Server pool Kerberos authentication scheme

• US 20070127723A1
• Filed: 01/05/2007
• Published: 06/07/2007
• Est. Priority Date: 10/28/2003
• Status: Active Grant

• Current Assignee: Steven Grobman
• Original Assignee: Steven Grobman
• Inventors: Grobman, Steven
• Granted Patent: US 8,984,613 B2
• Time in Patent Office: Days
• US Class Current: 380/278
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807

Abstract

The present disclosure relates to the authenticating a client against a pool of servers utilizing a secure authentication protocol, and, more specifically, to the authenticating a client against a pool of servers providing a common service, utilizing the Kerberos secure authentication protocol.

Claims

1. A Key Distribution Center comprising:

an Authentication Service that is capable of

authenticating that a client may legitimately access the Key Distribution Center, and

issuing a Ticket-Granting-Ticket to the client; and

a Ticket Granting Service that is capable of

accepting the Ticket-Granting-Ticket from the client, and

issuing a Multi-Server Service Ticket to the client; and

wherein the Multi-Server Service Ticket allows the client access a network service that is provided by a plurality of servers.

2. The Center of claim 1, wherein the Multi-Server Service Ticket includes:

encrypted session keys for each of the respective plurality of servers, and an encrypted cipher text;

wherein, there is only one plaintext session key, each encrypted session key is formed by encrypting the plaintext session key with a secret key associated with a respective server of the plurality of servers, and the encrypted cipher text is encrypted with the plaintext session key.

3. The Center of claim 1, wherein Authentication Server is capable of authenticating that a client may legitimately access the Key Distribution Center, and issuing a Ticket-Granting-Ticket to the client,

utilizing a protocol substantially in compliance with the Kerberos protocol.

4. The Center of claim 2, wherein the Ticket Granting Service is capable of issuing a Multi-Server Service Ticket to the client and further includes the capability to:

generating a session key;

encrypting a cipher text with the session key

determining the number of servers designated to provide the requested service;

for each providing server, encrypting the session key with a secret key associated with each respective server;

creating a Multi-Server Service Ticket that includes an encrypted session key for each providing server, and the encrypted cipher text; and

transmitting the Multi-Server Service Ticket to the client.

5. The Center of claim 4, wherein the Ticket Granting Service capability to determine the number of servers designated to provide the requested service includes:

utilizing a database that maps a generic server name to a specific server name; and

setting the numbers of servers designated to provide the service equal to the number of specific server names mapped to the generic server name that provides the requested service.

6. The Center of claim 5, wherein Ticket Granting Service capability of utilizing a database that maps a generic server name to a specific server name includes selecting a database from a group consisting essentially of:

a domain name server database,

a database associated with a Key Distribution Center, and

a Kerberos database.

7. A system comprising:

a Key Distribution Center having;

an Authentication Service that is capable of

authenticating that a client may legitimately access the Key Distribution Center, and

issuing a Ticket-Granting-Ticket to the client; and

a Ticket Granting Service that is capable of

accepting the Ticket-Granting-Ticket from the client, and

issuing a Multi-Server Service Ticket to the client;

a plurality of servers that are each capable of providing the client with a network service; and

wherein the Multi-Server Service Ticket allows the client access the network service provided by the plurality of servers.

8. The system of claim 7, wherein the Multi-Server Service Ticket includes:

encrypted session keys for each of the respective plurality of servers, and an encrypted cipher text;

wherein, there is only one plaintext session key, each encrypted session key is formed by encrypting the plaintext session key with a secret key associated with a respective server of the plurality of servers, and the encrypted cipher text is encrypted with the plaintext session key.

9. The system of claim 7, wherein Authentication Server is capable of utilizing a protocol substantially in compliance with the Kerberos protocol.

10. The system of claim 9, wherein the Ticket Granting Service is capable of issuing a Multi-Server Service Ticket to the client and further includes the capability to:

generating a session key;

encrypting a cipher text with the session key

determining the number of servers designated to provide the requested service;

for each providing server, encrypting the session key with a secret key associated with each respective server;

creating a Multi-Server Service Ticket that includes an encrypted session key for each providing server, and the encrypted cipher text; and

transmitting the Multi-Server Service Ticket to the client.

11. The system of claim 10, wherein the Ticket Granting Service capability to determine the number of servers designated to provide the requested service includes:

utilizing a database that maps a generic server name to a specific server name; and

setting the numbers of servers designated to provide the service equal to the number of specific server names mapped to the generic server name that provides the requested service.

12. The system of claim 11, wherein Ticket Granting Service capability of utilizing a database that maps a generic server name to a specific server name includes selecting a database from a group consisting essentially of:

a domain name server database,

a database associated with a Key Distribution Center, and

a Kerberos database.

13. The system of claim 10, wherein the plurality of servers is capable of authenticating a client'"'"'s request for a service utilizing;

receiving a Multi-Server Service Ticket having at least one encrypted session key, and an encrypted cipher text;

assigning a receiving server from among the plurality of servers to service the Service request;

decrypting the encrypted session key associated with the receiving server utilizing a secret key associated with the receiving server;

decrypting the cipher text utilizing the decrypted session key; and

utilizing the receiving server to provide the service to the client.

14. The system of claim 13, wherein each server of the plurality of servers is capable of being the receiving server and the receiving server is capable of:

decrypting the encrypted session key associated with the receiving server utilizing a secret key associated with the receiving server;

decrypting the cipher text utilizing the decrypted session key; and

providing the service to the client.

15. The system of claim 14, wherein decrypting the encrypted session key includes:

determining the number of encrypted session keys included within the received Multi-Server Service Ticket;

for each encrypted session key, decrypting the encrypted session key utilizing a secret key associated with the receiving server; and

wherein decrypting the cipher text utilizing the decrypted session key includes

for each encrypted session key, attempting to decrypt the cipher text with the decrypted session key;

if the cipher text is successfully decrypted, providing the service to the client.

16. The system of claim 13, wherein plurality of servers are configured as a cluster and are capable of functioning as a group of independent computers that work together as a single system.