SYSTEM FOR AND METHOD OF PROVIDING SINGLE SIGN-ON (SSO) CAPABILITY IN AN APPLICATION PUBLISHING ENVIRONMENT

• US 20140143847A1
• Filed: 01/08/2014
• Published: 05/22/2014
• Est. Priority Date: 05/25/2012
• Status: Abandoned Application

• Current Assignee: RPX Corporation
• Original Assignee: GraphOn Corporation
• Inventors: Tidd, William
• Application Number:
  US14/150,684
• Publication Number:
  US 20140143847A1
• Time in Patent Office: Days
• US Class Current: 726/8
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

A client-server computing system includes a computer cluster for hosting certain resources, applications, programs, processes, files, and/or data that are published to users who are accessing the computer cluster remotely. The computer cluster includes a network of one or more host computers, a gateway server, a gateway service database, and a user database. A single sign-on (SSO) method of the disclosure includes performing a computer cluster authentication process in which a user enters his/her credentials followed by a resource authentication process in which there is no need for the user to reenter his/her credentials, having entered them already in the computer cluster authentication process.

Claims

1. A method for providing single-sign-on capability, the method comprising:

receiving at a gateway service a connection request sent by a host computer, the connection request comprising identifying information associated with the host computer;

executing instructions stored in memory of the gateway service, wherein execution of the instructions by a processor of the gateway service;

queries a host table stored in memory regarding a host record that corresponds to the host computer, wherein the host computer is authenticated based on comparison of the identifying information against the corresponding host record,

grants the connection request from the host computer, wherein the host computer joins a cluster of host computers associated with the gateway service and is visible to a client device,

authenticates a user of the client device to the host computer based on credentials provided by the user, and

automatically erases user credentials from memory of the gateway service subsequent to successful authentication of the user credentials on the host computer;

receiving at the gateway service a subsequent access request regarding another host computer in the cluster; and

forwarding the subsequent access request from the gateway service to the selected initial host computer for authentication based on the credentials.

2. The method of claim 1, wherein the connection between the gateway service and the host computer is selected from the group consisting of SSL connections and TCP connections.

3. The method of claim 1, wherein the identifying information is selected from the group consisting of host name, host ID, host public key, network address, and MAC address.

4. The method of claim 1, wherein the host table is stored in the memory of a gateway service database.

5. The method of claim 1, further comprising receiving a subsequent request from another host computer, wherein the other host computer cannot be authenticated when identifying information of the other host computer fails to match information in a corresponding host record of the other host computer.

6. The method of claim 5, wherein the gateway service rejects the connection request, and wherein the other host computer does not join the cluster of host computers.

7. An apparatus for providing single-sign-on capability, the apparatus comprising:

a communication interface for receiving at a gateway service a connection request sent by a host computer, the connection request comprising identifying information associated with the host computer;

a processor for executing instructions stored in memory of the gateway service, wherein execution of the instructions by the processor of the gateway service;

queries a host table stored in memory regarding a host record that corresponds to the host computer, wherein the host computer is authenticated based on comparison of the identifying information against the corresponding host record,

grants the connection request from the host computer, wherein the host computer joins a cluster of host computers associated with the gateway service and is visible to a client device,

authenticates a user of the client device to the host computer based on credentials provided by the user, and

automatically erases user credentials from memory of the gateway service subsequent to successful authentication of the user credentials on the host computer;

wherein the communication interface at the gateway service;

receives a subsequent access request regarding another host computer in the cluster, and

forwards the subsequent access request from the gateway service to the selected initial host computer for authentication based on the credentials.

8. The apparatus of claim 7, wherein the connection between the gateway service and the host computer is selected from the group consisting of SSL connections and TCP connections.

9. The apparatus of claim 7, wherein the identifying information is selected from the group consisting of host name, host ID, host public key, network address, and MAC address.

10. The apparatus of claim 7, further comprising gateway service database memory for storing the host table.

11. The apparatus of claim 7, wherein the communication interface receives a subsequent request from another host computer, wherein the other host computer cannot be authenticated when identifying information of the other host computer fails to match information in a corresponding host record of the other host computer.

12. The apparatus of claim 11, wherein the gateway service rejects the connection request, and wherein the other host computer does not join the cluster of host computers.

13. A system for providing single-sign-on capability, the system comprising:

a cluster comprising a plurality of host computers; and

a gateway service comprising;

a communication interface for receiving at a gateway service a connection request sent by a host computer, the connection request comprising identifying information associated with the host computer; and

a processor for executing instructions stored in memory of the gateway service, wherein execution of the instructions by the processor of the gateway service;

queries a host table stored in memory regarding a host record that corresponds to the host computer, wherein the host computer is authenticated based on comparison of the identifying information against the corresponding host record,

grants the connection request from the host computer, wherein the host computer joins a cluster of host computers associated with the gateway service and is visible to a client device,

authenticates a user of the client device to the host computer based on credentials provided by the user, and

automatically erases user credentials from memory of the gateway service subsequent to successful authentication of the user credentials on the host computer;

wherein the communication interface at the gateway service;

receives a subsequent access request regarding another host computer in the cluster, and

forwards the subsequent access request from the gateway service to the selected initial host computer for authentication based on the credentials.

14. The system of claim 13, wherein the connection between the gateway service and the host computer is selected from the group consisting of SSL connections and TCP connections.

15. The system of claim 13, wherein the identifying information is selected from the group consisting of host name, host ID, host public key, network address, and MAC address.

16. The system of claim 13, further comprising gateway service database memory for storing the host table.

17. The system of claim 13, wherein the communication interface receives a subsequent request from another host computer, wherein the other host computer cannot be authenticated when identifying information of the other host computer fails to match information in a corresponding host record of the other host computer.

18. The system of claim 17, wherein the gateway service rejects the connection request, and wherein the other host computer does not join the cluster of host computers.

19. A non-transitory computer-readable storage medium, having embodied thereon a program executable by a processor to perform a method for providing single-sign-on capability, the method comprising:

receiving a connection request sent by a host computer, the connection request comprising identifying information associated with the host computer;

querying a host table regarding a host record that corresponds to the host computer, wherein the host computer is authenticated based on comparison of the identifying information against the corresponding host record;

granting the connection request from the host computer, wherein the host computer joins a cluster of host computers associated with the gateway service and is visible to a client device;

authenticating a user of the client device to the host computer based on credentials provided by the user;

automatically erasing user credentials subsequent to successful authentication of the user credentials on the host computer;

receiving at the gateway service a subsequent access request regarding another host computer in the cluster; and

forwarding the subsequent access request from the gateway service to the selected initial host computer for authentication based on the credentials.