temporary access information to the computer system associated the service at the target connection point to establish an authenticated connection between the client and the service.

17. The non-transitory computer-readable medium of claim 15 wherein the temporary access information includes a constraint that the temporary access information be used within a predetermined time.

18. The non-transitory computer-readable medium of claim 15 wherein the temporary access information includes a constraint that the temporary access information be used no more than a predetermined number of times.

19. The non-transitory computer-readable medium of claim 15 wherein the temporary access information that includes a constraint that the temporary access information be received from only the client.

20. The non-transitory computer-readable medium of claim 15 wherein the temporary access information for the service includes a temporary password.