Authentication routing system and method for cloud computing service and authentication router

• US 20130219476A1
• Filed: 10/21/2011
• Published: 08/22/2013
• Est. Priority Date: 10/26/2010
• Status: Active Grant

• Current Assignee: ZTE Corporation
• Original Assignee: ZTE Corporation
• Inventors: Lin, Zhaoji, Chen, Xiaohua
• Granted Patent: US 8,898,747 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority

Abstract

The disclosure discloses an authentication routing system and method for a cloud computing service and an authentication router. The method comprises the following steps: an authentication router registers a cloud computing service and saves the registration information of a cloud computing service registered successfully (401), wherein the registration information includes but is not limited to: an index number of a cloud computing service, an authentication mechanism chosen by the cloud computing service, an address of an authentication server address providing the authentication mechanism and a routing strategy of the authentication server; when a user terminal requests a cloud computing service, the authentication router receives an authentication request for the user terminal from the requested cloud computing service (402); and the authentication router routes the authentication request for the user terminal to a corresponding authentication server for authentication according to the saved registration information corresponding to the cloud computing service (403). Through the disclosure, a cloud computing service can provide a consistent user authentication experience and a relatively high authentication security level and effectively ensures the privacy security of the user when being used by the user.

Claims

1. An authentication routing system for a cloud computing service, comprising:

a user terminal, an authentication router and an authentication server, wherein

the authentication router is configured to register a cloud computing service and save registration information of a cloud computing service registered successfully, and further configured to receive an authentication request for the user terminal from the cloud computing service, and route the authentication request for the user terminal to a corresponding authentication server according to the saved registration information corresponding to the cloud computing service;

the user terminal is configured to request and use a cloud computing service; and

the authentication server is configured to authenticate the user terminal according to its own authentication mechanism.

2. The authentication routing system for a cloud computing service according to claim 1, wherein the registration information comprises:

an index number of a cloud computing service, an authentication mechanism chosen by the cloud computing service, an address of an authentication server address providing the authentication mechanism and a routing strategy of the authentication server.

3. The authentication routing system for a cloud computing service according to claim 1, wherein the authentication router further comprises a registration module which is configured to receive a registration request from the cloud computing service, provide an optional authentication mechanism list to the cloud computing service which is requested to be registered, and receive an authentication mechanism chosen by the cloud computing service from the list, and save the registration information of the cloud computing service according to the authentication mechanism chosen by the cloud computing service.

4. The authentication routing system for a cloud computing service according to claim 2, wherein the authentication request for the user terminal from the cloud computing service at least carries the index number of the cloud computing service;

and

correspondingly, the authentication router further comprises an authentication routing module which is configured to choose an authentication mechanism for the cloud computing service according to a predetermined strategy and the index number of the cloud computing service carried in the authentication request, and search for a corresponding authentication server address in the registration information according to the chosen authentication mechanism to route the authentication request to the corresponding authentication server.

5. The authentication routing system for a cloud computing service according to claim 4, wherein the authentication server is further configured to, if the user terminal does not support the authentication mechanism of the authentication server when being authenticated by the authentication server, notify the authentication router of this situation;

and

correspondingly, the authentication routing module of the authentication router is further configured to choose another authentication mechanism for the cloud computing service according to the predetermined strategy when the authentication server notifies that the user terminal does not support the chosen authentication mechanism, and search for a corresponding authentication server address in the registration information according to the chosen authentication mechanism to route the authentication request to the corresponding authentication server for authentication.

6. The authentication routing system for a cloud computing service according to claim 1, wherein the authentication server is further configured to return an authentication result to the authentication router after completing the authentication for the user terminal;

and

the authentication router returns an authentication result to the cloud computing service, and the cloud computing service determines whether to provide the user terminal with the cloud computing service according to the authentication result received.

19. The authentication routing system for a cloud computing service according to claim 2, wherein the authentication router further comprises a registration module which is configured to receive a registration request from the cloud computing service, provide an optional authentication mechanism list to the cloud computing service which is requested to be registered, and receive an authentication mechanism chosen by the cloud computing service from the list, and save the registration information of the cloud computing service according to the authentication mechanism chosen by the cloud computing service.

20. The authentication routing system for a cloud computing service according to claim 2, wherein the authentication server is further configured to return an authentication result to the authentication router after completing the authentication for the user terminal;

and

the authentication router returns an authentication result to the cloud computing service, and the cloud computing service determines whether to provide the user terminal with the cloud computing service according to the authentication result received.

7. An authentication routing method for a cloud computing service, comprising:

registering, by an authentication router, a cloud computing service and saving registration information of a cloud computing service registered successfully;

when a user terminal requests a cloud computing service, receiving, by the authentication router, an authentication request for the user terminal from the requested cloud computing service; and

routing, by the authentication router, the authentication request for the user terminal to a corresponding authentication server for authentication according to the saved registration information corresponding to the cloud computing service.

8. The authentication routing method for a cloud computing service according to claim 7, wherein the registration information comprises:

an index number of a cloud computing service, an authentication mechanism chosen by the cloud computing service, an address of an authentication server address providing the authentication mechanism and a routing strategy of the authentication server.

9. The authentication routing method for a cloud computing service according to claim 7, wherein the registering, by an authentication router, a cloud computing service and saving registration information comprises:

receiving, by the authentication router, a registration request from the cloud computing service;

providing, by the authentication router, an optional authentication mechanism list to the cloud computing service which is requested to be registered;

choosing, by the cloud computing service, a proper authentication mechanism from the optional authentication mechanism list according to a security requirement and strategy and returning the proper authentication mechanism to the authentication router; and

saving, by the authentication router, the registration information of the cloud computing service according to the authentication mechanism chosen by the cloud computing service.

10. The authentication routing method for a cloud computing service according to claim 8, wherein the authentication request for the user terminal from the cloud computing service at least carries the index number of the cloud computing service;

and

the authentication router chooses an authentication mechanism for the cloud computing service according to a predetermined strategy and the index number of the cloud computing service carried in the authentication request, and searches for a corresponding authentication server address in the registration information according to the chosen authentication mechanism to route the authentication request to the corresponding authentication server.

11. The authentication routing method for a cloud computing service according to claim 10, further comprising:

if the user terminal does not support the authentication mechanism of the authentication server when being authenticated by the authentication server, notifying, by the authentication server, the authentication router of this situation; and

choosing, by the authentication router, another authentication mechanism for the cloud computing service according to the predetermined strategy, and searching for a corresponding authentication server address in the registration information according to the chosen authentication mechanism to route the authentication request to the corresponding authentication server for authentication.

12. The authentication routing method for a cloud computing service according to claim 7, further comprising:

returning, by the authentication server, an authentication result to the authentication router after the authentication server completes the authentication for the user terminal;

returning, by the authentication router, an authentication result to the cloud computing service; and

determining, by the cloud computing service, whether to provide the user terminal with the cloud computing service according to the authentication result received.

21. The authentication routing method for a cloud computing service according to claim 8, wherein the registering, by an authentication router, a cloud computing service and saving registration information comprises:

receiving, by the authentication router, a registration request from the cloud computing service;

providing, by the authentication router, an optional authentication mechanism list to the cloud computing service which is requested to be registered;

choosing, by the cloud computing service, a proper authentication mechanism from the optional authentication mechanism list according to a security requirement and strategy and returning the proper authentication mechanism to the authentication router; and

saving, by the authentication router, the registration information of the cloud computing service according to the authentication mechanism chosen by the cloud computing service.

22. The authentication routing method for a cloud computing service according to claim 8, further comprising:

returning, by the authentication server, an authentication result to the authentication router after the authentication server completes the authentication for the user terminal;

returning, by the authentication router, an authentication result to the cloud computing service; and

determining, by the cloud computing service, whether to provide the user terminal with the cloud computing service according to the authentication result received.

13. An authentication router, comprising:

a registration module, which is configured to register a cloud computing service and save registration information of a cloud computing service registered successfully; and

an authentication routing module, which is configured to receive an authentication request for a user terminal from the cloud computing service, and route the authentication request for the user terminal to a corresponding authentication server for authentication according to the saved registration information corresponding to the cloud computing service.

14. The authentication router according to claim 13, wherein the registration information comprises:

an index number of a cloud computing service, an authentication mechanism chosen by the cloud computing service, an address of an authentication server address providing the authentication mechanism and a routing strategy of the authentication server.

15. The authentication router according to claim 13, wherein the registration module is further configured to receive a registration request from the cloud computing service, provide an optional authentication mechanism list to the cloud computing service which is requested to be registered, and receive an authentication mechanism chosen by the cloud computing service from the list, and save the registration information of the cloud computing service according to the authentication mechanism chosen by the cloud computing service.

16. The authentication router according to claim 14, wherein the authentication request for the user terminal from the cloud computing service at least carries the index number of the cloud computing service;

and

correspondingly, the authentication routing module is further configured to choose an authentication mechanism for the cloud computing service according to a predetermined strategy and the index number of the cloud computing service carried in the authentication request, and search for a corresponding authentication server address in the registration information according to the chosen authentication mechanism to route the authentication request to the corresponding authentication server.

17. The authentication router according to claim 16, wherein the authentication routing module is further configured to choose another authentication mechanism for the cloud computing service according to the predetermined strategy when the authentication server notifies that the user terminal does not support the chosen authentication mechanism, and search for a corresponding authentication server address in the registration information according to the chosen authentication mechanism to route the authentication request to the corresponding authentication server for authentication.

18. The authentication router according to claim 13, wherein the authentication routing module is further configured to forward an authentication result returned by the authentication server to the cloud computing service after the authentication server completes the authentication for the user terminal.

23. The authentication router according to claim 14, wherein the registration module is further configured to receive a registration request from the cloud computing service, provide an optional authentication mechanism list to the cloud computing service which is requested to be registered, and receive an authentication mechanism chosen by the cloud computing service from the list, and save the registration information of the cloud computing service according to the authentication mechanism chosen by the cloud computing service.

24. The authentication router according to claim 14, wherein the authentication routing module is further configured to forward an authentication result returned by the authentication server to the cloud computing service after the authentication server completes the authentication for the user terminal.