Host agnostic integration and interoperation system

Patent metadata

Field	Value
Publication number	US-9319469-B2
Application number	US-201113329964-A
Country	US
Kind code	B2
Filing date	Dec 19, 2011
Priority date	Sep 27, 2011
Publication date	Apr 19, 2016
Grant date	Apr 19, 2016

Abstract

A host agnostic integration and interoperation system. The host agnostic integration and interoperation system includes an open platform interface and the associated conventions that define the roles of and direct operations between a host and a service application running on an external application server and allow the host to discover and integrate the functionality provided by the service application. The open platform interface employs a limited number of easily implemented semantic methods allowing a host to expose and integrate the ability to view, edit, or otherwise manipulate a document using the host supported functionality of the service application from a standard user agent. The host agnostic integration and interoperation system handles user authentication at the host using an access token and establishes a trust relationship between the host and the external application server using a lightweight but secure proof key system.

First claim

What is claimed is:

1. A method for securely communicating between a host and a service application running on a selected external application server to allow a service application running on the external application server to access a document maintained by the host, said method comprising the steps of:
initiating a transaction, by the host, with the selected external application server by transmitting an action request from the host to the service application running on the selected external application server, the action request being against an entry point address associated with the service application;
initiating a communication with the selected external application server to obtain a proof key adapted to validate a proof signature;
receiving said proof key in response to said communication;
providing the selected external application server with an access token and a document identifier for use in fulfilling said action request;
receiving a metadata request comprising said access token and said document identifier;
validating said access token prior to responding to said metadata request;
sending a metadata response comprising selected metadata based on said action request when said access token is valid;
receiving a content request comprising said access token and said document identifier;
validating said access token prior to responding to said content request; and
sending a content response comprising content from the document identified by said document identifier when said access token is valid.

2. The method of claim 1 further comprising the step of generating said access token prior to said step of providing the selected external application server with said access token and said document identifier.

3. The method of claim 1 characterized in that at least one of said access token and said document identifier are provided in said action request.

4. The method of claim 3 characterized in that the document is protected, said method further comprising the steps of:
notifying the external application server that said content request must be a secure request in response to said step of receiving a metadata request;
receiving a proof signature in said content request; and
validating said proof signature using said proof key prior to responding to said content request.

5. The method of claim 1 , wherein the proof key is generated by the selected external application server, said proof signature uniquely identifying the selected external application server.

6. The method of claim 5 characterized in that said metadata request and said content request each further comprises a proof signature adapted to be validated using said proof key.

7. The method of claim 5 further comprising the step of:
verifying that said metadata request was sent from the selected external application server prior to responding to said metadata request; and
verifying that said content request was sent from the selected external application server prior to responding to said content request.

8. The method of claim 1 characterized in that said step of initiating a transaction with a selected external application server occurs in response to the step of navigating a user agent to an endpoint address on said host in response to an instruction from a user via a user agent.

9. The method of claim 1 characterized in that said step of initiating a transaction with a selected external application server occurs in response to the step of programmatically instructing the host to initiate the transaction without navigating a user agent to an endpoint address on said host.

10. A computer storage device containing computer executable instructions which when executed by a computer perform a method for communicating between a host and a service application running on a selected external application server to allow a service application running on the external application server to access a document maintained by the host, said method comprising the steps of:
providing a host with a proof key uniquely identifying an external application server in response to a discovery request from the host;
receiving at the service application running on the external application server an action, an access token, a metadata address, and a document identifier transmitted by the host to the service application running on the external application server;
invoking said service application on said external application server in response to receipt of said action;
sending a metadata request comprising a proof signature generated using said proof key, said access token, and said document identifier to said metadata address;
receiving a metadata response comprising information related to a document identified by said document identifier, said information selected based on said action;
sending a document content request comprising said proof signature, said access token, and said document identifier to a document access address; and
receiving a content response comprising the content of the document.

11. The computer storage device of claim 10 characterized in that said method further comprises the step of initiating a method call to the host in response to an action request initiated by a user via a user agent, said method call providing said access token and said document identifier to the host.

12. The computer storage device of claim 10 characterized in that said method further comprises the step of initiating a method call to the host programmatically without navigating a user agent to an endpoint address on said host, said method call providing said access token and said document identifier to the host.

13. A method for securely communicating between a host and a service application running on an external application server to allow a service application running on the external application server to access a document maintained by the host, said method comprising the steps of:
initiating a communication with a selected external application server to obtain a proof key uniquely identifying a selected external application server, said proof key adapted for validating a proof signature generated by the selected external application server;
receiving said proof key from the selected external application server;
initiating, by the host, a transaction between the host and the external application server by transmitting an action request from the host to the service application running on the selected external application server, the action request being against an entry point associated with the service application;
providing, by the host, the selected external application server with an access token and a document identifier for use in fulfilling said action request;
generating said access token prior to said step of providing the selected external application server with said access token and a document identifier;
receiving a metadata request comprising a proof signature, said access token, and said document identifier, said proof signature designed to be validated using said proof key;
validating said proof signature using said proof key prior to responding to said metadata request;
validating said access token prior to responding to said metadata request;
sending a metadata response comprising selected metadata based on said action request when said proof signature and said access are valid;
receiving a content request comprising said proof signature, said access token, and said document identifier;
validating said proof signature prior to responding to said content request;
validating said access token prior to responding to said content request; and
sending a cont

Assignees

• Ruhlen Matthew James
• Yuhas Jr Kenneth John
• Fields Mark T
• Abadi Martin
• Microsoft Technology Licensing Llc

Inventors

• Ruhlen Matthew James
• Yuhas Jr Kenneth John
• Fields Mark T
• Abadi Martin

Classifications

• H04L67/16 Primary

  Electricity · mapped topic

• H04L63/105

  Multiple levels of security · CPC title

• H04L63/0807

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• H04L67/1002

  Electricity · mapped topic

• H04L67/1001 Primary

  for accessing one among a plurality of replicated servers · CPC title