Web ticket based upon a symmetric key usable for user authentication

Patent metadata

Field	Value
Publication number	US-2018227291-A1
Application number	US-201815947705-A
Country	US
Kind code	A1
Filing date	Apr 6, 2018
Priority date	Feb 28, 2013
Publication date	Aug 9, 2018
Grant date	—

Abstract

Described herein are various aspects pertaining to generating web tickets for use with authenticating computing devices to a computing system. Symmetric keys are used when generating the web tickets, wherein a symmetric key is valid for use when generating web tickets for a first period of time, and a web ticket generated based upon the symmetric key is valid for use when authenticating a computing device for a second period of time that is longer than the first period of time. Thus, the symmetric key is used for authenticating computing devices after it has ceased being used to generate web tickets.

First claim

What is claimed is:

1 . A computing system comprising:
at least one processor; and memory storing instructions that, when executed by the at least one processor, cause the at least one processor to perform acts comprising:
responsive to receiving a request for a first web ticket from a first computing device that is in communication with the computing system, generating the first web ticket based upon a first symmetric key, wherein the first symmetric key has a first expiration time assigned thereto, and further wherein the first web ticket has a second expiration time assigned thereto that is subsequent the first expiration time;
transmitting the first web ticket to the first computing device, wherein the first web ticket is valid for authenticating the first computing device until the second expiration time has passed;
subsequent to the first expiration time, prior to the second expiration time, and responsive to receiving a second request for a second web ticket from a second computing device that is in communication with the computing system, generating the second web ticket based upon a second symmetric key, wherein the second symmetric key has a third expiration time assigned thereto that is prior to the second expiration time, and further wherein the second web ticket has a fourth expiration time assigned thereto that is subsequent the second authentication time; and
transmitting the second web ticket to the second computing device, wherein the second web ticket is valid for authenticating the second computing device until the fourth expiration time has passed.

2 . The computing system of claim 1 , the acts further comprising:
subsequent the first expiration time and prior to the second expiration time, receiving the first web ticket from the first computing device; and responsive to receiving the first web ticket, authenticating the first computing device based upon the first web ticket and the first symmetric key.

3 . The computing system of claim 1 , the acts further comprising:
prior to the first expiration time, receiving the first web ticket from the first computing device; and responsive to receiving the first web ticket, authenticating the first computing device based upon the first web ticket and the first symmetric key.

4 . The computing system of claim 1 , the acts further comprising:
subsequent the second expiration time, receiving the first web ticket from the first computing device; and failing to authenticate the first computing device due to the first web ticket having expired.

5 . The computing system of claim 1 , the acts further comprising:
subsequent the first expiration time and prior to the third expiration time, receiving the second web ticket from the second computing device; and responsive to receiving the second web ticket, authenticating the second computing device based upon the second web ticket and the second symmetric key.

6 . The computing system of claim 1 , the acts further comprising:
subsequent the third expiration time and prior to the fourth expiration time, receiving the second web ticket from the second computing device; and responsive to receiving the second web ticket, authenticating the second computing device based upon the second web ticket and the second symmetric key.

7 . The computing system of claim 1 , the acts further comprising:
subsequent the fourth expiration time, receiving the second web ticket from the second computing device; and failing to authenticate the second computing device due to the second web ticket having expired.

8 . The computing system of claim 1 , wherein the first web ticket comprises a first signature and the second web ticket comprises a second signature, wherein the first signature is based upon the first symmetric key, and further wherein the second signature is based upon the second symmetric key.

9 . The computing system of claim 8 , wherein the first web ticket further comprises a first identifier that identifies the first symmetric key, and further wherein the second web ticket further comprises a second identifier that identifies the second symmetric key.

10 . The computing system of claim 1 , wherein both the first web ticket and the second web ticket have a size of less than 200 bytes.

11 . A method executed by a computing system, the method comprising:
receiving, from a first computing device, a first request for a first web ticket, wherein the first computing device is to authenticate with the computing system based upon the first web ticket; responsive to receiving the first request, generating the first web ticket based upon a first symmetric key, wherein the computing system is configured to use the first symmetric key to generate web tickets only until a first expiration time, the first web ticket is valid for authenticating the first computing device only until a second expiration time, and further wherein the second expiration time is subsequent the first expiration time; transmitting the first web ticket to the first computing device; subsequent the first expiration time, receiving, from a second computing device, a second request for a second web ticket, wherein the second computing device is to authenticate with the computing system based upon the second web ticket; responsive to receiving the second request, generating the second web ticket based upon a second symmetric key, wherein the computing system is configured to use the second symmetric key to generate web tickets only until a third expiration time that is subsequent the first expiration time, the second web ticked is valid for authenticating the second computing device only until a fourth expiration time, and further wherein the fourth expiration time is subsequent the second expiration time; and transmitting the second web ticket to the second computing device.

12 . The method of claim 11 , wherein the third expiration time is prior to the second expiration time.

13 . The method of claim 12 , further comprising:
subsequent to the first expiration time and prior to the second expiration time, generating the second symmetric key.

14 . The method of claim 12 , wherein the first web ticket comprises a first identifier for the first symmetric key, the method further comprising:
receiving, from the first computing device, the first web ticket; responsive to receiving the first web ticket, determining that the first identifier is included in a list of symmetric key identifiers, wherein the symmetric key identifiers identify valid symmetric keys that have not expired; responsive to determining that the first identifier is included in the list of symmetric key identifiers, obtaining the first symmetric key; and validating the first computing device based upon the first web ticket and the first symmetric key.

15 . The method of claim 14 , wherein the second web ticket comprises a second identifier for the second symmetric key, and further wherein the second identifier is included in the list of symmetric key identifiers.

16 . The method of claim 15 , further comprising:
receiving, from the second computing device, the second web ticket; responsive to receiving the second web ticket, determining that the second identifier is included in the list of symmetric key identifiers; responsive to determining that the second identifier is included in the list of symmetric key identifiers, obtaining the second symmetric key; and validating the second computing device based upon the second web ticket and the second symmetric key.

17 . The method of claim 1

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Tidwell Paul
• Pitsch Yves
• Rao Deepak
• Eydelman Vadim
• Kondepudi Satya

Classifications

• H04L67/1095

  Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes · CPC title

• G06F21/57

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• G06F21/335

  for accessing specific resources, e.g. using Kerberos tickets · CPC title

• H04L67/327

  Electricity · mapped topic

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title