METHOD AND SYSTEM FOR MULTI-TIERED DISTRIBUTED SECURITY AUTHENTICATION AND FILTERING

• US 20130239176A1
• Filed: 03/06/2012
• Published: 09/12/2013
• Est. Priority Date: 03/06/2012
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Terris, Benjamin S., Welp, Richard A.
• Granted Patent: US 9,043,878 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

Multi-tiered distributed security authentication and filtering. One embodiment comprises managing user access to one or more computing resources, by centrally maintaining user subscription information comprising user authentication information and system authorization information, and providing relevant subscription information from the user subscription information to one or more remote computing systems. Managing user access further includes, in a remote computing system, authenticating a user login to the remote computing system based on user authentication information from said relevant subscription information, and upon user authentication, selectively authorizing user access to computing resources of the remote computing system based on system authorization information from said relevant subscription information.

Claims

1. A method of managing user access to one or more computing resources, comprising:

centrally maintaining user subscription information comprising user authentication information and system authorization information;

providing relevant subscription information from the user subscription information to one or more remote computing systems;

in a remote computing system;

authenticating a user login to the remote computing system based on user authentication information from said relevant subscription information; and

upon user authentication, selectively authorizing user access to computing resources of the remote computing system based on system authorization information from said relevant subscription information.

2. The method of claim 1, wherein:

said system authorization information comprises filtering information for limiting access to certain computing resources for each user.

3. The method of claim 1, wherein:

said relevant subscription information for a remote computing system comprises subscription information for users that are associated with the computing resources of that remote computing system.

4. The method of claim 3, wherein:

selectively authorizing user access to computing resources of the remote computing system comprises, upon user authentication, limiting access to certain computing resources for the user based on the system authorization information for that user.

5. The method of claim 1, wherein:

said user authentication information comprises multilevel authentication and password information for filtering access to a remote computing system by one or more users.

6. The method of claim 5, wherein:

authenticating a user login to the remote computing system comprises checking user provided credentials against the multilevel authentication and password information, for authenticating access to the remote computing system.

7. The method of claim 1, wherein:

a subscription determines which computing resources a user is allowed to access remotely; and

centrally maintaining user subscription information comprises maintaining the user subscription information in a central computing system in relation to the remote computing systems within a distributed computing system.

8. A system for managing user access to one or more computing resources, comprising:

a subscription subsystem that centrally maintains user subscription information comprising user authentication information and system authorization information, wherein the subscription subsystem provides relevant subscription information from the user subscription information to one or more remote computing systems; and

an authentication subsystem that authenticates a user login to a remote computing system based on user authentication information from said relevant subscription information, and upon user authentication, selectively authorizes user access to computing resources of the remote computing system based on system authorization information from said relevant subscription information.

9. The system of claim 8, wherein said relevant subscription information for a remote computing system comprises subscription information for users that are associated with the computing resources of that remote computing system.

10. The system of claim 9, wherein:

said user authentication information comprises multilevel authentication and password information for filtering access to a remote computing system by one or more users.

11. The system of claim 10, wherein:

said system authorization information comprises filtering information for limiting access to certain computing resources for each user.

12. The system of claim 11, wherein:

the authentication subsystem authenticates a user login to the remote computing system by checking user provided credentials against the multilevel authentication and password information, for authenticating access to the remote computing system.

13. The system of claim 12, wherein:

the authentication subsystem selectively authorizes user access to computing resources of the remote computing system upon user authentication, by limiting access to certain computing resources for the user based on the system authorization information for that user.

14. The system of claim 13, wherein:

a subscription determines which computing resources a user is allowed to access remotely; and

the subscription system centrally maintains user subscription information by maintaining the user subscription information in a central computing system in relation to the remote computing systems within a distributed computing system.

15. A computer program product for managing user access to one or more computing resources, the computer program product comprising:

a computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising;

computer readable program code configured to centrally maintain user subscription information comprising user authentication information and system authorization information;

computer readable program code configured to provide relevant subscription information from the user subscription information to one or more remote computing systems;

computer readable program code configured to, in a remote computing system;

authenticate a user login to the remote computing system based on user authentication information from said relevant subscription information; and

upon user authentication, selectively authorize user access to computing resources of the remote computing system based on system authorization information from said relevant subscription information.

16. The computer program product of claim 15, wherein said relevant subscription information for a remote computing system comprises subscription information for users that are associated with the computing resources of that remote computing system.

17. The computer program product of claim 16, wherein:

said user authentication information comprises multilevel authentication and password information for filtering access to a remote computing system by one or more users;

said system authorization information comprises filtering information for limiting access to certain computing resources for each user.

18. The computer program product of claim 17, further comprising:

computer readable program code configured to authenticate a user login to the remote computing system by checking user provided credentials against the multilevel authentication and password information, for authenticating access to the remote computing system.

19. The computer program product of claim 18, further comprising:

computer readable program code configured to selectively authorize user access to computing resources of the remote computing system by, upon user authentication, limiting access to certain computing resources for the user based on the system authorization information for that user.

20. The computer program product of claim 19, wherein a subscription determines which computing resources a user is allowed to access remotely, and the computer program product further comprises computer readable program code configured to centrally maintain user subscription information by maintaining the user subscription information in a central computing system in relation to the remote computing systems within a distributed computing system.

21. A method of managing user access to one or more computing resources, comprising:

centrally maintaining user subscription information comprising user authentication information and system authorization information; and

providing relevant subscription information from the user subscription information to one or more remote computing systems, allowing at least one of said one or more remote computing systems to authenticate a user login to that remote computing system based on user authentication information from said relevant subscription information, and upon user authentication, selectively authorize user access to computing resources of the remote computing system based on system authorization information from said relevant subscription information.