HTTP AUTHENTICATION AND AUTHORIZATION MANAGEMENT

• US 20100023762A1
• Filed: 07/24/2008
• Published: 01/28/2010
• Est. Priority Date: 07/24/2008
• Status: Active Grant

• Current Assignee: Zscaler Incorporated
• Original Assignee: SafeChannel, Inc.
• Inventors: Kailash, Kailash, Mullick, Amarnath, Raphel, Jose, Nanjundaswamy, Shashidhara Mysore
• Granted Patent: US 8,806,201 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 2463/121 Timestamp
• CPC Class Codes: H04L 61/4523 using lightweight directory access protocol [LDAP]
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps

Abstract

Systems, methods and apparatus for a distributed security that provides authentication and authorization management. The system can include an epoch processor that is used to validate authentication and authorization data that is valid only for an epoch. The epoch processor can maintain a public key that can be used to decrypt the authentication and authorization data during the epoch that the key is valid. The epoch processor can receive a new public key during each epoch. The epoch processor can also determine if the authentication or authorization data was fraudulently generated based on the contents of the data, and verifying whether the data is valid for the epoch in which it was decrypted.

Claims

1. A computer implemented method, comprising:

receiving at a processing node a current public epoch key of a current epoch key pair, wherein one attribute of the current public epoch key is a current key epoch ID that identifies the current epoch of the current public epoch key;

receiving at the processing node authorized user data associated with a request;

decrypting at the processing node the authorized user data using the public epoch key;

determining if the decryption of the authorized user data was successful;

if the decryption of the authorized user data was successful,

identifying at the processing node a user epoch ID from the decrypted authorized user data;

comparing at the processing node the user epoch ID to the current key epoch ID of the current public epoch key;

determining at the processing node whether the user epoch ID is a valid epoch id;

if the user epoch ID is a valid epoch ID, processing the decrypted user data and the request.

2. The method of claim 1, wherein the authorized user data is based on authentication data.

3. The method of claim 1, wherein an epoch is a period of time.

4. The method of claim 1, wherein an epoch ID is a timestamp.

5. The method of claim 1, wherein the epoch public key is used to decrypt data encrypted using the epoch private key.

6. The method of claim 1, wherein the request is an http request

7. The method of claim 1, wherein the authorized user data is in the form of an http cookie.

8. The method of claim 1, further comprising:

if the decryption of the authorized user data is not successful, requesting user authorization from the client browser.

9. The method of claim 1, further comprising:

if the user epoch ID is not a valid epoch ID, requesting user authorization from the client browser.

10. The method of claim 1, wherein processing the decrypted user data and the request comprises:

determining at the processing node if the request is authorized based on the user data;

if the request is authorized, allowing the request.

11. The method of claim 1, wherein determining at a processing node whether the user epoch ID is a valid epoch ID comprises determining at the processing node if the user epoch ID is the current epoch ID. ID.

12. The method of claim 1, wherein determining at a processing node whether the user epoch ID is a valid epoch ID comprises determining at the processing node if the user epoch ID is determined to be in a range of valid epoch ids.

13. The method of claim 11, wherein the range of valid epoch ids comprises the current epoch ID, and an epoch ID of an epoch prior to the current epoch.

14. The method of claim 1, wherein processing the decrypted user data and the request comprises:

determining whether user epoch ID is the current epoch id;

If the user epoch ID is not the current epoch ID, requesting current authorized user data associated with the current epoch id;

providing the current authorized user data to the client browser.

15. The method of claim 1, wherein identifying at the processing node a user epoch ID from the decrypted authorized user data comprises:

identifying from the decrypted authorized user data a predetermined allocation of the authorized user data to user credentials; and

identifying the user credentials from the decrypted authorized user data.

16. The method of claim 15, further comprising:

Identifying a user epoch ID from the portion of the decrypted authorized user data not allocated to the user credentials.

17. Software stored in a computer readable medium and comprising instructions executable by a data processing system and upon such execution cause the data processing system to perform operations comprising:

receiving a current public epoch key of a current epoch key pair, wherein one attribute of the current public epoch key is a current key epoch ID that identifies the current epoch of the current public epoch key;

receiving a request for content and authorized user data associated with the request;

decrypting the authorized user data using the public epoch key;

identifying a user epoch ID from the decrypted authorized user data;

determining if the user epoch ID is a valid epoch id; and

if the user epoch ID is a valid epoch ID, processing the decrypted user data and the request.

18. The software of claim 17, wherein a valid epoch ID is the current epoch ID.

19. The software of claim 17, wherein a valid epoch ID is an epoch ID that is within an acceptable range of the current epoch ID.

20. The software of claim 17, further comprising instructions executable by the data processing system and upon such execution cause the data processing system to perform operations comprising:

determining whether user epoch ID is the current epoch id;

If the user epoch ID is not the current epoch ID, and if the user epoch ID is a valid epoch ID, requesting current authorized user data associated with the current epoch id;

providing the current authorized user data to the client browser.