Controlling Exposure of Sensitive Data and Operation Using Process Bound Security Tokens in Cloud Computing Environment

• US 20150006902A1
• Filed: 09/13/2014
• Published: 01/01/2015
• Est. Priority Date: 01/21/2013
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Chang, John Y-C., CHao, Ching-Yun, Chiu, Bertrand Be-Chung, Park, Ki Hong
• Granted Patent: US 9,237,020 B2
• Time in Patent Office: Days
• US Class Current: 713/176
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 65/61 for supporting one-way streaming services, e.g. Internet radio
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Exposure of sensitive information to users is controlled using a first security token containing user identity and user credentials to represent the user who requests services, and a second security token containing two other identities, one identifying the token issuer and the other identifying the owning process. When requesting services, the token-owning process sends a security token to indicate who is making the request, and uses its key to digitally sign the request. The token-owning process signs the request to indicate that it endorses the request. A receiving server accepts a request if (1) the token-owning process endorses the request by signing the request; (2) the token is valid (token is signed by its issuer and the digital signature is verified and unexpired); (3) user entity, which can be a real user or a deployment or a server process, that is represented by the token has the authorization to access the specified resources; and (4) the token-owning process is authorized to endorse the user entity represented by the token to access the specified resources.

Claims

1. A method for controlling exposure of sensitive data and using process bound security tokens comprising:

representing a service requester using one or more security tokens containing a user identity, one or more user credentials, an identity of a token issuer, and an identity of the owning process;

responsive to requesting services and subsequent authenticating to a server process, issuing the one or more security tokens including an issuer key name which indicates a key which was used to sign the security token;

responsive to receiving the security token, using an issuer process name and the issuer key name to uniquely identify a public key needed to verify a token issuer digital signature; and

responsive to verifying the token issuer digital signature, granting access to a requested process or server resource to the requesting service.

2. The method as set forth in claim 1 wherein an owning process of a security token is the server process that received the user request, wherein the issuer process of the security token is a token services, wherein the security token is digitally signed by a token service using a private key of the token service, and wherein the security token contains an issuer key name that indicates which key is to be used to sign the security token.

3. The method as set forth in claim 1 wherein the one or more security tokens contains an owning process key name which indicates a cryptographic key the owning process must use to digitally sign request messages using a security token to prove the ownership of a security token.

4. The method as set forth in claim 1 wherein, responsive to a request message and a security token being received by a downstream server process, and that the validity and integrity of the request message and the security token is verified, and the request is authorized, the receiving server process can make downstream requests on behalf of an original requester by sending the received security token along with a server security token for the receiving server process to endorse the downstream request by digitally signing the request message by using a server private key that is identified by the owning process private key in the owner server security token.

5. A method for controlling exposure of sensitive data and using process bound security tokens comprising:

receiving by a server process a set of user authentication credentials a request to access or communicate to a server;

creating and signing with a token issuer cryptographic key a first security token that is owned by the first server;

sending to a downstream server the signed first token and the request endorsed by the server by digitally sign the request message;

endorsing the request by the downstream server by attaching a second security token representing the downstream server that is signed by a token issuer cryptographic key;

sending the endorsed request to a targeted server;

responsive to one or more security verifications of the endorsed request, issuing by the targeted server a user token;

returning the user token to the server process; and

the server process storing and associating the user token with a single sign-on token; and

sending the single sign-on token to the source of the request.

6. The method as set forth in claim 5 wherein the source of the request is a user device.

7. The method as set forth in claim 5 wherein the source of the request is a user process.

8. The method as set forth in claim 6 wherein the second security token comprises an identification of the token issuer, and comprises an identification of the owning process.

9. The method as set forth in claim 5 further comprising:

subsequent to the sending of the single sign-on cookie to the source of the request, receiving a second request by the inlet server for access to or communication with the target server, wherein the second request has the single sign-on attached;

looking up by the server process the user token associated with the attached single sign-on cookie; and

forwarding the second request with the user token to the key server.

10. The method as set forth in claim 9 wherein further comprising:

endorsing the second request by attaching the second security token signed by the second cryptographic key;

sending the endorsed second request to the targeted server.

11. The method as set forth in claim 10 further comprising:

responsive to one or more security verifications of the endorsed second request, performing by the targeted server a requested access, usage of a resource, or performance of a service according to the second request.

12. The method as set forth in claim 11 further comprising:

responsive to results generation by the access, usage, or service performance, returning the results to the server process with the user token attached;

detaching by the server process the user token from the results;

forwarding to the source of the second request the results and the single sign-on cookie.