Authenticating a client using linked authentication credentials
View Patent ↗Techniques are provided for improving security in a single-sign-on context by providing, to a user's client system, two linked authentication credentials in separate logical communication sessions and requiring that both credentials be presented to a host system. Only after presentation of both credentials is the user authenticated and permitted to access applications on the host system.
1. A method of facilitating authenticating of a client device, the method comprising:
providing, to a client device in a first communication session, a first authentication credential;
providing, to the client device in a second communication session that is different from the first communication session, a second authentication credential, the second authentication credential being linked to the first authentication credential, wherein the second authentication credential includes a status indicator that indicates that the second authentication credential is inactive, and wherein the second authentication credential, including the status indicator that indicates that the second authentication credential is inactive, by itself, fails to authenticate the client device;
receiving the first authentication credential and the second authentication credential from the client device in a third communication session that is different from the second communication session;
determining that the first authentication credential and the second authentication credential are linked; and
based on the determination that the first authentication credential and the second authentication credential are linked, enabling the second authentication credential to be used as a mechanism in authenticating the client device, wherein enabling the second authentication credential comprises setting the status indicator to indicate that the second authentication credential is active, wherein the second authentication credential, once identified as enabled by setting the status indicator to indicate that the second authentication credential is active, authenticates the client device without also presenting the first authentication credential.
2. The method of claim 1 wherein:
providing a first authentication credential to the client device comprises providing, to the client device, a first authentication credential that includes an identifier that uniquely identifies the first authentication credential;
providing a second authentication credential that is linked to the first authentication credential to the client device comprises providing, to the client device, a second authentication credential that includes a parent authentication credential identifier that indicates that the second authentication credential is linked to the first authentication credential by referencing the identifier that uniquely identifies the first authentication credential; and
determining that the first authentication credential and the second authentication credential are linked comprises determining that the second authentication credential includes the parent authentication credential identifier that references the identifier that uniquely identifies the first authentication credential.
3. The method of claim 2 wherein providing, to the client device, a second authentication credential that includes a parent authentication credential identifier that references the identifier that uniquely identifies the first authentication credential comprises providing, to the client device, a second authentication credential identifier that includes a parent authentication credential identifier that includes the identifier that uniquely identifies the first authentication credential.
4. The method of claim 1 wherein:
providing a second authentication credential that is linked to the first authentication credential to the client device comprises providing, to the client device, a second authentication credential that includes an identifier that uniquely identifies the second authentication credential;
providing a first authentication credential to the client device comprises providing, to the client device, a first authentication credential that includes a parent authentication credential identifier that indicates that the second authentication credential is linked to the first authentication credential by referencing the identifier that uniquely identifies the second authentication credential; and
determining that the first authentication credential and the second authentication credential are linked comprises determining that the first authentication credential includes the parent authentication credential identifier that references the identifier that uniquely identifies the second authentication credential.
5. The method of claim 1 further comprising providing, over the third communication session, the second authentication credential that is enabled for use in authenticating the client device.
6. The method of claim 1 wherein:
the first communication session comprises a secure communication session, and
the third communication session comprises a secure communication session.
7. The method of claim 5 wherein the second communication session comprises a communication session that differs in security from the first and third communication sessions.
8. The method of claim 1 wherein enabling the second authentication credential for use in authentication of the client device comprises enabling the second authentication credential for use in authentication of the client device for a predetermined amount of time.
9. The method of claim 1 wherein the first authentication credential comprises a ticket-granting ticket able to be used in only a single communication session.
10. The method of claim 1 wherein the second authentication credential comprises a ticket-granting ticket able to be used in only a single communication session.
11. An apparatus for facilitating authenticating of a client device, the apparatus comprising:
at least one processor; and
memory storing instructions that, when executed by the at least one processor, cause the apparatus to perform:
providing, to a client device in a first communication session, a first authentication credential;
providing, to the client device in a second communication session that is different from the first communication session, a second authentication credential, the second authentication credential being linked to the first authentication credential, wherein the second authentication credential includes a status indicator that indicates that the second authentication credential is inactive, and wherein the second authentication credential, including the status indicator that indicates that the second authentication credential is inactive, by itself, fails to authenticate the client device;
receiving the first authentication credential and the second authentication credential from the client device in a third communication session that is different from the second communication session;
determining that the first authentication credential and the second authentication credential are linked; and
based on the determination that the first authentication credential and the second authentication credential are linked, enabling the second authentication credential to be used as a mechanism in authenticating the client device, wherein enabling the second authentication credential comprises setting the status indicator to indicate that the second authentication credential is active, wherein the second authentication credential, once identified as enabled by setting the status indicator to indicate that the second authentication credential is active, authenticates the client device without also presenting the first authentication credential.
12. The apparatus of claim 11 wherein:
providing a first authentication credential to the client device comprises providing, to the client device, a first authentication credential that includes an identifier that uniquely identifies the first authentication credential;
providing a second authentication credential that is linked to the first authentication credential to the client device comprises providing, to the client device, a second authentication credential that includes a parent authentication credential identifier that indicates that the second authentication credential is linked to the first authentication credential by referencing the identifier that uniquely identifies the first authentication credential; and
determining that the first authentication credential and the second authentication credential are linked comprises determining that the second authentication credential includes the parent authentication credential identifier that references the identifier that uniquely identifies the first authentication credential.
13. The apparatus of claim 12 wherein providing, to the client device, a second authentication credential that includes a parent authentication credential identifier that references the identifier that uniquely identifies the first authentication credential comprises providing, to the client device, a second authentication credential identifier that includes a parent authentication credential identifier that includes the identifier that uniquely identifies the first authentication credential.
14. The apparatus of claim 11 wherein:
providing a second authentication credential that is linked to the first authentication credential to the client device comprises providing, to the client device, a second authentication credential that includes an identifier that uniquely identifies the second authentication credential;
providing a first authentication credential to the client device comprises providing, to the client device, a first authentication credential that includes a parent authentication credential identifier that indicates that the second authentication credential is linked to the first authentication credential by referencing the identifier that uniquely identifies the second authentication credential; and
determining that the first authentication credential and the second authentication credential are linked comprises determining that the first authentication credential includes the parent authentication credential identifier that references the identifier that uniquely identifies the second authentication credential.
15. The apparatus of claim 11 wherein at least one of the first authentication credential and the second authentication credential comprises a ticket-granting ticket able to be used in only a single communication session.
16. At least one non-transitory computer-readable medium storing computer-executable instructions that when executed by at least one processor cause the at least one processor to perform:
providing, to a client device in a first communication session, a first authentication credential;
providing, to the client device in a second communication session that is different from the first communication session, a second authentication credential, the second authentication credential being linked to the first authentication credential, wherein the second authentication credential includes a status indicator that indicates that the second authentication credential is inactive, and wherein the second authentication credential, including the status indicator that indicates that the second authentication credential is inactive, by itself, fails to authenticate the client device;
receiving the first authentication credential and the second authentication credential from the client device in a third communication session that is different from the second communication session;
determining that the first authentication credential and the second authentication credential are linked; and
based on the determination that the first authentication credential and the second authentication credential are linked, enabling the second authentication credential to be used as a mechanism in authenticating the client device, wherein enabling the second authentication credential comprises setting the status indicator to indicate that the second authentication credential is active, wherein the second authentication credential, once identified as enabled by setting the status indicator to indicate that the second authentication credential is active, authenticates the client device without also presenting the first authentication credential.
17. The at least one non-transitory computer-readable medium of claim 16 wherein:
providing a first authentication credential to the client device comprises providing, to the client device, a first authentication credential that includes an identifier that uniquely identifies the first authentication credential;
providing a second authentication credential that is linked to the first authentication credential to the client device comprises providing, to the client device, a second authentication credential that includes a parent authentication credential identifier that indicates that the second authentication credential is linked to the first authentication credential by referencing the identifier that uniquely identifies the first authentication credential; and
determining that the first authentication credential and the second authentication credential are linked comprises determining that the second authentication credential includes the parent authentication credential identifier that references the identifier that uniquely identifies the first authentication credential.
18. The at least one non-transitory computer-readable medium of claim 17 wherein providing, to the client device, a second authentication credential that includes a parent authentication credential identifier that references the identifier that uniquely identifies the first authentication credential comprises providing, to the client device, a second authentication credential identifier that includes a parent authentication credential identifier that includes the identifier that uniquely identifies the first authentication credential.
19. The at least one non-transitory computer-readable medium of claim 16 wherein:
providing a second authentication credential that is linked to the first authentication credential to the client device comprises providing, to the client device, a second authentication credential that includes an identifier that uniquely identifies the second authentication credential;
providing a first authentication credential to the client device comprises providing, to the client device, a first authentication credential that includes a parent authentication credential identifier that indicates that the second authentication credential is linked to the first authentication credential by referencing the identifier that uniquely identifies the second authentication credential; and
determining that the first authentication credential and the second authentication credential are linked comprises determining that the first authentication credential includes the parent authentication credential identifier that references the identifier that uniquely identifies the second authentication credential.
20. The at least one non-transitory computer-readable medium of claim 16 wherein at least one of the first authentication credential and the second authentication credential comprises a ticket-granting ticket able to be used in only a single communication session.