Proof of possession for web browser cookie based security tokens

Patent metadata

Field	Value
Publication number	US-9521146-B2
Application number	US-201313971835-A
Country	US
Kind code	B2
Filing date	Aug 21, 2013
Priority date	Aug 21, 2013
Publication date	Dec 13, 2016
Grant date	Dec 13, 2016

Abstract

In one embodiment, a user device 110 may access a network service 122 using a secure cookie 300 . A high trust process may create an authentication proof 360 using a secure key. The high trust process may provide a browsing token 310 and the authentication proof 360 to a low trust process to send to an authentication service 124.

First claim

We claim:

1. A machine-implemented method, comprising:
sending a login credential to an authentication service for a network service from a system context process executing at an operating system level administrative privilege of a client device;
receiving a browsing token and a secure key from the authentication service in the system context process;
storing the secure key in a system context of a memory of the client device limiting access to the secure key to the operating system level administrative privilege;
creating an authentication proof by creating a time sensitive signature of a browsing token in the system context of the client device using the secure key; and
providing the browsing token and the authentication proof to a user context process executing at an application level administrative privilege of the client device to send to the authentication service to access the network service.

2. The method of claim 1 , further comprising:
register an access of a device system by a user.

3. The method of claim 1 , further comprising:
receiving the login credential from a user upon access to a device system.

4. The method of claim 1 , further comprising:
invoking an application programming interface to request the login credential from a user with the user context process.

5. The method of claim 1 , further comprising:
limiting the authentication proof to a single use.

6. The method of claim 1 , further comprising:
limiting the authentication proof to an expiration time period.

7. A tangible machine-readable storage device having a set of instructions detailing a method stored thereon that when executed by one or more processors cause the one or more processors to perform the method, the method comprising:
sending a login credential to an authentication service for a network service from a system context process executing at an operating system level administrative privilege of a client device;
receiving a browsing token and a secure key from the authentication service in the system context process;
storing the secure key in a system context of a memory of the client device limiting access to the secure key to the operating system level administrative privilege;
creating an authentication proof by creating a time sensitive signature of a browsing token in the system context of the client device using the secure key; and
providing the browsing token and the authentication proof to a user context process executing at an application level administrative privilege of the client device to send to the authentication service to access the network service.

8. The tangible machine-readable storage device of claim 7 , wherein the method further comprises:
register an access of a device system by a user.

9. The tangible machine-readable storage device of claim 7 , wherein the method further comprises:
receiving the login credential from a user upon access to a device system.

10. The tangible machine-readable storage device of claim 7 , wherein the method further comprises:
invoking an application programming interface to request the login credential from a user with the user context process.

11. The tangible machine-readable storage device of claim 7 , wherein the method further comprises:
limiting the authentication proof to a single use.

12. The tangible machine-readable storage device of claim 7 , wherein the method further comprises:
limiting the authentication proof to an expiration time period.

13. A client device, comprising:
a memory configured to store a secure key from an authentication service for a network service in a system context limiting data access to an operating system level administrative privilege;
a processor connected to the memory configured to create an authentication proof by creating a time sensitive signature of a browsing token in a system context process executing at the operating system level administrative privilege of the client device using the secure key and further configured to provide the browsing token and the authentication proof to a user context process executing at an application level administrative privilege of the client device; and
a communication interface configured to send a login credential to the authentication service from the system context process, further configured to receive the browsing token and secure key from the authentication service in the system context process, and also configured to send the browsing token and the authentication proof to the authentication service to access the network service for the user context process.

14. The client device of claim 13 , further comprising:
an input device configured to register an access of a device system by the user.

15. The client device of claim 13 , wherein the processor is further configured to invoke an application programming interface to request the login credential from a user with the user context process.

16. The client device of claim 13 , further comprising:
an input device configured to receive a login credential from a user upon access to a device system.

17. The client device of claim 13 , wherein the processor is further configured to limit the authentication proof to a single use.

18. The client device of claim 13 , wherein the processor is further configured to limit the authentication proof to an expiration time period.

19. The client device of claim 13 , wherein the communication interface is further configured to send an additional login credential from the user context process to the authentication service.

20. The client device of claim 13 , wherein the communication interface is further configured to receive for the user context process a set of service tokens bound to the browsing token by the authentication service.

Assignees

• Microsoft Corp
• Microsoft Technology Licensing Llc

Inventors

• Kaluskar Sanket
• Subotic Dejan
• Kamel Tarek
• Frei Adrian
• Aphale Guruprasad
• Wetter Allan

Classifications

• G06F2221/2137

  Time limited access, e.g. to a computer or data · CPC title

• H04L67/146

  Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding · CPC title

• G06F21/57

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• H04L63/10 Primary

  for controlling access to devices or network resources · CPC title

• G06F21/34

  involving the use of external additional devices, e.g. dongles or smart cards · CPC title