Single sign-on without a broker application

Patent metadata

Field	Value
Publication number	US-9692745-B2
Application number	US-201514684139-A
Country	US
Kind code	B2
Filing date	Apr 10, 2015
Priority date	Apr 10, 2015
Publication date	Jun 27, 2017
Grant date	Jun 27, 2017

Abstract

Facilitating single sign-on on a device having sandboxed applications. A method includes identifying a plurality of associated applications. Criteria are evaluated to identify a primary application. Authentication state is stored at the primary application. One or more portions of the authentication state can be used by the applications in the plurality of associated application for authentication.

First claim

What is claimed is:

1. In a computing environment, a method of facilitating single sign-on on a device having sandboxed applications, the method comprising:
identifying a plurality of associated applications, wherein at least a first application of the associated applications is in a different sandbox security container than at least a second application of the associated applications, and wherein each application of the plurality of associated applications comprises authentication information for obtaining services from one or more service providers;
selecting a primary application from among the plurality of associated applications based on one or more known criteria;
storing an authentication state at the primary application, wherein the authentication state comprises an authoritative set of state data for each of the plurality of associated applications;
receiving an authentication request at a non-primary application within the plurality of associated applications; and
servicing the authentication request via the primary application, wherein authentication information for the non-primary application is derived from the authentication state stored at the primary application.

2. The method of claim 1 , wherein selecting a primary application from among the plurality of associated applications based on one or more known criteria comprises identifying an ordered list of applications from the plurality of associated applications to identify back-up locations for the authentication state, the method further comprising storing at least a portion of the authentication state in a top n number of applications from the ordered list.

3. The method of claim 2 , wherein storing at least a portion of the authentication state in a top n number of applications from the ordered list is performed as a result of one or more of adding a user account, removing a user account, user interaction to provide authentication input, expiration of pre-determined time, an application version change, or a change in authentication state.

4. The method of claim 2 , further comprising determining that the authentication state is no longer available from the primary application due to the primary application being removed from the device, and as a result promoting a top application from the top n application to the primary application.

5. The method of claim 2 , further comprising determining that the authentication state is no longer available from the primary application due to the authentication state being unavailable from the primary application, and as a result, the primary application obtaining the authentication state from one of the top n applications.

6. The method of claim 1 , wherein selecting a primary application comprises selecting an application based on at least one or more of: an alphabetical order by application name, application versions, software development kit (SDK) versions, protocol versions, a hard coded list, lifetime of applications on the device, frequency of application use, likelihood of application being installed or uninstalled, a specified user preference, or external metrics.

7. The method of claim 1 , further comprising, selecting the plurality of associated applications from an allowed list of applications that can be authenticated on the device.

8. The method of claim 1 , further comprising receiving a request for information from the authentication state from an application that is not in the plurality of associated applications, determining that the application is not in the plurality of associated applications, and as a result denying the request.

9. The method of claim 1 , wherein each of the applications in the plurality of associated applications can communicate with the primary application and with each other.

10. A sandboxed system comprising:
a memory configured to store a plurality of associated applications, wherein each application of the plurality of associated applications comprises authentication information for obtaining services from one or more service providers;
a security unit configured to maintain security containers to generate a plurality of sandboxes wherein at least some of the applications in the plurality of associated applications are in different sandboxes; and
a processor configured to select a primary application from the plurality of associated applications based on one or more known criteria,
wherein the primary application comprises an authentication state at the primary application, the authentication state comprising an authoritative set of state data for each of the plurality of associated applications including the authentication information for each of the plurality of associated applications, and which is used by the primary application to service one or more authentication request directed to one or more non-primary applications in the plurality of associated applications.

11. The sandboxed system of claim 10 , wherein the processor identifies an ordered list of applications from the plurality of associated applications to identify back-up locations for the authentication state, and wherein a top n number of applications from the plurality of associated applications as identified by the ordered list comprise back-up information including at least a portion of the authentication state.

12. The sandboxed system of claim 11 , wherein the system comprises an update module that is configured to update the back-up information in the top n number of applications from the plurality of associated applications as a result of one or more of adding a user account, removing a user account, user interaction to provide authentication input, expiration of pre-determined time, an application version change, or a change in authentication state.

13. The sandboxed system of claim 11 , wherein the system comprises a validation module that is configured to determine that the authentication state is no longer available from the primary application due to the primary application being removed from the device, and as a result promote a top application from the top n application to the primary application.

14. The sandboxed system of claim 11 , wherein the system comprises a validation module that is configured to determine that the authentication state is no longer available from the primary application due to the authentication state being unavailable from the primary application, and as a result, cause the primary application to obtain the authentication state from one of the top n applications.

15. The sandboxed system of claim 10 , wherein the processor is configured to select the primary application based on at least one or more of: an alphabetical order by application name, application versions, software development kit (SDK) versions, protocol versions, a hard coded list, lifetime of applications on the device, frequency of application use, likelihood of application being installed or uninstalled, a specified user preference, or external metrics.

16. The sandboxed system of claim 10 , further comprising an allowed applications data structure, wherein the applications in the plurality of associated applications are selected from an allowed list of applications in the allowed application data structure that can be authenticated on the device.

17. The sandboxed system of claim 10 , wherein each of the applications in the plurality of applications is configured to receive a request for information from the authentication state from an application that is not in the plurality of associated applications, determine that the application is not in the plurality of a

Assignees

• Microsoft Technology Licensing Llc

Inventors

• He jia le
• Xia Li Qing
• Lundeen Alan Jonathan
• Subotic Dejan

Classifications

• H04L63/108

  when the policy decisions are valid for a limited amount of time · CPC title

• H04L63/12

  Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32) · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• H04L63/0815 Primary

  providing single-sign-on or federations · CPC title

• G06F21/41 Primary

  where a single sign-on provides access to a plurality of computers · CPC title