Apparatus, system, and method for faciliating authenticated communication between authentication realms

• US 20050108575A1
• Filed: 11/12/2004
• Published: 05/19/2005
• Est. Priority Date: 11/18/2003
• Status: Abandoned Application

• Current Assignee: Vintela, Inc. (Quest Software, Inc.), Wedgetail Communications
• Original Assignee: Vintela, Inc. (Quest Software, Inc.)
• Inventors: Yung, Chong Ming
• Application Number:
  US10/987,475
• Publication Number:
  US 20050108575A1
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213

Abstract

An apparatus, system, and method are disclosed for facilitating authenticated communication between authentication realms. The present invention includes an authentication gateway configured to authenticate a principal using a first authentication protocol. The first authentication protocol may be one of a variety of authentication protocols. A generator in communication with the authentication gateway generates a foreign realm authentication token that is compatible with a second authentication protocol and configured for inter-realm communication. A foreign realm authentication module then authenticates the principal to access services of a foreign realm using the foreign realm authentication token. The authentication is performed by the foreign realm authentication module in accordance with the second authentication protocol. The first authentication protocol may be a non-Kerberos protocol and the second authentication protocol may be a Kerberos protocol.

Claims

1. An apparatus for facilitating authenticated communication between authentication realms, the apparatus comprising:

an authentication gateway configured to authenticate a principal using a first authentication protocol;

a generator configured to generate a foreign realm authentication token compatible with a second authentication protocol and configured for inter-realm communication; and

a foreign realm authentication module configured to authenticate the principal to access services of a foreign realm using the foreign realm authentication token in accordance with the second authentication protocol.

2. The apparatus of claim 1, wherein the foreign realm authentication token is compatible with a token definition in the second authentication protocol for foreign realm authentication tokens.

3. The apparatus of claim 1, wherein the first authentication protocol is different from the second authentication protocol that includes a token definition for foreign realm authentication tokens.

4. The apparatus of claim 1, further comprising a registration module configured to register the authentication gateway with the foreign realm authentication module such that the authentication gateway has authority to issue foreign realm authentication tokens to principals satisfying authentication requirements of the authentication gateway.

5. The apparatus of claim 1, further comprises a gateway communication module configured to receive an authentication token from the principal, the authentication token incompatible with the second authentication protocol, and a validation module configured to validate the authentication token according to the first authentication protocol.

6. The apparatus of claim 5, wherein the authentication token identifies a requested service within the foreign realm and includes credentials for the principal, the credentials comprising a user name and password.

7. The apparatus of claim 5, wherein the authentication token comprises a Security Assertions Markup Language (SAML) token generated by an authentication authority.

8. The apparatus of claim 1, wherein the authentication gateway shares a secret key with the foreign realm authentication module, the authentication gateway using the secret key to encrypt a message within the foreign realm authentication token, the foreign realm authentication module issuing an inter-realm token in response to successful decryption of the message using the secret key, the inter-realm token permitting authenticated access by the principal to a service of the foreign realm.

9. The apparatus of claim 1, further comprising a packager configured to embed an authentication token from the principal in the foreign realm authentication token, the authentication token identifying the principal, and a logger configured to log access to the foreign realm by the principal by way of the foreign realm authentication module.

10. The apparatus of claim 1, further comprising a principal communication module configured to,

send the foreign realm authentication token to the foreign realm authentication module;

receive a session token valid for services of service providers in the foreign realm according to the second authentication protocol;

send the session token to a service provider; and

establish service related communications with the service provider in response to the service provider validating the session token.

11. An apparatus for facilitating authenticated communication between authentication realms, the apparatus comprising:

a generator configured to generate a cross-realm authentication token compatible with a Kerberos authentication protocol;

a proxy configured to send a non-Kerberos authentication token from a user application, receive the cross-realm authentication token, and exchange communications between the user application and a service in a Kerberos realm in response to successful inter-realm authentication;

a Kerberos gateway configured to receive the non-Kerberos authentication token from the proxy and authenticate the user application using a non-Kerberos authentication protocol; and

a Kerberos authentication server configured to authenticate the proxy to access services of the Kerberos realm using the cross-realm authentication token and in accordance with the Kerberos authentication protocol.

12. The apparatus of claim 11, wherein the cross-realm authentication token comprises a valid Ticket-Granting-Ticket (TGT) for the Kerberos realm.

13. The apparatus of claim 11, further comprising a gateway communication module configured to receive the non-Kerberos authentication token from the proxy, the non-Kerberos authentication token incompatible with the Kerberos authentication protocol, and a validation module configured to validate the non-Kerberos authentication token according to the non-Kerberos authentication protocol.

14. The apparatus of claim 11, further comprising a packager configured to embed the non-Kerberos authentication token from the user application in the cross-realm authentication token, the non-Kerberos authentication token identifying the user application, and a logger configured to log access to the Kerberos realm by the user application by way of the Kerberos authentication server.

15. A system for facilitating authenticated communication between authentication realms, the system comprising:

a client computer within an authentication realm, the client computer configured to solicit credentials from a user of an application and generate a non-Kerberos authentication token;

a Kerberos gateway server registered as a gateway between the authentication realm and a foreign authentication realm, the Kerberos gateway server configured to receive and authenticate the non-Kerberos authentication token and to issue a Ticket-Granting-N Ticket (TGT) to the client computer in response to authentication of the user using a non-Kerberos authentication protocol;

a Kerberos authentication server configured to issue a cross-realm ticket and to send the cross-realm ticket to the client computer in response to the TGT from the client computer;

a Kerberos service provider configured to establish a cross-realm communication session with the user application on the client computer in response to the cross-realm ticket from the client computer; and

a network configured to operatively couple the client computer, Kerberos gateway server, Kerberos authentication server, and Kerberos service provider for networked communications.

16. The system of claim 15, further comprising a packager configured to embed the non-Kerberos authentication token from the user application in the TGT, the non-Kerberos authentication token identifying the user application, and a logger configured to log access to the Kerberos realm by the user application by way of the Kerberos authentication server.

17. The system of claim 15, further comprising a registration module configured to share a secret key between the Kerberos gateway and the Kerberos authentication server such that the Kerberos gateway uses the secret key to issue TGTs to the user application in response to the user application satisfying non-Kerberos authentication requirements of the Kerberos gateway.

18. A signal bearing medium tangibly embodying a program of machine-readable instructions executable by a digital processing apparatus to perform operations to facilitate authenticated communication between authentication realms, the operations comprising:

an operation to authenticate a principal using a first authentication protocol;

an operation to generate a foreign realm authentication token compatible with a second authentication protocol, the foreign realm authentication token configured for inter-realm communication; and

an operation to authenticate the principal to access services of a foreign realm using the foreign realm authentication token and in accordance with the second authentication protocol.

19. The signal bearing medium of claim 18, wherein the foreign realm authentication token is compatible with a token definition in the second authentication protocol for foreign realm authentication tokens.

20. The signal bearing medium of claim 18, wherein the first authentication protocol is different from the second authentication protocol that includes a token definition for foreign realm authentication tokens.

21. The signal bearing medium of claim 18, further comprising an operation to register an authentication gateway with a foreign realm authentication server such that the authentication gateway has authority to issue foreign realm authentication tokens to principals satisfying authentication requirements of the authentication gateway.

22. The signal bearing medium of claim 18, wherein the operation to authenticate a principal using a first authentication protocol further comprises an operation to receive an authentication token from the principal, the authentication token incompatible with the second authentication protocol, and an operation to validate the authentication token according to the first authentication protocol at an authentication authority.

23. The signal bearing medium of claim 22, wherein the authentication token identifies a requested service within the foreign realm and includes credentials for the principal, the credentials comprising security role information.

24. The signal bearing medium of claim 18, wherein the operation to generate a foreign realm authentication token further comprises an operation to encrypt a message within the foreign realm authentication token using a secret key shared with a foreign realm authentication server, the foreign realm authentication server configured to issue an inter-realm token that permits the principal authenticated access to a service of the foreign realm.

25. The signal bearing medium of claim 18, wherein the operation to generate a foreign realm authentication token further comprises an operation to embed an authentication token from the principal in the foreign realm authentication token, the authentication token identifying the principal, the operations further comprising an operation to log access to the foreign realm by the principal at a foreign realm authentication server.

26. The signal bearing medium of claim 18, wherein the operation to authenticate the principal to access services of a foreign realm further comprises, an operation to send the foreign realm authentication token to an authentication server configured to authenticate within the foreign realm;

an operation to receive a session token valid for services of service providers in the foreign realm according to the second authentication protocol;

an operation to send the session token to a service provider; and

an operation to establish service related communications with the service provider in response to the service provider validating the session token.

27. A method for facilitating authenticated communication between authentication realms, the method comprising:

authenticating a principal using a first authentication protocol;

generating a foreign realm authentication token compatible with a second authentication protocol, the foreign realm authentication token configured for inter-realm communication; and

authenticating the principal to access services of a foreign realm using the foreign realm authentication token and in accordance with the second authentication protocol.

28. The method of claim 27, further comprising registering an authentication gateway with a foreign realm authentication server such that the authentication gateway has authority to issue foreign realm authentication tokens to principals satisfying authentication requirements of the authentication gateway.

29. The method of claim 27, wherein generating a foreign realm authentication token further comprises embedding an authentication token from the principal in the foreign realm authentication token, the authentication token identifying the principal, the method further comprising logging access to the foreign realm by the principal at a foreign realm authentication server.

30. An apparatus for facilitating authenticated communication between authentication realms, the apparatus comprising:

means for authenticating a principal using a first authentication protocol;

means for generating a foreign realm authentication token compatible with a second authentication protocol, the foreign realm authentication token configured for inter-realm communication; and

means for authenticating the principal to access services of a foreign realm using the foreign realm authentication token and in accordance with the second authentication protocol.