Abstract:
The claimed subject matter provides a method for securing a partner service. The method can include receiving a request, wherein the request comprises a unique value, to access the partner service, wherein the request is received from a browser client for a partner application and determining that a user is authorized to access the partner application, the partner application generating a token that associates the user with the partner application. The method can also include generating a signature for the token, the signature to enable the partner service to independently regenerate the signature, the token comprising an identifier for the partner application enabling the partner service to detect which partner application generates the token and sending the token with the signature to the browser client.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
       [0001]    This application claims priority to U.S. patent application Ser. No. 12/948,770, filed on Nov. 18, 2010, the contents of which are incorporated by reference as if set forth in their entirety herein for all of these applications. 
     
    
     BACKGROUND 
       [0002]    Web services may provide users a secured environment for accessing everyday applications such as email and chat. Generally, authenticated users may access the everyday applications using a web browser client. 
         [0003]    In some cases, web services may be partner enabled. A partner enabled web service may securely serve data for a partner application. Because of security concerns, partner applications typically access a partner-enabled web service through server-to-server communication. 
         [0004]    Direct access to a partner-enabled web service from a partner application&#39;s browser client is insecure. The insecurity arises from the challenge in verifying whether the direct access originates from a specific partner. Because of such insecurities, the partner client applications are typically stand-alone applications instead of web browser clients. 
       SUMMARY 
       [0005]    The following presents a simplified summary of the innovation in order to provide a basic understanding of some aspects described herein. This summary is not an extensive overview of the claimed subject matter. It is intended to neither identify key or critical elements of the claimed subject matter nor delineate the scope of the subject innovation. Its sole purpose is to present some concepts of the claimed subject matter in a simplified form as a prelude to the more detailed description that is presented later. 
         [0006]    In one embodiment, a method includes receiving a request, wherein the request comprises a unique value, to access the partner service, wherein the request is received from a browser client for a partner application and determining that a user is authorized to access the partner application, the partner application generating a token that associates the user with the partner application. The method can also include generating a signature for the token, the signature to enable the partner service to independently regenerate the signature, the token comprising an identifier for the partner application enabling the partner service to detect which partner application generates the token, and sending the token with the signature to the browser client. 
         [0007]    In another embodiment, a system for securing a partner service, can include a processing unit and a system memory, wherein the system memory comprises code configured to direct the processing unit to receive a request, wherein the request comprises a unique value to access the partner service, wherein the request is received from a browser client for a partner application, wherein the browser client is associated with a user. The code can also be configured to direct the processing unit to determine that the user is authorized to access the partner application and to generate a token, using the partner application, the token associating the user with the partner application, and the token comprising an identifier for the partner application enabling the partner service to identify the partner application as generating the token. Furthermore, the code can be configured to direct the processor to generate a signature for the token, the signature to enable the partner service to independently regenerate the signature and send the token with the signature to the browser client. 
         [0008]    In yet another embodiment, one or more computer-readable storage devices, can include code configured to direct a processing unit to receive a request to access a partner service, wherein the request comprises a unique value and the request is received from a browser client for a partner application, wherein the browser client is associated with a user and determine that the user is authorized to access the partner application. The code can also be configured to direct the processing unit to generate a token that associates the user with the partner application, wherein the token comprises an identifier of the partner application enabling the partner service to identify the partner application as generating the token and generate a signature for the token, the signature to enable the partner service to independently regenerate the signature. Furthermore, the code can be configured to direct the processing unit to send the token with the signature to the browser client and encode the token using a one-way hashing algorithm. 
         [0009]    The following description and the annexed drawings set forth in detail certain illustrative aspects of the claimed subject matter. These aspects are indicative, however, of a few of the various ways in which the principles of the innovation may be employed and the claimed subject matter is intended to include all such aspects and their equivalents. Other advantages and novel features of the claimed subject matter will become apparent from the following detailed description of the innovation when considered in conjunction with the drawings. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0010]      FIG. 1  is a block diagram of a system for securing a partner-enabled web service in accordance with the claimed subject matter; 
           [0011]      FIG. 2  is a message flow diagram of a method for securing a partner-enabled web service in accordance with the claimed subject matter; 
           [0012]      FIG. 3  is a block diagram of an exemplary networking environment wherein aspects of the claimed subject matter can be employed; and 
           [0013]      FIG. 4  is a block diagram of an exemplary operating environment that can be employed in accordance with the claimed subject matter. 
       
    
    
     DETAILED DESCRIPTION 
       [0014]    The claimed subject matter is described with reference to the drawings, wherein like reference numerals are used to refer to like elements throughout. In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the subject innovation. It may be evident, however, that the claimed subject matter may be practiced without these specific details. In other instances, well-known structures and devices are shown in block diagram form in order to facilitate describing the subject innovation. 
         [0015]    As utilized herein, terms “component,” “system,” “browser,” “web service,” “client,” “partner application” and the like are intended to refer to a computer-related entity, either hardware, software (e.g., in execution), and/or firmware. For example, a component can be a process running on a processor, an object, an executable, a program, a function, a library, a subroutine, and/or a computer or a combination of software and hardware. By way of illustration, both an application running on a server and the server can be a component. One or more components can reside within a process and a component can be localized on one computer and/or distributed between two or more computers. The term “processor” is generally understood to refer to a hardware component, such as a processing unit of a computer system. 
         [0016]    Furthermore, the claimed subject matter may be implemented as a method, apparatus, or article of manufacture using standard programming and/or engineering techniques to produce software, firmware, hardware, or any combination thereof to control a computer to implement the disclosed subject matter. The term “article of manufacture” as used herein is intended to encompass a computer program accessible from any non-transitory computer-readable device, or media. 
         [0017]    Non-transitory computer-readable storage media can include but are not limited to magnetic storage devices (e.g., hard disk, floppy disk, and magnetic strips, among others), optical disks (e.g., compact disk (CD), and digital versatile disk (DVD), among others), smart cards, and flash memory devices (e.g., card, stick, and key drive, among others). Of course, those skilled in the art will recognize many modifications may be made to this configuration without departing from the scope or spirit of the claimed subject matter. Moreover, the word “exemplary” is used herein to mean serving as an example, instance, or illustration. Any aspect or design described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other aspects or designs. 
         [0018]    Access to the partner-enabled web service may be restricted to authenticated users and authenticated partner client applications. These partner client applications may run on web browser clients. However, existing options to enable access for an authenticated user of a partner client application running on a browser are limited. 
         [0019]    For example, a partner authentication function may generate an application token to authenticate the partner client application running on the browser. Separate functionality may authenticate the user. However, this scheme offers no association between the authenticated partner client application and the authenticated user. As such, if the application token is compromised, security to the partner server application may be jeopardized. 
         [0020]    Further, there is no strong hint to trace the compromised token back to the authenticated user responsible for the token. This could result in resetting the whole partner server application, even for innocent users of such. Further, because there is no mechanism for associating a user and a partner application, a compromised user could claim an unverifiable association with any partner application. The result is that our partner-enabled web service would not be able to trust the service requests from our partners. 
         [0021]    A delegated authentication function may set up a session allowing the browser client to act on behalf of the authenticated user. While this scheme provides a strong association between the partner client application and the authenticated user, this scheme prohibits the partner application from sharing the user&#39;s authenticated session. As such, the partner application&#39;s authentication to the web service may be disjoint from other applications capable of sharing the same authentication system, such as Windows Live enabled applications. 
         [0022]    In one embodiment, a partner client application running on a web browser may access a partner-enabled web service. In such an embodiment, the partner client application may be authenticated and associated with the authenticated user. In this manner, the authenticated user may be enabled to access the partner-enabled web service via a partner application running on a web browser. 
         [0023]      FIG. 1  is a block diagram of a system  100  for securing a partner-enabled web service in accordance with the claimed subject matter. The system  100  includes a partner application client  102 , a partner application web service  104 , and a partner-enabled web service  106 , in communication over a network  108 . For clarity, the partner application web service  104  is referred to herein as the partner application  104 . 
         [0024]    The client  102  may be a web browser that enables a user to create an authenticated session on the partner application  104 . The partner-enabled web service  106  may be a secured web server application that provides access to common applications such as email, chat, and partner applications. Additionally, the partner-enabled web service  106  may secure its data service by serving only users that are associated with the partner application  104 . 
         [0025]    The partner application  104  and the partner-enabled web service  106  may have a trusted relationship that enables them to share a server side secret. In one embodiment, the partner-enabled web service  106  may be accessed using a representational state transfer application program interface (REST API). 
         [0026]    Further, both the partner application  104  and the partner-enabled web service  106  share a set of proprietary authentication utilities. Using these utilities, both the partner-enabled web service  106  and the partner application  104  may be able to retrieve a user id from the authenticated session. 
         [0027]    The partner application  104  may also include a centralized authorization engine that holds a list of users who can use the client  102  to access the partner application  104 . Advantageously, maintaining a centralized list of authorized users for a given application is easy to manage. 
         [0028]    The authorization engine may issue a client application association token (CAAT) that is carried to the client  102 . The client  102  may then pass both the user authenticated session and the CAAT to the partner-enabled web service  106 . The authentication engine may then verify that the CAAT is generated by the partner application  104  for the specified user. If any of the above steps fails, the authentication may fail, and the user may be denied access to the partner-enabled web service  106 . 
         [0029]    In this manner, an association may be maintained between an authenticated user and the authenticated partner application  104 . Additionally, the partner application  104  may share a session with the partner-enabled web service  106 . The authenticated user may be any user that can authenticate using the set of proprietary authentication utilities. 
         [0030]      FIG. 2  is a message flow diagram of a method  200  for securing a partner-enabled web service in accordance with the claimed subject matter. The method  200  begins when the client  102  sends a login request to the partner application  104 . The partner application  104 , by means of the set of proprietary authentication utilities, may then authenticate the user and establish an authenticated session. 
         [0031]    The partner application  104  may send a response to the client  102  that includes a canary value. As understood by one skilled in the art, the canary value may be used to guard against security issues like a replay attack, and cross-site request forgery. 
         [0032]    The client  102  may send an http request that includes the canary value. The http request may be for access to the partner application  104 . 
         [0033]    In response, the partner application  104  may determine whether the user is authorized to access the partner application  104 . 
         [0034]    If the user is authorized for both, the partner application  104  may generate a signature. The signature may include an application secret, the user id, and an application id for the partner application  104 . The application secret may be a key shared by the partner application  104  and the partner-enabled web service  106 , and used for signing the signature. 
         [0035]    The partner application  104  may retrieve the user id from the authenticated session, which may be represented as cookies. On the receiving end of the partner application  104 , the cookie may represent the logged-in user. The cookies are transported to the partner application  104  in a web service request to the partner application  104  (not shown). 
         [0036]    In one embodiment, the time within which the partner-enabled web service  106  is accessible to the partner application  104  may be limited. In such an embodiment, the signature may also include a time at which the signature is generated. 
         [0037]    The signature may be included within the CAAT, along with the application ID and time of issue. In one embodiment, the signature may be encoded using a hashing algorithm, such as a keyed-hash message authentication code such as HMAC-SHA1. 
         [0038]    The application ID may enable the partner-enabled web service  106  to know which partner application  104  has generated the CAAT. The partner-enabled web service  106  may use the application secret specific to the application ID to verify the CAAT. The time of issue may be used to guard against replay attacks, so that the CAAT cannot be reused indefinitely. 
         [0039]    The CAAT may be sent within the body of a response to the client  102 . The client  102  may store the CAAT in client memory. Advantageously, by encoding the CAAT using a one-way hashing algorithm, no server side secrets may be readily exposed on the client  102 . 
         [0040]    The client  102  may then compose a web service request for the partner-enabled web service  106 . In one embodiment, the web service request may be a REST request. The REST request may include the CAAT in the request header. The client  102  may then send an http request that includes the request header and cookies to the partner-enabled web service  106 . 
         [0041]    The partner-enabled web service  106  may then regenerate the signature. The signature may be regenerated using the component parts: the user id, the application ID, the time of issue, and the application secret. 
         [0042]    The partner-enabled web service  106  may retrieve the user id from the authenticated session. The application ID and the time of issue may be retrieved from the CAAT included in the request header. 
         [0043]    Both the partner application  104  and the partner-enabled web service  106  may own a copy of the application secret. As such, the partner-enabled web service  106  may use the application ID to determine which application secret to use. 
         [0044]    The partner-enabled web service  106  may then regenerate the signature and verify that the regenerated signature matches the signature included in the CAAT of the request header. If they match, the partner-enabled web service  106  may process the request, and send a response to the client  102 . If not, the partner-enabled web service  106  may send an error message. 
         [0045]    As stated previously, the time within which a signature may be used may be limited. In one embodiment, the partner may calculate an expiration time that is eight hours passed the issue time. If the current time is past the expiration time, the request may be rejected with an error message. 
         [0046]    Advantageously, using this method, the CAAT passed to the client  102  is associated with a user id. As such, any breach of usage agreement (with regard to a specific CAAT) may be linked to a specific user. Because the CAAT is associating a user with the partner application  104 , the partner-enabled web service  106  may trust the origin of the request as a valid referral from a partner application  104 . 
         [0047]      FIG. 3  is a block diagram of an exemplary networking environment  300  wherein aspects of the claimed subject matter can be employed. Moreover, the exemplary networking environment  300  may be used to implement a system and method of providing browser access to partner-enabled applications of a web service. The networking environment  300  includes one or more client(s)  310 . The client(s)  310  can be hardware and/or software (e.g., threads, processes, computing devices). The environment  300  also includes one or more server(s)  320 . The server(s)  320  can be hardware and/or software (e.g., threads, processes, computing devices). The servers  320  can house threads to automatically test the performance of advertising campaigns by employing the subject innovation, for example. 
         [0048]    One possible communication between a client  310  and a server  320  can be in the form of a data packet adapted to be transmitted between two or more computer processes. The environment  300  includes a communication framework  340  that can be employed to facilitate communications between the client(s)  310  and the server(s)  320 . The client(s)  310  are operably connected to one or more client data store(s)  350  that can be employed to store information local to the client(s)  310 . The client data store(s)  350  do not have to be in the client(s)  310 , but may be located remotely, such as in a cloud server. Similarly, the server(s)  320  are operably connected to one or more server data store(s)  330  that can be employed to store information local to the servers  320 . 
         [0049]    As an example, the client(s)  310  may be computers providing access to servers over a communication framework  340 , such as the Internet. The server(s)  320  may be web service servers accessed by the client  102 . 
         [0050]    With reference to  FIG. 4 , an exemplary operating environment  400  for implementing various aspects of the claimed subject matter includes a computer  412 . The computer  412  includes a processing unit  414 , a system memory  416 , and a system bus  418 . 
         [0051]    The system bus  418  couples system components including, but not limited to, the system memory  416  to the processing unit  414 . The processing unit  414  can be any of various available processors. Dual microprocessors and other multiprocessor architectures also can be employed as the processing unit  414 . 
         [0052]    The system bus  418  can be any of several types of bus structure(s) including the memory bus or memory controller, a peripheral bus or external bus, and/or a local bus using any variety of available bus architectures known to those of ordinary skill in the art. 
         [0053]    The system memory  416  is non-transitory computer-readable media that includes volatile memory  420  and nonvolatile memory  422 . The basic input/output system (BIOS), containing the basic routines to transfer information between elements within the computer  412 , such as during start-up, is stored in nonvolatile memory  422 . By way of illustration, and not limitation, nonvolatile memory  422  can include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. 
         [0054]    Volatile memory  420  includes random access memory (RAM), which acts as external cache memory. By way of illustration and not limitation, RAM is available in many forms such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), SynchLink™ DRAM (SLDRAM), Rambus® direct RAM (RDRAM), direct Rambus® dynamic RAM (DRDRAM), and Rambus® dynamic RAM (RDRAM). 
         [0055]    The computer  412  also includes other non-transitory computer-readable media, such as removable/non-removable, volatile/non-volatile computer storage media.  FIG. 4  shows, for example a disk storage  424 . Disk storage  424  includes, but is not limited to, devices like a magnetic disk drive, floppy disk drive, tape drive, Jaz drive, Zip drive, LS-100 drive, flash memory card, or memory stick. 
         [0056]    In addition, disk storage  424  can include storage media separately or in combination with other storage media including, but not limited to, an optical disk drive such as a compact disk ROM device (CD-ROM), CD recordable drive (CD-R Drive), CD rewritable drive (CD-RW Drive) or a digital versatile disk ROM drive (DVD-ROM). To facilitate connection of the disk storage devices  424  to the system bus  418 , a removable or non-removable interface is typically used such as interface  426 . 
         [0057]    It is to be appreciated that  FIG. 4  describes software that acts as an intermediary between users and the basic computer resources described in the suitable operating environment  400 . Such software includes an operating system  428 . Operating system  428 , which can be stored on disk storage  424 , acts to control and allocate resources of the computer system  412 . 
         [0058]    System applications  430  take advantage of the management of resources by operating system  428  through program modules  432  and program data  434  stored either in system memory  416  or on disk storage  424 . It is to be appreciated that the claimed subject matter can be implemented with various operating systems or combinations of operating systems. 
         [0059]    A user enters commands or information into the computer  412  through input device(s)  436 . Input devices  436  include, but are not limited to, a pointing device (such as a mouse, trackball, stylus, or the like), a keyboard, a microphone, a joystick, a satellite dish, a scanner, a TV tuner card, a digital camera, a digital video camera, a web camera, and/or the like. The input devices  436  connect to the processing unit  414  through the system bus  418  via interface port(s)  438 . Interface port(s)  438  include, for example, a serial port, a parallel port, a game port, and a universal serial bus (USB). 
         [0060]    Output device(s)  440  use some of the same type of ports as input device(s)  436 . Thus, for example, a USB port may be used to provide input to the computer  412 , and to output information from computer  412  to an output device  440 . 
         [0061]    Output adapter  442  is provided to illustrate that there are some output devices  440  like monitors, speakers, and printers, among other output devices  440 , which are accessible via adapters. The output adapters  442  include, by way of illustration and not limitation, video and sound cards that provide a means of connection between the output device  440  and the system bus  418 . It can be noted that other devices and/or systems of devices provide both input and output capabilities such as remote computer(s)  444 . 
         [0062]    The computer  412  can be a server hosting a partner-enabled web service in a networked environment using logical connections to one or more remote computers, such as remote computer(s)  444 . The remote computer(s)  444  may be client systems configured with web browsers, PC applications, mobile phone applications, and the like, to allow users to access the advertising network, as discussed herein. The remote computer(s)  444  can be a personal computer, a server, a router, a network PC, a workstation, a microprocessor based appliance, a mobile phone, a peer device or other common network node and the like, and typically includes many or all of the elements described relative to the computer  412 . 
         [0063]    For purposes of brevity, only a memory storage device  446  is illustrated with remote computer(s)  444 . Remote computer(s)  444  is logically connected to the computer  412  through a network interface  448  and then physically connected via a communication connection  450 . 
         [0064]    Network interface  448  encompasses wire and/or wireless communication networks such as local-area networks (LAN) and wide-area networks (WAN). LAN technologies include Fiber Distributed Data Interface (FDDI), Copper Distributed Data Interface (CDDI), Ethernet, Token Ring and the like. WAN technologies include, but are not limited to, point-to-point links, circuit switching networks like Integrated Services Digital Networks (ISDN) and variations thereon, packet switching networks, and Digital Subscriber Lines (DSL). 
         [0065]    Communication connection(s)  450  refers to the hardware/software employed to connect the network interface  448  to the bus  418 . While communication connection  450  is shown for illustrative clarity inside computer  412 , it can also be external to the computer  412 . The hardware/software for connection to the network interface  448  may include, for exemplary purposes only, internal and external technologies such as, mobile phone switches, modems including regular telephone grade modems, cable modems and DSL modems, ISDN adapters, and Ethernet cards. 
         [0066]    An exemplary embodiment of the computer  412  may comprise a server hosting a partner-enabled web service. The server may be configured to secure access to partner applications as described herein. An exemplary processing unit  414  for the server may be a computing cluster comprising Intel® Xeon CPUs. The disk storage  424  may comprise an enterprise data storage system, for example, holding thousands of impressions. 
         [0067]    Exemplary embodiments of the subject innovation may associate an authenticated user with an authenticated application. The subject innovation may generate a token that includes a user id, application id, and an application secret that is encoded by a one-way hashing algorithm. 
         [0068]    What has been described above includes examples of the subject innovation. It is, of course, not possible to describe every conceivable combination of components or methodologies for purposes of describing the claimed subject matter, but one of ordinary skill in the art may recognize that many further combinations and permutations of the subject innovation are possible. Accordingly, the claimed subject matter is intended to embrace all such alterations, modifications, and variations that fall within the spirit and scope of the appended claims. 
         [0069]    In particular and in regard to the various functions performed by the above described components, devices, circuits, systems and the like, the terms (including a reference to a “means”) used to describe such components are intended to correspond, unless otherwise indicated, to any component which performs the specified function of the described component (e.g., a functional equivalent), even though not structurally equivalent to the disclosed structure, which performs the function in the herein illustrated exemplary aspects of the claimed subject matter. In this regard, it will also be recognized that the innovation includes a system as well as a computer-readable storage media having computer-executable instructions for performing the acts and/or events of the various methods of the claimed subject matter. 
         [0070]    There are multiple ways of implementing the subject innovation, e.g., an appropriate API, tool kit, driver code, operating system, control, standalone or downloadable software object, etc., which enables applications and services to use the techniques described herein. The claimed subject matter contemplates the use from the standpoint of an API (or other software object), as well as from a software or hardware object that operates according to the techniques set forth herein. Thus, various implementations of the subject innovation described herein may have aspects that are wholly in hardware, partly in hardware and partly in software, as well as in software. 
         [0071]    The aforementioned systems have been described with respect to interaction between several components. It can be appreciated that such systems and components can include those components or specified sub-components, some of the specified components or sub-components, and/or additional components, and according to various permutations and combinations of the foregoing. Sub-components can also be implemented as components communicatively coupled to other components rather than included within parent components (hierarchical). 
         [0072]    Additionally, it can be noted that one or more components may be combined into a single component providing aggregate functionality or divided into several separate sub-components, and any one or more middle layers, such as a management layer, may be provided to communicatively couple to such sub-components in order to provide integrated functionality. Any components described herein may also interact with one or more other components not specifically described herein but generally known by those of skill in the art. 
         [0073]    In addition, while a particular feature of the subject innovation may have been disclosed with respect to only one of several implementations, such feature may be combined with one or more other features of the other implementations as may be desired and advantageous for any given or particular application. Furthermore, to the extent that the terms “includes,” “including,” “has,” “contains,” variants thereof, and other similar words are used in either the detailed description or the claims, these terms are intended to be inclusive in a manner similar to the term “comprising” as an open transition word without precluding any additional or other elements.