Authentication framework for a client of a remote database

Patent metadata

Field	Value
Publication number	US-2018091490-A1
Application number	US-201615275237-A
Country	US
Kind code	A1
Filing date	Sep 23, 2016
Priority date	Sep 23, 2016
Publication date	Mar 29, 2018
Grant date	—

Abstract

Disclosed herein is a technique for authenticating an application operating on a client device with an authentication server device based on user credentials associated with an identity provider. In particular, the authentication server device facilitates the authorization process between the application and the identity provider without exposing, to the application, either the user credentials or an authorization code generated by the identity provider.

First claim

What is claimed is:

1 . A method for authenticating an application, the method comprising:
at an authentication server device:
receiving authorization information from a web browser, wherein the authorization information is associated with an authentication request issued by the web browser to a particular identity provider;
generating an authorization identifier in response to a successful verification of the authentication request with the particular identity provider;
communicating the authorization identifier to the web browser;
verifying a login request received from the application based on the authorization identifier; and
enabling secure communication between the application and the authentication server device in response to a successful verification of the login request.

2 . The method of claim 1 , wherein the authentication request includes:
(i) login information, (ii) a client identifier associated with the particular identity provider, and (ii) a request identifier provided to the application by the authentication server device.

3 . The method of claim 2 , wherein the authorization information includes an authorization code issued by the particular identity provider and the request identifier.

4 . The method of claim 2 , wherein the authorization identifier includes a random code or secret that is linked to the login information.

5 . The method of claim 3 , wherein the authorization identifier is generated based on the authorization code.

6 . The method of claim 1 , further comprising:
storing a list of identity providers and one or more client identifiers associated with each identity provider in the list of identity providers, wherein the particular identity provider is selected from the list of identity providers.

7 . The method of claim 1 , wherein the login request includes the authorization identifier and a request identifier.

8 . The method of claim 7 , wherein verifying the login request comprises:
comparing the authorization identifier and the request identifier associated with the login request with information stored at the authentication server device.

9 . The method of claim 1 , wherein enabling the secure communication between the application and the authentication server device comprises:
generating a session key for the application.

10 . A server computing device comprising:
at least one processor; and at least one memory configured to store instructions that, when executed by the at least one processor, cause the server computing device to:
generate an authorization identifier in response to a successful verification of authorization information received from a web browser, wherein the authorization information includes an authorization code issued by an identity provider;
communicate the authorization identifier to the web browser;
verify a login request received from an application based on the authorization identifier; and
enable secure communication between the application and the server computing device in response to a successful verification of the login request.

11 . The server computing device of claim 10 , wherein the authorization information further includes a request identifier associated with an authorization request for authorization with the identity provider.

12 . The server computing device of claim 10 , wherein the authorization identifier is generated based on the authorization code.

13 . The server computing device of claim 10 , wherein the login request includes the authorization identifier and a request identifier.

14 . The server computing device of claim 13 , wherein verifying the login request comprises:
comparing the authorization identifier and the request identifier associated with the login request with information stored at the server computing device.

15 . The server computing device of claim 10 , wherein enabling the secure communication between the application and the server computing device comprises:
generating a session key for the application.

16 . At least one non-transitory computer-readable medium configured to store instructions that, when executed by at least one processor included in a computing device, cause the computing device to perform steps that include:
receiving a request identifier and a login uniform resource locator (URL) in response to an authorization request for authorization of an application with an identity provider; launching a web browser using the login URL; receiving an authorization identifier via the web browser; communicating a login request, wherein the login request includes the authorization identifier; and establishing a secure communication channel in response to a successful verification of the login request.

17 . The at least one non-transitory computer-readable medium of claim 16 , wherein the login request further includes the request identifier.

18 . The at least one non-transitory computer-readable medium of claim 16 , wherein the authorization identifier is based on an authorization code provided by the identity provider.

19 . The at least one non-transitory computer-readable medium of claim 16 , wherein the login request is verified based on the authorization identifier.

20 . The at least one non-transitory computer-readable medium of claim 16 , wherein the secure communication channel is established with a server device based on a session key.

Assignees

• Apple Inc

Inventors

• Wang Hui
• Quiggins James C
• Maeckel Clay A
• Zhao Fan

Classifications

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/0407

  wherein the identity of one or more communicating identities is hidden (cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00) · CPC title

• H04L63/12

  Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32) · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title