AUTHENTICATION SERVER ENHANCEMENTS

• US 20150113589A1
• Filed: 09/29/2014
• Published: 04/23/2015
• Est. Priority Date: 10/01/2013
• Status: Active Grant

• Current Assignee: Duleep G. Pillai, Robert K. Lemaster
• Original Assignee: Robert K. Lemaster
• Inventors: Pillai, Duleep G., Lemaster, Robert K.
• Granted Patent: US 9,578,005 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A set of authentication server configuration rules are implemented. The authentication server configuration rules utilize regular-expression based commands. A running log of commands entered by every user is maintained for each command is run by the at least one authentication server. A configuration diff command is run each time a session ends. A set of actions of an authentication-server administrator on the authentication server is tracked. The set of actions of the authentication-server administrator is stored in a log. The log includes a username of the authentication-server administrator who generated the log and a time source and a time zone associated of a location of the set of actions. A hash algorithm is run on the log. A portable document format (PDF) formatted the of the log is generated. A list of usernames is generated from a set logs that filled a user-authentication process required to access the authentication server.

Claims

1. An authentication-server method comprising:

with at least one authentication server;

implementing a set of authentication server configuration rules, wherein the authentication server configuration rules utilize regular-expression based commands;

maintaining a running log of all commands entered by every user as each command is run by the at least one authentication server;

running a configuration diff command each time a session ends;

racking a set of actions of an authentication-server administrator on the authentication server;

storing the set of actions of the authentication-server administrator in a log, wherein the log comprises a username of the authentication-server administrator who generated the log, and a time source and a time zone associated of a location of the set of actions;

running a hash algorithm on the log;

generating an portable document format (PDF) formatted file of the log;

generating a list of all usernames from a set logs that failed a user-authentication process required to access the authentication server;

when a specified amount of failed authentication attempts from a single remote internet protocol (IP) address are detected, blocking all authentication attempts from IP address for a specified period of time;

adding an authorized IP address list as part of an access control list to a user record, wherein the access control list allows the user record'"'"'s username to access the authentication server from specified remote user hosts or subnets; and

providing a mobile device application that enables the authentication-server administrator, wherein the mobile device application enables the authentication-server administrator to monitor and access a proxy server with access to the authentication server, and wherein the authentication server and the mobile device application authenticate to the proxy server over a secured connection.

2. The authentication-server method of claim 1, wherein regular-expression based commands comprise a permit-deny statement on any pan of an authentication-server command.

3. The authentication-server method of claim 2, wherein a regular expressions is used to match on host names of clients instead in lieu an internet protocol (IP) address client identifier.

4. The authentication-server method of claim 1, wherein the configuration diff command is emailed to the authentication-server administrator.

5. The authentication-server method of claim 1, wherein the user record comprises an access control list of specified client devices that can access the authentication server when also associated with the authorized IP address.

6. The authentication-server method of claim 1, wherein the authentication server sends an alerts to the mobile device application through the proxy server, wherein the alert comprises information about an authentication server maintenance, report, an authentication server access log or an authentication server view statistic.

7. The authentication-server method of claim 6, wherein a remote authentication-server commands can be communicated from the mobile device application to the proxy server and then forwarded to the authentication server for implementation.

8. A computerized system of an authentication processor comprising:

at least one processor operating in the authentication server is configured to execute instructions;

a memory including instructions when executed on the at least one processor, causes the processor to perform;

implement a set of authentication server configuration rules, wherein the authentication server configuration rules utilize regular-expression based commands;

maintain a running log of all commands entered by every user as each command is run by the at least one authentication server;

run a configuration diff command each time a session ends;

track a set of actions of an authentication-server administrator on the authentication server;

store the set of actions of the authentication-server administrator in a log, wherein the log comprises a username of the authentication-server administrator who generated the log and a time source and a time zone associated of a location of the set of actions;

run a hash algorithm on the log;

generate an portable document format (PDF) formatted file of the log;

generate a list of all usernames from a set logs that failed a user-authentication process required to access the authentication server;

when a specified amount of failed authentication attempts from a single remote internet protocol (IP) address are detected, block all authentication attempts from IP address for a specified period, of time;

add an authorized IP address list as part of an access control list to a user record, wherein the access control list allows the user record'"'"'s username to access the authentication server from specified remote user hosts or subnets; and

provide a mobile device application that enables the authentication-server administrator, wherein the mobile device application enables the authentication-server administrator to monitor and access a proxy server with access to the authentication server, and wherein the authentication server and the mobile device, application authenticate to the proxy server over a secured connection.

9. The authentication-server method of claim 8, wherein regular-expression based commands comprise a permit-deny statement on any part of an authentication-server command.

10. The authentication-server method of claim 9, wherein a regular expressions is used to match on Most names of clients instead in lieu an interne protocol (IP) address client identifier.

11. The authentication-server method of claim 8, wherein the configuration cliff command is emailed to the authentication-server administrator.

12. The authentication-server method of claim 8, wherein the user record comprises an access control list of specified client devices that can access the authentication server when also associated with the authorized IP address.

13. The authentication-server method of claim 8, wherein the authentication server sends an alerts to the mobile device application through the proxy server, wherein the alert comprises information about an authentication server maintenance report, an authentication server access log or an authentication server view statistic.

14. The authentication-server method of claim 13, wherein a remote authentication-server commands can be communicated from the mobile device application to the proxy server and then forwarded to the authentication server for implementation,