Patent ID: 7900247
Filing Date: 2011-03-01
Classification: H04L

Abstract:
1. At a computer system, a method of authenticating a Web services client, the method comprising: an act of sending an authentication request to an authentication service; an act of receiving an authentication response from the authentication service, the authentication response including two instances of a first symmetric session key for securing communication between the Web services client and an access granting service, the first instance of the first symmetric session key secured for delivery to the Web services client and included in a first proof token, the second instance of the first symmetric session key encrypted with a secret symmetric key of the security token service and included in a token granting token, the token granting token being signed with a digital signature using the secret symmetric key, the authentication response also being signed with a digital signature using the authentication service's private key; an act of sending an access request for access to an instance of a Web service in a Web service farm to the access granting service, the access request including the token granting token; an act of receiving an access granting response from the access granting service, the access granting response including two instances of a second symmetric session key for securing communication between the Web services client and the Web service, the first instance of the second symmetric session key being encrypted with the first symmetric session key and included in a second proof token, the second instance of the second symmetric session key being encrypted with a public key from a public/private key pair corresponding to the Web service and included in a service token; an act of sending a security token request to a first instance of the Web service, the security token request including identity information for the Web services client and the service token; an act of receiving a security token response from the first instance of the Web service, the security token response including a security context token and a master symmetric session key for securing communication between the Web services client and the Web service, the security context token including a binary extension such that any instance of the Web service in the Web service farm can recreate security session state for the Web services client from the binary extension without referring to a distributed service-side cache; an act of deriving a first and second derived symmetric session keys from the master symmetric session key, wherein the first and second derived symmetric session keys are derived by the Web services client using a common key derivation algorithm; an act of sending a service request to the first instance of the Web service, the service request encrypted using the first derived symmetric session key and signed using a second derived symmetric session key; an act of receiving a service response from the first instance of the Web service, the service response encrypted using a third derived symmetric session key, the service response signed with a digital signature using a fourth derived symmetric session key, wherein the third and fourth derived symmetric session keys were derived by the first instance of the Web service from the master symmetric session key using the common key derivation algorithm; an act of deriving the third and fourth derived symmetric session keys from the master symmetric session key, wherein the third and fourth derived symmetric session keys are derived by the Web services client using the common key derivation algorithm; an act of using the third derived symmetric session key to decrypt the service response; an act of using the fourth derived symmetric session key to validate the digital signature; an act of sending the security context token including the binary extension to a second instance of the Web service such that the second instance of the Web service recreates the security session state for the Web services client from the binary extension without referring to a distributed service-side cache; and an act of sending a service request to the second instance of the Web service using symmetric session keys that are derived from the master symmetric session key that was received from the first instance of the Web service such that the Web services client may communicate with the second instance of the Web service without first having to request a security token from the second instance of the Web service.