Device token protocol for authorization and persistent authentication shared across applications

Patent metadata

Field	Value
Publication number	US-9038138-B2
Application number	US-201213609018-A
Country	US
Kind code	B2
Filing date	Sep 10, 2012
Priority date	Sep 10, 2012
Publication date	May 19, 2015
Grant date	May 19, 2015

Abstract

Various techniques for providing a device token protocol for authorization and persistent authentication shared across applications are disclosed. In some embodiments, a device token protocol for authorization and persistent authentication shared across applications includes sending user credentials to a remote server to authenticate a user on a device for a plurality of applications; and receiving a device token from the remote server for the user to authenticate the user for the plurality of applications on the device, in which the device token facilitates authentication and authorization.

First claim

What is claimed is:

1. A system for authentication and authorization for a plurality of applications, comprising:
a hardware processor configured to:
send user credentials to a remote server to authenticate a user on a device for a plurality of applications;
receive a device token from the remote server for persistent authentication of the user for the plurality of applications on the device, wherein the device token is persistently stored on the device for granting multiple instances of access to use one or more of the plurality of applications without a need for re-authentication by sending the user credentials from the user on a per client basis, wherein said persistent authentication is shared across the applications and enables remote revocation of authorizations by revoking the device token;
send multiple access token requests to the remote server requesting the multiple instances of access without re-authenticating the user, wherein each access token request includes the device token and a respective client identifier uniquely identifying a respective application of the plurality of applications; and
receive access tokens from the remote server granting the multiple instances of access to use one or more of the plurality of applications; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system recited in claim 1 , wherein the device token is uniquely associated with the user to verify authentication, and wherein the device identifier is associated with a profile identifier to provide for the authorization for access to a resource.

3. The system recited in claim 1 , wherein the device token is stored in persistent storage without an expiration.

4. The system recited in claim 1 , wherein the device token is a persistent, non-transferable device token, and wherein the device token is uniquely associated with the user and with the device.

5. The system recited in claim 1 , wherein the device token includes authorization information to authorize the user on the device to access a resource.

6. The system recited in claim 1 , wherein the device token is associated with a device identifier (ID) that is uniquely associated with the device, and wherein the device token is associated with a user identifier (ID).

7. The system recited in claim 1 , wherein the device token includes an authentication token.

8. The system recited in claim 1 , wherein the device token includes an access token.

9. The system recited in claim 1 , wherein the user authorization credentials are not stored locally on the device.

10. The system recited in claim 1 , wherein the processor is further configured to:
receive a deauthorization message from the remote server, wherein the deauthorization message invalidates the device token.

11. The system recited in claim 1 , wherein the processor is further configured to:
execute an application manager that communicates with the plurality of applications on the device to implement the device token based authentication and authorization, wherein the device token is uniquely associated with a user identifier and a device identifier to verify authentication, and wherein the device identifier is associated with a profile identifier to provide for the authorization for access to a resource.

12. A method for authentication and authorization for a plurality of applications, comprising:
sending user credentials to a remote server to authenticate a user on a device for a plurality of applications;
receiving a device token from the remote server for persistent authentication of the user for the plurality of applications on the device, wherein the device token is persistently stored on the device for granting multiple instances of access to use one or more of the plurality of applications without a need for re-authentication by sending the user credentials from the user on a per client basis, wherein said persistent authentication is shared across the applications and enables remote revocation of authorizations by revoking the device token;
sending multiple access token requests to the remote server requesting the multiple instances of access without re-authenticating the user, wherein each access token request includes the device token and a respective client identifier uniquely identifying a respective application of the plurality of applications; and
receiving access tokens from the remote server granting the multiple instances of access to use one or more of the plurality of applications.

13. The method of claim 12 , wherein the device token uniquely associated with the user to verify authentication, and wherein the device identifier is associated with a profile identifier to provide for the authorization for access to a resource.

14. The method of claim 12 , further comprising:
receiving a deauthorization message from the remote server, wherein the deauthorization message invalidates the device token.

Assignees

• Trammel John
• Kalfas Andrei
• Yalcinalp Lutfiye Umit
• Brotsky Daniel Carl
• Boag James Thomas
• Adobe Systems Inc

Inventors

• Trammel John
• Kalfas Andrei
• Yalcinalp Lutfiye Umit
• Brotsky Daniel Carl
• Boag James Thomas

Classifications

• H04L63/0876 Primary

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• H04L9/3213

  using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807) · CPC title

• G06F21/41 Primary

  where a single sign-on provides access to a plurality of computers · CPC title

• H04L63/0807

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title