Distributed single sign-on

• US 10,171,451 B2
• Filed: 06/13/2018
• Issued: 01/01/2019
• Est. Priority Date: 09/25/2014
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Camenisch, Jan, Gilad, Yossi, Lehmann, Anja, Nagy, Zoltan A., Neven, Gregory
• Primary Examiner(s): Smithers, Matthew
• Application Number:
  US16/007,353
• Publication Number:
  US 20180295122A1
• Time in Patent Office: 202 Days
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Respective cryptographic shares of password data, dependent on a user password, are provided at n authentication servers. A number t₁≤n of the password data shares determine if the user password matches a password attempt. Respective cryptographic shares of secret data, enabling determination of a username for each verifier server, are provided at n authentication servers. A number t₂≤t₁ of the shares reconstruct the secret data. For a password attempt, the user computer communicates with at least t₁ authentication servers to determine if the user password matches the password attempt and, if so, the user computer receives at least t₂ secret data shares from respective authentication servers. The user computer uses the secret data to generate, with T≤t₁ of said t₁ servers, a cryptographic token for authenticating the user computer to a selected verifier server, secret from said at least T servers, under said username.

Claims

1. A method for use, at an authentication server being one of a plurality of n such authentication servers connectable to a user computer via a network, in generating a cryptographic token for authenticating the user computer to one of plurality of verifier servers under a username identifying the user computer to that verifier server, the method comprising:

storing one of n cryptographic shares of password data, which is dependent on a predetermined user password, such that a plurality t₁<

n of the n password data shares, each being stored by a respective one of the n authentication servers, is needed to determine if said user password matches a password attempt;

storing one of n cryptographic shares of secret data, which enables determination of said username for each verifier server, such that a plurality t₂=t₁ of the n secret data shares, each being stored by a respective one of the n authentication servers, is needed to reconstruct the secret data, wherein said username is different for every verifier server, and wherein said secret data comprises data indicative of said username for each verifier server;

on receipt from the user computer of an authentication request sent to each of at least t₁ authentication servers on input of a password attempt at the user computer, communicating via said network to implement an authentication procedure in which said password data shares of those authentication servers are used to determine if said user password matches the password attempt and, if so, the user computer receives at least t₂ secret data shares from respective authentication servers;

on receipt from the user computer of a token request sent to each of at least a plurality T=t₁ of said at least t₁ authentication servers on reconstruction of said secret data, communicating with the user computer to implement a token generation procedure in which, via communication with said at least T authentication servers, the user computer uses said secret data to generate a cryptographic token for authenticating the user computer to a selected verifier server, secret from said at least T servers, under said username for the selected verifier server.