Microsoft Technology Licensing, LLC

Tarek B Kamel

Adrian Frei

James Shang Kai Chou

Yordan Ivanov Rouskov

Benjamin Richard Vincent

Dejan Subotic

Guruprasad B Aphale

Paul J Leach

Cristian Marius Ilac

Eric Fleischman

Liqiang Zhu

Vijay G Bharadwaj

Xiaohong Su

Allan Wetter

Sparky Toews

Daniel E Castro

Peter M Tsang

Kristina Karen Hotz

Rachel Anne Brown Teller

Sankara Narayanan Venkataraman

Peter E Zenzerovich

Narender Chauhan

Sanket Kaluskar

Neelam Anuradha Reddy

Guruprasad Aphale

According to examples, an apparatus may include a processor that may receive a request from a first device for an authentication token for access to a service, determine whether the first device is authorized to receive the authentication token for access to the service, and based on a determination that the first device is authorized to receive the authentication token for access to the service, generate a machine-readable code including the authentication token that a second device is to use for access to the service by the second device. The processor may also send the generated machine-readable code to the first device. The first device may display the machine-readable code and the second device may use a captured image of the machine-readable code to establish an authenticated session to the service on the second device.

Establish access to a service using machine-readable code

Authenticating a secure session between a first user entity and an identity provider using a second user entity. The method includes receiving a request for a session from an entity that purports to be the first user entity. The method further includes sending authentication context from the request, and wherein the authentication context for the request arrives at the second user entity. The method further includes receiving an indication that the authentication context has been verified. As a result, the method further includes authenticating a secure session between a first user entity and an identity provider or approving a secure transaction.

Securing remote authentication

A device operated by a user may store an object to which access is to be regulated, which may be achieved by encrypting the object with an encryption key and sending the key to a server having a key store. When a user of the device requests access to the object, the server may authenticate the user (e.g., according to a credential submitted by the user) and verify a trust identifier of the device (e.g., authorization to access the object through the device, and/or the integrity of the device), before sending to the device a ticket granting access to the key. The device may send the ticket to the server, receive the key from the server, decrypt the stored encrypted object, and provide the object to the user. This mechanism promotes rapid access upon request and efficient use of the server, and enables remote revocation of access.

Controlling access to protected objects

Binding a security token to a client token binder, such as a trusted platform module, is provided. A bound security token can only be used on the client on which it was obtained. A secret binding key (k) is established between the client and an STS. The client derives a key (k) from k, signs a security token request with k, and instructs the STS to bind the requested security token to k. The STS validates the request by deriving kusing a client-provided nonce and kto MAC the message and compare the MAC values. If the request is validated, the STS generates a response comprising the requested security token, derives two keys from k: one to sign the response and one to encrypt the response, and sends the response to the client. Only a device comprising kis enabled to use the bound security token, providing increased security.

Token binding using trust module protected keys

User-authentication-based approval of a first device via communication with a second device over a channel (e.g., an insecure channel) is described. The first device receives a session ID and first user-observable information, or an identifier thereof, from an identity provider, presents the first user-observable information to a user, and sends the session ID to the second device. The second device sends the session ID to the identity provider to obtain therefrom second user-observable information, or an identifier thereof, and a security challenge. The second user-observable information bears a user-discernable relationship to the first user-observable information and is presented to the user by the second device. The second device is capable of generating a response to the security challenge for transmission to the identity provider based at least on input received from the user, the response to the security challenge being indicative of the suitability of the first device for approval.

User-authentication-based approval of a first device via communication with a second device

Embodiments are directed to validating the identity of a user. In one scenario, a computer system determines that a login account has been created for a user, where the creation includes generation of a first identifier for the user based on a user's determined location at the time of account creation. The computer system next receives a login attempt from the user that includes a second, different identifier and one or more login credentials. The computer system then determines the location from which the login attempt was received and, using the second identifier and the determined login location, identifies the user account corresponding to the user. The computer system further authenticates the user upon determining that the second identifier and login location match the first identifier.

Location-based user disambiguation

In one embodiment, a user devicemay access a network serviceusing a secure cookie. A high trust process may create an authentication proofusing a secure key. The high trust process may provide a browsing tokenand the authentication proofto a low trust process to send to an authentication service

Proof of possession for web browser cookie based security tokens

An exemplary group ticket for a Kerberos protocol includes a service ticket encrypted with a dynamic group key and a plurality of enveloped pairs where each pair includes a name associated with a member of a group and an encrypted the dynamic group key for decryption by a key possessed by the member of the group where decryption of an encrypted dynamic group key allows for decryption of the service ticket. Other exemplary methods, systems, etc., are also disclosed.

Kerberos ticket virtualization for network load balancers

Growing community of inventors

Issaquah, WA, United States of America

Tarek B Kamel