Microsoft Technology Licensing, LLC

Guruprasad B Aphale

Adrian Frei

Tarek B Kamel

Yordan Ivanov Rouskov

Vijay G Bharadwaj

Xiaohong Su

Allan Wetter

Dejan Subotic

Sankara Narayanan Venkataraman

Sanket Kaluskar

Binding a security token to a client token binder, such as a trusted platform module, is provided. A bound security token can only be used on the client on which it was obtained. A secret binding key (k) is established between the client and an STS. The client derives a key (k) from k, signs a security token request with k, and instructs the STS to bind the requested security token to k. The STS validates the request by deriving kusing a client-provided nonce and kto MAC the message and compare the MAC values. If the request is validated, the STS generates a response comprising the requested security token, derives two keys from k: one to sign the response and one to encrypt the response, and sends the response to the client. Only a device comprising kis enabled to use the bound security token, providing increased security.

Token binding using trust module protected keys

In one embodiment, a user devicemay access a network serviceusing a secure cookie. A high trust process may create an authentication proofusing a secure key. The high trust process may provide a browsing tokenand the authentication proofto a low trust process to send to an authentication service

Proof of possession for web browser cookie based security tokens

Growing community of inventors

Bothell, WA, United States of America

Guruprasad B Aphale