Method and System for the Storage of Authentication Credentials

• US 20070289001A1
• Filed: 04/30/2007
• Published: 12/13/2007
• Est. Priority Date: 05/20/2006
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Havercan, Peter Edward
• Granted Patent: US 8,719,948 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G11B 20/00086 Circuits for prevention of unauthorised reproduction or copying, e.g. piracy indicating unauthorised use of record carriers in general G11B23/28; scrambling for television signal recording H04N5/913; network architectures or network protocols for network security H04L63/00; cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

A method, apparatus and computer program product for controlling access to host access credentials required to access a host computer system by a client application is provided. The host access credentials are stored in a restricted access directory. The method comprises authenticating directory access credentials received from a client application. The authenticated client application then requests the host access credentials and a determination as to whether the authenticated client process is authorized to access the requested host access credentials, and, if authorized, these are provided to the client application.

Claims

1. A method of controlling access to host access credentials required to access a resource on a host computer system by a process running on a client computer system, the method comprising the steps of:

storing the host access credentials in a restricted access directory;

receiving directory access credentials from the client process;

authenticating the received directory access credentials;

receiving a request for the host access credentials from the authenticated client process, the request identifying a user of the client computer system;

determining whether the user of the client computer system is authorised to access the host access credentials stored in the directory; and

in response to determining that the user of the client computer system is authorised to access the host access credentials, providing the requested host access credentials to the authenticated client process.

2. The method of claim 1, wherein the step of storing the host access credentials in a restricted access directory comprises:

receiving directory access credentials from a directory administrator;

authenticating the received directory administrator credentials;

receiving the host access credentials and an associated access control list from the authenticated directory administrator;

storing the host access credentials in the directory and the associated access control list.

3. The method of claim 1, wherein the step of determining whether the user of the client computer system is authorised to access the host access credentials comprises comparing the identity of the user to an access control list.

4. The method of claim 2, wherein the access control list defines a list of users authorised to access the host access credentials.

5. The method of claim 2, comprising requesting the host access credentials from the directory in response to a challenge for said host access credentials from the host computer system.

6. The method of claim 2, further comprising sending the host access credentials to the host computer system.

7. The method of claim 2, wherein the user of the client computer system is the authenticated client process.

8. The method of claim 2, further comprising sending a request to authenticate the client process, the request identifying an entry in the repository and a password.

9. The method of claim 8, wherein the step of authenticating the client process comprises determining whether the received password matches a password stored as an attribute of the identified repository entry.

10. A data processing apparatus for controlling access to host access credentials required to access a resource on a host computer system by a process running on a client computer system the host access credentials being stored in a restricted access field of a directory, the data processing apparatus comprising:

a receiving component for receiving messages from the client process;

an authentication component for authenticating a client process using directory access credentials received from a client process; and

a query component for querying the directory for the requested host access credentials in response to a request for the host access credentials from an authenticated client process, the request identifying a user of the client computer system, for determining whether the user of the authenticated client process is authorised to access the host access credentials stored in the directory, and for providing the host access credentials if the user of the client computer system is determined to be authorised to access the host access credentials.

11. A data processing apparatus according to claim 10, configured to:

receive directory access credentials from a directory administrator;

authenticate the received directory administrator credentials;

receive host access credentials and an associated access control list from the authenticated directory administrator; and

store the host access credentials in the directory, along with the associated access control list.

12. A computer program product having a set of instructions to cause a computer to perform a method of controlling access to host access credentials required to access a resource on a host computer system by a process running on a client computer system, the method comprising:

storing the host access credentials in a restricted access directory;

receiving directory access credentials from the client process;

authenticating the received directory access credentials;

receiving a request for the host access credentials from the authenticated client process, the request identifying a user of the client computer system;

determining whether the user of the client computer system is authorised to access the host access credentials stored in the directory; and

in response to determining that the user of the client computer system is authorised to access the host access credentials, providing the requested host access credentials to the authenticated client process.