Methods and systems for single sign-on while protecting user privacy

• US 9,479,490 B2
• Filed: 06/07/2013
• Issued: 10/25/2016
• Est. Priority Date: 06/07/2013
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Huhn, Derrick S., Werner, Jeremy M., Pattekar, Amol V.
• Primary Examiner(s): Desrosiers, Evans
• Application Number:
  US13/913,232
• Publication Number:
  US 20140366110A1
• Time in Patent Office: 1,236 Days
• Field of Search: 713168-174, 713182-186, 713/202, 709/206, 709/225, 709/229, 709/249, 709/389, 726 2- 21
• US Class Current: 1/1
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

A method of enabling applications to reference user information is provided, including receiving a request for a user identifier that references a user of the application and sending a second request for the user identifier to a server. The second request may include a second user identifier that references the user and a second authentication token for the second user identifier. Furthermore, the second user identifier and the second authentication token are not accessible by the user. The method includes receiving the user identifier and an authentication token for the first user identifier. The user identifier corresponds to the second identifier; and providing the user identifier and authentication token to the application. A method of enabling an application to identify users associated with a user of the application is provided; the method may include receiving, from the server, user identifiers that reference one or more users scoped to the application.

Claims

1. A method for enabling an application to identify a user of the application, the method comprising:

at a computing device on which the application is executing;

receiving, from the application, a first request for a first user identifier that references the user only within a scope of the application, wherein the first request includes a container identifier associated with the application;

in response to the first request, sending a second request for the first user identifier to a server, wherein the second request includes;

a second user identifier that references the user,

a second authentication token for the second user identifier, and

the container identifier, wherein;

the container identifier references a container that corresponds to the application,

the container includes information that correlates the second user identifier to the first user identifier, and

the second user identifier, the second authentication token, and the container are not accessible to the application;

receiving, from the server, the first user identifier and a first authentication token for the first user identifier; and

providing the first user identifier to the application.

2. The method of claim 1, wherein one or more applications are associated with the container.

3. The method of claim 1, further comprising:

receiving, at the server and from the computing device, the second request, including the second user identifier and the second authentication token;

determining whether an association exists between the second user identifier and an application-accessible user identifier; and

sending the application-accessible user identifier to the computing device, wherein the first user identifier is the application-accessible user identifier.

4. The method of claim 3, wherein:

receiving the second request includes receiving the container identifier that identifies the container associated with the application, and identifying a container association with the container identifier; and

determining whether the association exists further comprises determining whether an association exists between the container identifier and the second user identifier, wherein the first user identifier is accessible by applications associated with the container when the association exists.

5. The method of claim 3, further comprising:

in response to determining that the association does not exist between the second user identifier and the application-accessible user identifier;

generating a new application-accessible user identifier, and

creating an association between the second user identifier and the new application-accessible user identifier.

6. The method of claim 5, wherein the association is represented by a mapping table, and creating the association between the second user identifier and the new application-accessible user identifier comprises creating an entry in the mapping table that maps the second user identifier to the new application-accessible user identifier.

7. The method of claim 3, wherein the association is represented by a mapping table, and determining whether the association exists between the second user identifier and the application-accessible user identifier comprises searching the mapping table for an entry that includes the second user identifier.

8. The method of claim 1, wherein at least one of the first and second authentication tokens can be used to verify an identity of the user.

9. A non-transitory computer readable storage medium configured to store instructions that, when executed by a processor included in a computing device, cause the computing device to enable an application to identify a user of the application, by carrying out steps that include:

receiving, from the application, a first request for a first user identifier that references the user only within a scope of the application, wherein the first request includes a container identifier associated with the application;

in response to the first request, sending a second request for the first user identifier to a server, wherein the second request includes;

a second user identifier that references the user,

a second authentication token for the second user identifier, and

the container identifier, wherein;

the container identifier references a container that corresponds to the application,

the container includes information that correlates the second user identifier to the first user identifier, and

the second user identifier, the second authentication token, and the container are not accessible to the application;

receiving, from the server, the first user identifier and a first authentication token for the first user identifier; and

providing the first user identifier to the application.

10. The non-transitory computer readable storage medium of claim 9, wherein the steps further include:

receiving, at the server and from the computing device, the second request, including the second user identifier and the second authentication token;

determining whether an association exists between the second user identifier and an application-accessible user identifier; and

sending the application-accessible user identifier to the computing device, wherein the first user identifier is the application-accessible user identifier.

11. The non-transitory computer readable storage medium of claim 10, wherein:

receiving the second request includes receiving the container identifier that identifies the container associated with the application, and identifying a container association with the container identifier; and

determining whether the association exists further comprises determining whether an association exists between the container identifier and the second user identifier, wherein the first user identifier is accessible by applications associated with the container when the association exists.

12. The non-transitory computer readable storage medium of claim 10, wherein the steps further include:

in response to determining that the association does not exist between the second user identifier and the application-accessible user identifier;

generating a new application-accessible user identifier, and

creating an association between the second user identifier and the new application-accessible user identifier.

13. The non-transitory computer readable storage medium of claim 12, wherein the association is represented by a mapping table, and creating the association between the second user identifier and the new application-accessible user identifier comprises creating an entry in the mapping table that maps the second user identifier to the new application-accessible user identifier.

14. The non-transitory computer readable storage medium of claim 10, wherein the association is represented by a mapping table, and determining whether the association exists between the second user identifier and the application-accessible user identifier comprises searching the mapping table for an entry that includes the second user identifier.

15. A system configured to enable an application to identify a user of the application, the system comprising:

a server device; and

a computing device configured to carry out steps that include;

receiving, from the application, a first request for a first user identifier that references the user only within a scope of the application, wherein the first request includes a container identifier associated with the application;

in response to the first request, sending a second request for the first user identifier to the server device, wherein the second request includes;

a second user identifier that references the user,

a second authentication token for the second user identifier, and

the container identifier, wherein;

the container identifier references a container that corresponds to the application,

the container includes information that correlates the second user identifier to the first user identifier, and

the second user identifier, the second authentication token, and the container are not accessible to the application;

receiving, from the server device, the first user identifier and a first authentication token for the first user identifier; and

providing the first user identifier to the application.

16. The system of claim 15, wherein the server device is configured to carry out steps that include:

receiving, at the server device and from the computing device, the second request, including the second user identifier and the second authentication token;

determining whether an association exists between the second user identifier and an application-accessible user identifier; and

sending the application-accessible user identifier to the computing device, wherein the first user identifier is the application-accessible user identifier.

17. The system of claim 16, wherein:

receiving the second request includes receiving the container identifier that identifies the container associated with the application, and identifying a container association with the container identifier; and

determining whether the association exists further comprises determining whether an association exists between the container identifier and the second user identifier, wherein the first user identifier is accessible by applications associated with the container when the association exists.

18. The system of claim 16, wherein the server device is further configured to carry out steps that include:

in response to determining that the association does not exist between the second user identifier and the application-accessible user identifier;

generating a new application-accessible user identifier, and

creating an association between the second user identifier and the new application-accessible user identifier.

19. The system of claim 18, wherein the association is represented by a mapping table, and creating the association between the second user identifier and the new application-accessible user identifier comprises creating an entry in the mapping table that maps the second user identifier to the new application-accessible user identifier.

20. The system of claim 16, wherein the association is represented by a mapping table, and determining whether the association exists between the second user identifier and the application-accessible user identifier comprises searching the mapping table for an entry that includes the second user identifier.