Leveraging a persistent connection to access a secured service

• US 9,461,981 B2
• Filed: 07/02/2014
• Issued: 10/04/2016
• Est. Priority Date: 04/11/2001
• Status: Expired due to Term

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Inventors: Hirsh, Robert Bruce
• Primary Examiner(s): CERVETTI, DAVID GARCIA
• Application Number:
  US14/322,699
• Publication Number:
  US 20150012985A1
• Time in Patent Office: 825 Days
• Field of Search: 726/10, 726/9, 726/6, 726/27, 726/4, 713/186, 713/168, 713/153, 713/156, 713/158, 713/172, 713/182
• US Class Current: 1/1
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 67/55 Push-based network services

Abstract

Leveraging a persistent connection to provide a client access to a secured service may include establishing a persistent connection with a client in response to a first request from the client, and brokering a connection between the client and a secured service based on a second request from the client by leveraging the persistent connection with the client. The brokering may occur before the client attempts to connect to the secured service directly and the connection may be established between the client and the secured service without provision by the client of authentication information duplicative or additional to authentication information provided by the client to establish the persistent connection.

Claims

1. A method, comprising:

receiving, at a server and from a client, a request to access a secured service that is separate from the server;

receiving, from the client, authentication information to authenticate the client with the server;

authenticating, based on the authentication information, the client with the server by the server negotiating authorization information with the secured service;

sending, based on an authentication of the client with the server, the negotiated authorization information to the client to enable the client to access the secured service independent of the server.

2. The method as recited in claim 1, wherein the server negotiating authorization information with the secured service comprises negotiating the authorization information with the secured service via a broker service in communication with the secured service.

3. The method as recited in claim 1, further comprising authenticating, based on the authentication information, the client with the secured service.

4. The method as recited in claim 3, wherein authenticating the client with the secured service comprises leveraging only the authentication information from the client to authenticate the client with the secured service.

5. The method as recited in claim 3, wherein authenticating the client with the secured service comprises requesting the negotiated authorization information from the secured service.

6. The method as recited in claim 1, wherein the negotiated authorization information comprises information stored by the secured service.

7. The method as recited in claim 6, wherein the negotiated authorization information comprises information indicative of an identity of the client.

8. The method as recited in claim 1, wherein the negotiated authorization information comprises a password and a request-to-honor for the password.

9. The method as recited in claim 1, wherein the negotiated authorization information comprises a connection authorization request comprising a target connection point for the secured service.

10. The method as recited in claim 1, wherein the negotiated authorization information comprises constraint information for determining whether the negotiated authorization information satisfies at least one connection constraint associated with the secured service.

11. A method, comprising:

receiving, at a secured service and from an intermediary system that is separate from the secured service, a request for a client to access the secured service;

receiving, from the intermediary system, authentication information for the client;

authenticating, based on the authentication information from the intermediary system, the client with the secured service by the secured service negotiating authorization information for the client with the intermediary system; and

providing, to the client and in response to receiving the negotiated authorization information from the client, access to the secured service.

12. The method as recited in claim 11, wherein the authentication information from the intermediary system comprises authentication information used to establish a connection between the client and the intermediary system.

13. The method as recited in claim 11, further comprising sending the negotiated authorization information to the intermediary system to provide to the client.

14. The method as recited in claim 13, wherein the negotiated authorization information comprises information stored by the secured service.

15. The method as recited in claim 13, wherein the negotiated authorization information comprises a connection authorization request comprising a target connection point for the secured service.

16. The method as recited in claim 13, wherein the negotiated authorization information comprises constraint information for determining whether the authorization information satisfies at least one connection constraint associated with the secured service.

17. The method as recited in claim 16, wherein the constraint information includes at least one of an indication of a number of uses for using the negotiated authorization information, an indication of a time when the negotiated authorization information was determined, an indication of a time window for using the negotiated authorization information, or information indicative of an identity of the client.

18. A system, comprising:

at least one server; and

at least one non-transitory computer readable storage medium storing instructions thereon that, when executed by the at least one server, cause the system to;

receive, from a client, a request to access a secured service that is separate from the at least one server;

receive, from the client, authentication information to authenticate the client with the at least one server;

authenticate, based on the authentication information, the client with the at least one server by the server negotiating the authorization information with the secured service;

send, based on an authentication of the client with the at least one server, the negotiated authorization information to the client to enable the client to access the secured service independent of the at least one server.

19. The system as recited in claim 18, further comprising instructions that, when executed by the at least one server, cause the system to negotiate the authorization information with the secured service via a broker service in communication with the secured service.

20. The system as recited in claim 18, further comprising instructions that, when executed by the at least one server, cause the system to authenticating, based on the authentication information, the client with the secured service.