Systems and methods for state-less authentication

• US 20060117015A1
• Filed: 01/05/2006
• Published: 06/01/2006
• Est. Priority Date: 04/19/2001
• Status: Active Grant

• Current Assignee: Alto Dynamics, LLC (IP Investments Group LLC)
• Original Assignee: eOriginal, Inc.
• Inventors: Bisbee, Stephen F., Twaddell, Gordon W., Peterson, Ellis K., Becker, Keith F., Moskowitz, Jack J.
• Granted Patent: US 7,657,531 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: F23H 17/12 Fire-bars
• CPC Class Codes: G06F 16/00 Information retrieval; Database structures therefor; File system structures therefor
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: Y10S 707/99931 Database or file accessing
• CPC Class Codes: Y10S 707/99936 Pattern matching access

Abstract

Systems and methods for providing user logon and state-less authentication are described in a distributed processing environment. Upon an attempted access by a user to an online resource, transaction, or record, a logon component asks the user to supply a logon ID and a password. The logon component verifies the provided information, and upon successful identification, a security context is constructed from information relevant to the user. The security context is sent to the user and is presented to the system each time the user attempts to invoke a new resource, such as a program object, transaction, record, or certified printer avoiding the need for repeated logon processing.

Claims

1. A method of enabling access to a resource of a processing system in a security context upon log in, comprising the steps of:

verifying a user'"'"'s identity information, provided by a user to an access authorization component of the processing system during a secure communication session, based on a comparison with stored authorization information comprising at least one of a user identifier, an organization identifier, a sub-organization identifier, a key, an authentication certificate, a user location, a user role, and a user position identifying the user to the processing system;

generating a security context based on the verifying of the user'"'"'s identity information for access to the resource;

providing the security context to the user; and

sending, by the user to the processing system, the security context and a request for access to the resource.

2. The method of claim 1, wherein the resource is at least one of a processor, a program object, and a record of the processing system.

3. The method of claim 1, wherein the access authorization component provides a symmetric encryption key to the user in establishing the secure communication session.

4. The method of claim 1, comprising establishing a secure communication session between a user desiring access and the access authorization component of the processing system.

5. The method of claim 4, wherein the user'"'"'s identity information is verified by checking for agreement with the stored authorization information.

10. The method of claim 1, further comprising the step of determining, by a stateless component of the processing system, based on the security context sent with the request for access by the user, whether access to the requested resource should be granted to the user.

11. The method of claim 10, wherein the request for access is at least partially encrypted with a symmetric encryption key extracted from the security context.

12. The method of claim 11, wherein a hash value is computed over the request for access, the hash value is included with the security context and the request for access sent by the user to the processing system, the integrity of the request for access is checked based on the hash value, and access is granted only if the integrity of the hash value is verified.

13. The method of claim 10, wherein the user digitally signs the request for access, the user'"'"'s digital signature is included with the security context and the request for access sent by the user to the processing system, the user'"'"'s digital signature is checked by the processing system, and access to the resource is granted only if the user'"'"'s digital signature is authenticated.

14. The method of claim 13, wherein the request for access comprises a wrapper.

15. The method of claim 10, further comprising the step, after access to the requested resource is granted, of sending a response to the user that includes a request counter that enables the user to match the response to the request for access.

16. The method of claim 1, wherein at least one of a client time and a request counter is sent by the user to the processing system with the security context and the request for access to the resource.

17. The method of claim 16, wherein the request counter is sent by the user and access to the resource is denied if the request counter differs from a predetermined value.

6-9. -9. (canceled)

18-41. -41. (canceled)