1. A method for authenticating a client within a distributed data processing system, the method comprising the steps of:
receiving a digital certificate from the client at a host within the distributed data processing system;
obtaining a host identity for the client from the digital certificate, wherein the host identity for the client identifies the client to the host, and wherein the host is not a certifying authority that issued the digital certificate;
retrieving host-decryptable secret data associated with the host identity from the digital certificate;
decrypting the host-decryptable secret data with a host private key to generate secret data; and
authenticating the client at the host using the host identity and the secret data.
2. The method of claim 1, wherein the host acts as a proxy for the client.
3. The method of claim 1 further comprising:
verifying the received digital certificate.
4. The method of claim 1 further comprising:
generating, at the client, a request for a digital certificate comprising host identity mapping data;
sending the request for the digital certificate to a certifying authority (CA); and
receiving a digital certificate comprising host identity mapping data from the certifying authority.
5. The method of claim 4 further comprising:
storing the host identity in the request for the digital certificate;
encrypting secret data associated with the host identity using a public key of the certifying authority to generate CA-decryptable secret data; and
storing the CA-decryptable secret data in the request for the digital certificate, wherein the host identity and the CA-decryptable secret data comprise the host identity mapping data in the request for the digital certificate.
6. The method of claim 4 further comprising:
receiving, at the certifying authority, the request for a digital certificate;
generating the digital certificate in response to the received request for the digital certificate; and
sending the generated digital certificate to the client.
7. The method of claim 4 further comprising:
retrieving CA-decryptable secret data from the host identity mapping data in the request for the digital certificate;
decrypting the CA-decryptable secret data associated with the host identity using a private key of the certifying authority to generate secret data;
encrypting the secret data associated with the host identity using a public key of the host to generate the host-decryptable secret data; and
storing the host-decryptable secret data in the digital certificate, wherein the host identity and the host-decryptable secret data comprise the host identity mapping data in the digital certificate.
8. The method of claim 1 wherein the digital certificate comprises multiple host identities for multiple hosts within the distributed data processing system.
9. The method of claim 1 wherein the digital certificate is formatted according to the X.509 standard.
10. The method of claim 9 wherein the host identity and the host-decryptable secret data associated with the host identity is stored within an X.509 extension within the digital certificate.
11. The method of claim 1 further comprising:
performing multiple authentication processes within the distributed data processing system for the client through the host using information within the digital certificate.
12. A method for generating a digital certificate, the method comprising the steps of:
receiving, at a certifying authority (CA), a request for a digital certificate from a client, wherein the request for a digital certificate comprises host identity mapping data, wherein a host identity for the client within the host identity mapping data identifies the client to a host, and wherein the host is not the certifying authority;
generating the digital certificate in response to the received request for a digital certificate; and
sending the generated digital certificate to the client, wherein the digital certificate comprises host identity mapping data.
13. The method of claim 12 further comprising:
retrieving CA-decryptable secret data from the host identity mapping data in the request for a digital certificate;
decrypting the CA-decryptable secret data associated with a host identity using a private key of the certifying authority to generate secret data;
encrypting the secret data associated with the host identity using a public key of a host to generate a host-decryptable secret data; and
storing the host-decryptable secret data in the digital certificate, wherein the host identity and the host-decryptable secret data comprise the host identity mapping data in the digital certificate.
14. An apparatus for authenticating a client within a distributed data processing system, the apparatus comprising:
first receiving means for receiving a digital certificate from the client at a host within the distributed data processing system;
obtaining means for obtaining a host identity for the client from the digital certificate, wherein the host identity for the client identifies the client to the host, and wherein the host is not a certifying authority that issued the digital certificate;
first retrieving means for retrieving host-decryptable secret data associated with the host identity from the digital certificate;
first decrypting means for decrypting the host-decryptable secret data with a host private key to generate secret data; and
authenticating means for authenticating the client at the host using the host identity and the secret data.
15. The apparatus of claim 14, wherein the host acts as a proxy for the client.
16. The apparatus of claim 14 further comprising:
verifying means for verifying the received digital certificate.
17. The apparatus of claim 14 further comprising:
first generating means for generating, at the client, a request for a digital certificate comprising host identity mapping data;
first sending means for sending the request for the digital certificate to a certifying authority (CA); and
second receiving means for receiving a digital certificate comprising host identity mapping data from the certifying authority.
18. The apparatus of claim 17 further comprising:
first storing means for storing the host identity in the request for the digital certificate;
first encrypting means for encrypting secret data associated with the host identity using a public key of the certifying authority to generate CA-decryptable secret data; and
second storing means for storing the CA-decryptable secret data in the request for the digital certificate, wherein the host identity and the CA encrypted CA-decryptable secret data comprise the host identity mapping data in the request for the digital certificate.
19. The apparatus of claim 17 further comprising:
third receiving means for receiving, at the certifying authority, the request for a digital certificate;
second generating means for generating the digital certificate in response to the received request for the digital certificate; and
second sending means for sending the generated digital certificate to the client.
20. The apparatus of claim 17 further comprising:
second retrieving means for retrieving CA-decryptable secret data from the host identity mapping data in the request for the digital certificate;
second decrypting means for decrypting the CA-decryptable secret data associated with the host identity using a private key of the certifying authority to generate secret data;
second encrypting means for encrypting the secret data associated with the host identity using a public key of the host to generate the host-decryptable secret data; and
third storing means for storing the host-decryptable secret data in the digital certificate, wherein the host identity and the host-decryptable secret data comprise the host identity mapping data in the digital certificate.
21. The apparatus of claim 14 wherein the digital certificate comprises multiple host identities for multiple hosts within the distributed data processing system.
22. The apparatus of claim 14 wherein the digital certificate is formatted according to the X.509 standard.
23. The apparatus of claim 22 wherein the host identity and the host-decryptable secret data associated with the host identity is stored within an X.509 extension within the digital certificate.
24. The apparatus of claim 14 further comprising:
performing means for performing multiple authentication processes within the distributed data processing system for the client through the host using information within the digital certificate.
25. An apparatus for generating a digital certificate, the apparatus comprising:
receiving means for receiving, at a certifying authority (CA), a request for a digital certificate from a client, wherein the request for a digital certificate comprises host identity mapping data, wherein a host identity for the client within the host identity mapping data identifies the client to a host, and wherein the host is not the certifying authority;
generating means for generating the digital certificate in response to the received request for a digital certificate; and
sending means for sending the generated digital certificate to the client, wherein the digital certificate comprises host identity mapping data.
26. The apparatus of claim 25 further comprising:
retrieving means for retrieving CA-decryptable secret data from the host identity mapping data in the request for a digital certificate;
decrypting means for decrypting the CA-decryptable secret data associated with a host identity using a private key of the certifying authority to generate secret data;
encrypting means for encrypting the secret data associated with the host identity using a public key of a host to generate host-decryptable secret data; and
storing means for storing the host-decryptable secret data in the digital certificate, wherein the host identity and the host-decryptable secret data comprise the host identity mapping data in the digital certificate.
27. A computer program product on a computer readable medium for use in a distributed data processing system for authenticating a client, the computer program product comprising:
instructions for receiving a digital certificate from the client at a host within the distributed data processing system;
instructions for obtaining a host identity for the client from the digital certificate, wherein the host identity for the client identifies the client to the host, and wherein the host is not a certifying authority that issued the digital certificate;
instructions for retrieving host-decryptable secret data associated with the host identity from the digital certificate;
instructions for decrypting the host-decryptable secret data with a host private key to generate secret data; and
instructions for authenticating the client at the host using the host identity and the data.
28. The computer program product of claim 27, wherein the host acts as a proxy for the client.
29. The computer program product of claim 27 further comprising:
instructions for verifying the received digital certificate.
30. The computer program product of claim 27 further comprising:
instructions for generating, at the client, a request for a digital certificate comprising host identity mapping data;
instructions for sending the request for the digital certificate to a certifying authority (CA); and
instructions for receiving a digital certificate comprising host identity mapping data from the certifying authority.
31. The computer program product of claim 30 further comprising:
instructions for storing the host identity in the request for the digital certificate;
instructions for encrypting secret data associated with the host identity using a public key of the certifying authority to generate CA-decryptable secret data; and
instructions for storing the CA-decryptable secret data in the request for the digital certificate, wherein the host identity and the CA-decryptable secret data comprise the host identity mapping data in the request for the digital certificate.
32. The computer program product of claim 30 further comprising:
instructions for receiving, at the certifying authority, the request for a digital certificate;
instructions for generating the digital certificate in response to the received request for the digital certificate; and
instructions for sending the generated digital certificate to the client.
33. The computer program product of claim 30 further comprising:
instructions for retrieving CA-decryptable secret data from the host identity mapping data in the request for the digital certificate;
instructions for decrypting the CA-decryptable secret data associated with the host identity using a private key of the certifying authority to generate secret data;
instructions for encrypting the secret data associated with the host identity using a public key of the host to generate the host-decryptable secret data; and
instructions for storing the host-decryptable secret data in the digital certificate, wherein the host identity and the host-decryptable secret data comprise the host identity mapping data in the digital certificate.
34. The computer program product of claim 27 wherein the digital certificate comprises multiple host identities for multiple hosts within the distributed data processing system.
35. The computer program product of claim 27 wherein the digital certificate is formatted according to the X.509 standard.
36. The computer program product of claim 35 wherein the host identity and the host-decryptable secret data associated with the host identity is stored within an X.509 extension within the digital certificate.
37. The computer program product of claim 27 further comprising:
instructions for performing multiple authentication processes within the distributed data processing system for the client through the host using information within the digital certificate.
38. A computer program product on a computer readable medium for use in a distributed data processing system for generating a digital certificate, the computer program product comprising:
instructions for receiving, at a certifying authority (CA), a request for a digital certificate from a client, wherein the request for a digital certificate comprises host identity mapping data, wherein a host identity for the client within the host identity mapping data identifies the client to a host, and wherein the host is not the certifying authority;
instructions for generating the digital certificate in response to the received request for a digital certificate; and
instructions for sending the generated digital certificate to the client, wherein the digital certificate comprises host identity mapping data.
39. The computer program product of claim 38 further comprising:
instructions for retrieving CA-decryptable secret data from the host identity mapping data in the request for a digital certificate;
instructions for decrypting the CA-decryptable secret data associated with a host identity using a private key of the certifying authority to generate secret data;
instructions for encrypting the secret data associated with the host identity using a public key of a host to generate host-decryptable secret data; and
instructions for storing the host-decryptable secret data in the digital certificate, wherein the host identity and the host-decryptable secret data comprise the host identity mapping data in the digital certificate.
40. A data structure representing a digital certificate for use in a data processing system, the data structure comprising:
an issuer name;
a signature;
a subject name; and
an extension, wherein the extension comprises a host identity and host-decryptable secret data associated with the host identity, wherein the host identity identifies a client to a host, wherein the host is not a certifying authority that issued the digital certificate, and wherein the host-decryptable secret data is used by the host to authenticate the client.
The claims below are in addition to those above.
All refrences to claim(s) which appear below refer to the numbering after this setence.
1. A method comprising:
detecting invoked states of one or more activities invoked in a web application;
wherein the web application is configured to display, in a foreground, a current activity on a client device;
causing display, on the client device, of a multitask preview interface comprising one or more live previews;
wherein each live preview of the one or more live previews corresponds to an invoked state of an activity of the one or more activities;
wherein the one or more live previews includes a particular live preview that corresponds to a particular invoked state of a particular activity of the one or more activities;
detecting selection of the particular live preview; and
in response to detecting selection of the particular live preview, switching the current activity displayed in the foreground of the web application to the particular state of the particular activity;
wherein the method is performed by one or more computing devices.
2. The method of claim 1, wherein the particular live preview is generated by applying at least one of JavaScript or CSS to an object in a HTML DOM tree corresponding to the particular state of the particular activity.
3. The method of claim 1, wherein the particular live preview is updated in real time while the multitask preview interface is currently displayed.
4. The method of claim 1, wherein the web application is a single-page application having no background display area for displaying any of the one or more activities.
5. The method of claim 4, wherein the one or more live previews includes a preview that corresponds to an activity, of the one or more activities, that is not currently displayed in the foreground of the web application.
6. The method of claim 1, further comprising:
detecting invocation of a given activity of the web application during a current session;
responsive to detecting invocation of the given activity, if the given activity is a specific type of activity, then automatically adding the invoked state of the given activity to the one or more activities for which live previews are generated in the multitask preview interface.
7. The method of claim 6, wherein the specific type of activity is one of: composing a first specific document, viewing a second specific document, or searching a specific term.
8. The method of claim 6, wherein the one or more live previews are displayed in one or more groups in the multitask preview interface based on activity type.
9. The method of claim 1, wherein the multitask preview interface comprises user interface controls for removing at least one unwanted live preview from the multitask preview interface.
10. The method of claim 1, further comprising:
obtaining at least one advertisement based on a current state of one of the one or more activities; and
displaying the at least one advertisement in the multitask preview interface with at least one corresponding live preview.
11. A non-transitory computer storage medium storing instructions which, when executed by one or more processors, cause performance of a method comprising the steps of:
detecting invoked states of one or more activities invoked in a web application;
wherein the web application is configured to display, in a foreground, a current activity on a client device;
causing display, on the client device, of a multitask preview interface comprising one or more live previews;
wherein each live preview of the one or more live previews corresponds to an invoked state of an activity of the one or more activities;
wherein the one or more live previews includes a particular live preview that corresponds to a particular invoked state of a particular activity of the one or more activities;
detecting selection of the particular live preview; and
in response to detecting selection of the particular live preview, switching the current activity displayed in the foreground of the web application to the particular state of the particular activity.
12. The non-transitory computer storage medium of claim 11, wherein the particular live preview is generated by applying at least one of JavaScript or CSS to an object in a HTML DOM tree corresponding to the particular state of the particular activity.
13. The non-transitory computer storage medium of claim 11, wherein the particular live preview is updated in real time while the multitask preview interface is currently displayed.
14. The non-transitory computer storage medium of claim 11, wherein the web application is a single-page application having no background display area for displaying any of the one or more activities.
15. The non-transitory computer storage medium of claim 11, wherein the one or more live previews includes a preview that corresponds to an activity, of the one or more activities, that is not currently displayed in the foreground of the web application.
16. The non-transitory computer storage medium of claim 11, the method further comprising:
detecting invocation of a given activity of the web application during a current session;
responsive to detecting invocation of the given activity, if the given activity is a specific type of activity, then automatically adding the invoked state of the given activity to the one or more activities for which live previews are generated in the multitask preview interface.
17. The non-transitory computer storage medium of claim 16, wherein the specific type of activity is one of: composing a first specific document, viewing a second specific document, or searching a specific term.
18. The non-transitory computer storage medium of claim 16, wherein the one or more live previews are displayed in one or more groups in the multitask preview interface based on activity type.
19. The non-transitory computer storage medium of claim 11, wherein the multitask preview interface comprises user interface controls for removing at least one unwanted live preview from the multitask preview interface.
20. The non-transitory computer storage medium of claim 11, the method further comprising:
obtaining at least one advertisement based on a current state of one of the one or more activities; and
displaying the at least one advertisement in the multitask preview interface with at least one corresponding live preview.
21. A system comprising a processor and one or more stored sequences of instructions which, when executed by the processor, cause the processor to perform:
detecting invoked states of one or more activities invoked in a web application;
wherein the web application is configured to display, in a foreground, a current activity on a client device;
causing display, on the client device, of a multitask preview interface comprising one or more live previews;
wherein each live preview of the one or more live previews corresponds to an invoked state of an activity of the one or more activities;
wherein the one or more live previews includes a particular live preview that corresponds to a particular invoked state of a particular activity of the one or more activities;
detecting selection of the particular live preview; and
in response to detecting selection of the particular live preview, switching the current activity displayed in the foreground of the web application to the particular state of the particular activity.