Method and system for authenticating service providers to communicate with a primary service provider

Patent metadata

Field	Value
Publication number	US-9794239-B1
Application number	US-201113031094-A
Country	US
Kind code	B1
Filing date	Feb 18, 2011
Priority date	Feb 18, 2011
Publication date	Oct 17, 2017
Grant date	Oct 17, 2017

Abstract

A method and system for authenticating a user device includes an identity provider reading service and an external service provider receiving a request to access content from a user device and communicating the request to access content from a service provider to the reading service. The request to access content includes cookie data. The external service requests an identity provider token from the cookie data from the reading service based on the request to access. The identity provider reading service communicates the identity provider token to the external service provider. An identity provider communicates with the service provider. The external service generates and communicates an authentication request to the identity provider having the identity provider token and a service provider identifier. The identity provider communicates an assertion signal to the service provider when the cookie data is resolved at the identity provider. The service provider grants access to content to the user device in response to the assertion signal.

First claim

What is claimed is:

1. A method comprising:
receiving a request to access content from a user device at an external service provider;
communicating, at the external service provider, the request to access content to a reading service, said request to access content comprising cookie data that comprises identity provider data;
requesting, at the external service provider, an identity provider token corresponding to the identity provider data corresponding to an identity provider from the reading service based on the request to access;
communicating the identity provider token from the reading service to the external service provider;
generating, at the external service provider, an authentication request having the identity provider token and an external service provider identifier;
communicating the authentication request and the cookie data from the external service provider to the identity provider;
when the cookie data is resolved at the identity provider with the authentication request, communicating an assertion signal to the external service provider; and
granting access to content to the user device in response to the assertion signal.

2. The method as recited in claim 1 further comprising when the cookie data is not resolved, communicating a login page to the user device.

3. The method as recited in claim 2 further comprising in response to the login page communicating a user identifier and a password corresponding to a primary provider account to the identity provider.

4. The method as recited in claim 3 further comprising updating a cookie in a user browser after communicating the user identifier and the password.

5. The method as recited in claim 4 further comprising redirecting the user device to the external service provider using a redirection signal.

6. The method as recited in claim 4 further comprising redirecting the user device to the external service provider using a redirection signal comprising an authentication token.

7. The method as recited in claim 1 wherein receiving the request to access content comprises receiving the request to access content including a network identifier.

8. The method as recited in claim 1 wherein receiving the request to access content comprises receiving the request to access content including a content identifier.

9. The method as recited in claim 1 wherein the request to access content comprises receiving the request to access content including a network identifier and a content identifier.

10. The method as recited in claim 1 wherein communicating the authentication request comprises communicating the authentication request to the identity provider using Simple object Access Protocol (SOAP).

11. The method as recited in claim 1 wherein communicating the authentication request comprises communicating the authentication request to the identity provider using SOAP over Hypertext Transfer Protocol (HTTP).

12. The method as recited in claim 1 wherein communicating the assertion signal comprises communicating the assertion signal that comprises a service provider identifier and user identifier to the external service provider.

13. The method as recited in claim 1 wherein communicating the assertion signal comprises communicating the assertion signal that comprises a service provider identifier, the identity provider token and user identifier to the external service provider.

14. A system comprising:
an electronic identity provider reading service comprising a first electronic circuit;
an electronic external service provider comprising a second electronic circuit receiving a request to access content from a user device through a network and communicating the request to access content to the identity provider reading service, said request to access content comprising cookie data that comprises identity provider data, said external service provider requesting cookie data corresponding to an identity provider token corresponding to the identity provider data from the identity provider reading service based on the request to access;
said identity provider reading service communicating the identity provider token to the external service provider through the network;
an identity provider comprising a third electronic circuit in communication with the external service provider through a network;
said external service provider generating and communicating an authentication request and cookie data to the identity provider having the identity provider token and a service provider identifier;
said identity provider communicating an assertion signal to the external service provider when the cookie data is resolved at the identity provider with the authentication request; and
said external service provider granting access to content to the user device in response to the assertion signal.

15. The system as recited in claim 14 wherein said identity provider communicates a login page to the user device when the cookie data is not resolved.

16. The system as recited in claim 15 wherein in response to the login page, said user device communicating a user identifier and a password corresponding to a primary provider account to the identity provider.

17. The system as recited in claim 16 wherein a cookie in a user browser in the user device is updated after communicating the user identifier and the password.

18. The system as recited in claim 17 wherein the user device is redirected to the external service provider using a redirection signal.

19. The system as recited in claim 18 wherein the redirection signal comprises an authentication token.

20. The system as recited in claim 14 wherein the request to access content comprises a network identifier.

21. The system as recited in claim 14 wherein the request to access content comprises a content identifier.

22. The system as recited in claim 14 wherein the request to access content comprises a network identifier and a content identifier.

23. The system as recited in claim 14 wherein the authentication request is in a Simple Object Access Protocol (SOAP) format.

24. The system as recited in claim 14 wherein the assertion signal comprises a service provider identifier, the token and a user identifier.

25. The system as recited in claim 14 wherein the assertion signal comprises communicating an assertion signal that comprises the token and a user identifier.

Assignees

• Chaudhry Kapil
• Schlacht David N
• Directv Group Inc

Inventors

• Chaudhry Kapil
• Schlacht David N

Classifications

• G06F21/10 Primary

  Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]} · CPC title

• H04L63/0807

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• H04L63/0815

  providing single-sign-on or federations · CPC title

• H04L9/32

  including means for verifying the identity or authority of a user of the system {or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials} · CPC title

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title