Microsoft Technology Licensing, LLC

Yordan Ivanov Rouskov

Rui Chen

Pui-Yin Winfred Wong

Lynn Ayres

David Steeves

Eric Fleischman

Wei Jiang

Wei-Quiang Michael Guo

Wei-qiang Guo

Winfred Wong

Krishna C Vitaldevara

Sarah Faulkner

Prabu Raju

Ramesh Manne

Luke Abrams

Hersh Dangayach

Niyantha Shekar

Payoj Baral

Meenakshi Ramaswamy

Ariel Nicolas Gordon

Sarat Chandra Subramaniam

Titus Constantin Miron

Ismail Cem Paya

Trevin M Chow

Caleb Geoffrey Baker

Kok Wai Chan

Lin Huang

Adrian Frei

Violet Anna Barhudarian

Samuel Devasahayam

Adam Back

Dilip Krishna Pai

Radhika Kashyap

Venkatesh Gopalakrishnan

David W Bailey

Colin Chow

Sanjeev M Nagvekar

Lu Zhao

John D Whited

Rajeev Dujari

Marc Shepard

Gaurav Raghu Dhawan

John M Hawkins

Kyle Stapley Young

Oren Jordan Melzer

Tarek B Kamel

Vikas Rajvanshy

Anirban Basu

Venkata Raghuram Pampana

Allan Wetter

Jiangfeng Lu

Prabagar Ramadasse

Carlos Adrian Lopez Castro

William Bruce Barr, Iii

Sriram Dhanasekaran

Peter M Tsang

Orville Charles McDonald

Biao Wang

Parmeshwar Miguel Sequeira Arewar

Wei-Qiang (Michael) Guo

WeiQiang Michael Guo

Matt Sullivan

Kalyan Sayyaparaju

Samim Erdogan

Charles W Kaufman

Cormac E Herley

Murli D Satagopan

Alexander Thomas Weinert

Amit Kumar

Anthony Christopher Bloesch

Benjamin Richard Vincent

James Charles Kleewein

Stuart Schechter

Vijay G Bharadwaj

Daniel W Crevier

Jeffrey F Spelman

Xiaohong Su

Vikrant Arora

Robert McKee Howard

Laurentiu Bogdan Cristofor

Tore L Sundelin

Tarek Bahaa El-Din Mahmoud Kamel

Ramu Movva

Daniel Kershaw

Ryan D Johnson

Sean Christian Wohlgemuth

Brendan W Dixon

Yavor Vesselinov Angelov

Spencer Wong Low

Vaishali De

Walter C Hsueh

Michael Vincent McLaughlin

Ross Peter Adams

Shiung-Vei Yong

Matthew Hur

George Adrian Drumea

Dmitry Pugachev

Jean-Marc Prieur

Arieh Bibliowicz

Rammohan Nagasubramani

Generally discussed herein are devices, systems, and methods for binding with cryptographic key attestation. A method can include generating, by hardware of a device, a device public key and a device private key, based on the device private key, signing a first attestation resulting in a signed first attestation, the first attestation claiming the device private key originated from the hardware, based on the device public key and the signed first attestation, registering the device with a trusted authority, generating, by the hardware, a first application private key and a first application public key, and based on the device private key, signing a second attestation resulting in a signed second attestation, the second attestation claiming the first application private key originated from the hardware, and based on the first application public key and the signed second attestation, registering a first application of the device to a first server.

Binding with cryptographic key attestation

A computing system configured to support entities having the ability to indicate capability information for capabilities of the entities is illustrated. Embodiments may include an identity provider computer system comprising at least one processor. The identity provider computer system is configured to receive requests for access tokens from entities. The requests include capability information for the entities. The identity provider computer system is further configured to provide access tokens to the entities which include the capability information. The computing system further includes a resource provider computer system comprising at least one processor configured to receive resource requests and access tokens from entities. The access tokens include the capability information. The resource providers are further configured to provide responses to the entities according to the capability information.

Client readiness system

Authenticating computing entities. A method includes at an identity provider, providing a first access token to an entity for use by the entity in obtaining resources from a resource provider. The method further includes, at the identity provider, receiving response information from the entity. The response information from the entity is provided to the entity from the resource provider as a result of the resource provider enforcing policy at the resource provider. At the identity provider, a second access token is provided to the entity. The second access token is provided based on the response information, such that the second access token can be used by the entity to obtain the resources from the resource provider.

Rich token rejection system

Managing user sessions in a networked computing environment. A method includes, at an identity provider computer system, providing a first id token to a resource provider for an entity. The first id token has therein a first policy check interval having a value defining a period when the first id token should be revalidated. Due to expiration of the first policy check interval, a first refresh token is received from a resource provider computer system that received the first id token. As a result of receiving the first refresh token from the resource provider computer system, the identity provider computer system evaluates conditional access policy for the entity. If the identity provider computer system determines that the conditional access policy for the entity has been met, the identity provider computer system provides a new id token and a new refresh token to the resource provider computer system.

Server to server communication

Methods for hardening security between web services using protected forwarded access tokens are implemented via systems and devices. User applications receive user tokens with user information from an identity provider and provide the user tokens to first services with data requests. Each first service extracts and transforms a portion of a user token to validate a user token signature, and determines a target service for the data request. The first services acquire actor tokens from the identity provider that uniquely identify the first services using public keys, and then generate authentication tokens, signed with corresponding private keys, that encapsulate the actor tokens and the transformed user tokens. The signed authentication tokens are provided to target services which validate the authentication tokens as well as the encapsulated tokens and their respective signatures. Upon validation, requested data is retrieved and provided back for the user applications from the target services.

System and method for hardening security between web services using protected forwarded access tokens

In one embodiment, a user authentication server may use geo-location tracking to determine whether to present an enhanced identity challenge. A communication interfacemay receive a user login attempt by a user and a current location of the user login attempt. A data storagemay store a user location profile of the user. A processormay execute a comparison of the current location to the user location profile. The communication interfacemay present the user with an enhanced identity challenge before allowing user access based on the comparison.

Protection from unfamiliar login locations

Methods, systems, and apparatuses in a computing device enable user access to a resource. The method includes receiving, from a user, a request for access to a resource; accessing an authentication flow for granting access to the resource; obtaining first claims for a user from a first claims provider in the authentication flow; determining a second claims provider in the authentication flow, the second claims provider having a trust relationship with the claims facilitator; directing the user to the second claims provider; receiving second claims for the user from the second claims provider; and enabling the user to access the resource in response to at least the received first and second claims.

Extensible framework for authentication

Single sign-on identity management between local and cloud-based systems is provided. A remote or cloud-based authentication endpoint is registered as a local device, service or resource in a user's local directory services system. A local device and associated user requesting access to cloud-based resources will then see the authentication endpoint as an internal (inside the enterprise) server and may supply an authentication ticket which includes on-premises log-in or sign-on identity for the user. The remote or cloud-based authentication endpoint may then validate the authentication ticket, and the user may then access devices, applications and services operated in association with the remote or cloud-based authentication endpoint without a second or separate log-in or sign-on and without use of additional authentication equipment at the user's enterprise network.

Single sign-on identity management between local and remote systems

The automatic selection of an identity provider to be used to authenticate users when requesting to access network resources for a tenant. The authentication is initiated by checking the username against the directory of the tenant. If that check results in finding an entry for the username in that directory, the entry is checked for an identity provider. If that check results in finding an identity provider, the user is directed to that found identity provider for authentication. Thus, in many, most, or all cases, an identity provider is found and selected for authentication of the user without the user having to manually select the identity provider. The username may be an internal user of an entity. The selection of the identity provider works in either case since there would still be an entry for that user in the directory of the tenant.

Resource-based selection of identity provider

Network services may include data associated with one or more entities. An aggregator service may host respective application programming interfaces (APIs) of the services at a single endpoint of the network such that the entities, including associations and relationships between entities, may be federated. For example, the services may register the entities of which the data of each of the services is associated with through a declarative entity model to establish an API schema for each of the services, which may be published at the aggregator service. In response to receipt of a request for entity related data from a client, the aggregator service may employ the declarative entity model to determine which of the services are associated with the entity related data such that a query may be submitted to the services, and how to aggregate responses to the query received from the services for transmission to the client.

Aggregation and federation of distributed service entities and associations

A device operated by a user may store an object to which access is to be regulated, which may be achieved by encrypting the object with an encryption key and sending the key to a server having a key store. When a user of the device requests access to the object, the server may authenticate the user (e.g., according to a credential submitted by the user) and verify a trust identifier of the device (e.g., authorization to access the object through the device, and/or the integrity of the device), before sending to the device a ticket granting access to the key. The device may send the ticket to the server, receive the key from the server, decrypt the stored encrypted object, and provide the object to the user. This mechanism promotes rapid access upon request and efficient use of the server, and enables remote revocation of access.

Controlling access to protected objects

Binding a security token to a client token binder, such as a trusted platform module, is provided. A bound security token can only be used on the client on which it was obtained. A secret binding key (k) is established between the client and an STS. The client derives a key (k) from k, signs a security token request with k, and instructs the STS to bind the requested security token to k. The STS validates the request by deriving kusing a client-provided nonce and kto MAC the message and compare the MAC values. If the request is validated, the STS generates a response comprising the requested security token, derives two keys from k: one to sign the response and one to encrypt the response, and sends the response to the client. Only a device comprising kis enabled to use the bound security token, providing increased security.

Token binding using trust module protected keys

Embodiments are directed to revoking user sessions using signaling. In one scenario, an identity platform operating on a computer system receives an indication indicating that a user's login account has been compromised, where the user's login account has an associated login session and corresponding session artifact that is valid for a specified amount of time. The identity platform generates a signal indicating that the login session is no longer trusted and that the user is to be re-directed to the identity platform to re-authenticate and renew the session artifact and provides the generated signal to various relying parties including at least one relying party that is hosting the login session for the user.

Revoking sessions using signaling

Growing community of inventors

Seattle, WA, United States of America

Yordan Ivanov Rouskov