Web ticket based upon a symmetric key usable for user authentication

Patent metadata

Field	Value
Publication number	US-9954843-B2
Application number	US-201313925854-A
Country	US
Kind code	B2
Filing date	Jun 25, 2013
Priority date	Feb 28, 2013
Publication date	Apr 24, 2018
Grant date	Apr 24, 2018

Abstract

Described herein are various aspects pertaining to a web ticket that is used in connection with authenticating a user. The web ticket is generated through use of a symmetric key, and is less than two hundred bytes in size. A ticket issuer executing on a first computing device generates the web ticket responsive to receiving authentication data from a client computing device, and transmits the web ticket to such client computing device. The client computing device includes the web ticket in requests for data transmitted to a second server computing device that is in communication with the ticket issuer. The second server computing device includes a validator that validates the web ticket using the symmetric key, which is shared between the first server and the second server.

First claim

What is claimed is:

1. A client computing device that is configured to perform a plurality of acts when executing a client-side instance of a unified communications application, the plurality of acts comprising:
transmitting a request for a web ticket to a first server that executes a first server-side instance of the unified communications application, the request for the web ticket comprises authentication data of a user of the client computing device for the unified communications application;
subsequent to transmitting the request for the web ticket, receiving the web ticket from the first server, the web ticket comprising a hash-based signature that is based upon a symmetric key shared between the first server and a second server, the second server executes a second server-side instance of the unified communications application that is configured to maintain lists of contacts of users of the unified communications application, the symmetric key being valid for use when generating web tickets for a first length of time, the web ticket further comprising data that identifies the first server, data that identifies the user, and data that indicates that the web ticket is valid for a second length of time that is greater than the first length of time, wherein the web ticket has a size of less than 200 bytes;
transmitting a request for a list of contacts of the user to the second server, the list of contacts maintained by the second server-side instance of the unified communications application, wherein the request for the list of contacts comprises the web ticket; and
receiving the list of contacts from the second server based upon the request for the list of contacts, the list of contacts received responsive to the second instance of the unified communications application validating the hash-based signature through use of the symmetric key.

2. The client computing device of claim 1 being a mobile computing device.

3. The client computing device of claim 1 being a mobile telephone.

4. The client computing device of claim 1 configured to transmit the web ticket with each request for the list of contacts subsequent to receiving the web ticket from the first server and prior to the web ticket expiring.

5. The client computing device of claim 4 , wherein the web ticket is valid for a time period between one hour and one day.

6. The client computing device of claim 1 , wherein the web ticket further comprises data that identifies the first server as the ticket issuer server.

7. The client computing device of claim 1 , wherein the unified communications application supports a plurality of communications modalities, the modalities comprising instant messaging, presence of contacts, screen sharing, group maintenance, video conferencing, and telephone conferencing.

8. The client computing device of claim 1 , wherein the web ticket comprises data that indicates a time when the web ticket is to expire.

9. A method executed by a client computing device when executing a client-side instance of a unified communications application, the method comprising:
receiving a web ticket from a first server that executes a ticket issuer for a unified communications application, the web ticket being less than 200 bytes in size and comprising data that identifies the ticket issuer, data that identifies a user of the client computing device, and a hash-based signature that is based upon a symmetric key that is shared between the first server and a second server, the second server executes a server-side instance of the unified communications application that is configured to maintain lists of contacts of users of the unified communications application, the symmetric key being valid for use when generating web tickets for a first length of time, the web ticket further comprising data that indicates that the web ticket is valid for a second length of time that is greater than the first length of time;
transmitting, to the second server, a request for a list of contacts of the user of the client computing device, the list of contacts maintained by the server-side instance of the unified communications application, the request comprising the web ticket;
receiving the list of contacts from the second server responsive to the server-side instance of the unified communications application validating the hash-based signature through use of the symmetric key; and
displaying at least one contact in the list of contacts based upon the list of contacts received from the second server.

10. The method of claim 9 , the client computing device being one of a mobile telephone, a slate computing device, or a phablet computing device.

11. The method of claim 9 , wherein the hash-based signature is a message authentication code signature.

12. The method of claim 9 , wherein a Uniform Resource Locator comprises the request transmitted to the second server.

13. The method of claim 9 , wherein the web ticket comprises an identifier that is usable by the second server to retrieve the symmetric key from a list of symmetric keys.

14. The method of claim 9 , wherein the web ticket comprises a field that indicates a time when the web ticket expires.

15. The method of claim 9 , further comprising transmitting multiple requests to the second server, wherein each request in the multiple requests comprises the web ticket.

16. A computer-readable storage medium of a client computing device executing a client-side instance of a unified communications application, the computer-readable storage medium comprising instructions that, when executed by a processor, cause the processor to perform acts comprising:
transmitting a request to a first server that executes a first server-side instance of the unified communications application, the request comprising data that identifies a user of the client computing device;
receiving a response to the request from the first server, the response comprising a web ticket that has a size of less than 200 bytes, the web ticket comprising a hash-based signature that is based upon a symmetric key shared between the first server and a second server, the second server executes a second server-side instance of the unified communications application that is configured to maintain lists of contacts of users of the unified communications application, the symmetric key being valid for use when generating web tickets for a first length of time, the web ticket further comprising data that identifies the first server, data that identifies the user, and data that indicates that the web ticket is valid for a second length of time that is greater than the first length of time;
subsequent to receiving the response from the first server, transmitting a second request to the second server for a list of contacts of the user maintained by the second server-side instance of the unified communications application, the request comprising the web ticket;
receiving a response from the second server that comprises the list of contacts, the response received responsive to the second instance of the unified communications application validating the hash-based signature through use of the symmetric key; and
displaying graphical data on a display screen of the client computing device, the graphical data comprises at least one contact in the list of contacts.

17. The computer-readable storage medium of claim 16 , wherein the client computing device is a mobile computing device.

18. The computer-readable storage medium of claim 17 , wherein the mobile computing device is a mobile telephone.

19. T

Assignees

• Microsoft Corp
• Microsoft Technology Licensing Llc

Inventors

• Tidwell Paul
• Pitsch Yves
• Rao Deepak
• Eydelman Vadim
• Kondepudi Satya

Classifications

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• H04L63/0807 Primary

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• H04L65/40

  Support for services or applications · CPC title

• G06F21/57

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title