Flexible interface to authentication services in a distributed data processing environment

• US 5,481,720 A
• Filed: 09/14/1994
• Issued: 01/02/1996
• Est. Priority Date: 05/15/1989
• Status: Expired due to Term

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Smith, Todd A., Loucks, Larry K.
• Primary Examiner(s): Kriess, Kevin A.
• Assistant Examiner(s): CHAVIS, JOHN Q
• Application Number:
  US08/306,224
• Time in Patent Office: 475 Days
• Field of Search: 395/700, 395/650, 395/600
• US Class Current: 726/21
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register

Abstract

In a distributed data processing system, the authentication of a process at one node for the use of a service at another node is performed in a facility that is separate from the requestor and service process. The separate facility is also replaceable, thereby allowing different authentication policies to be implemented within the distributed data processing system. The requesting process and the service process merely pass the authentication information between themselves without attempting to interpret the work of the separate authentication facility. In addition to authenticating the requestor to the service, the service is also authenticated to the requestor.

Claims

1. A system for authenticating a requestor process at a first node, of a service process running at a second node in a distributed data processing system, comprising:

a first machine at said first node;

a second machine at a second node; and

communication means interconnecting said first and said second machines;

said first machine executing

an operating system;

said requestor process, and

a first authentication agent program defining a corresponding first authentication policy independently of said operating system;

said first machine further including

means for constructing authentication information and a first authentication acknowledgement supporting said first authentication policy;

said second machine further executing

an operating system;

said service process, and

a second authentication agent program defining a corresponding second authentication policy independently of said operating system;

said second machine further including

means for receiving and processing said authentication information communication from said first machine to said second machine over said communication means;

means for acquiring and transmitting a second authentication acknowledgement on said communication means from said second machine to said first machine;

and wherein said first machine further includes

means for comparing said first authentication acknowledgement and said second received authentication acknowledgement for determining a second authentication of said service process.

2. The apparatus of claim 1 wherein said first authentication policy differs from said second authentication policy.

3. A method for authentication a requestor process at a first node of a service process running at a second node in a distributed data processing system comprising:

executing in a first machine

an operating system;

said requestor process; and

a first authentication agent program defining a corresponding first authentication policy independently of said operating system;

constructing with said first machine authentication information and a first authentication acknowledgement supporting said first authentication policy;

executing in a second machine

an operating system;

a service process; and

a second authentication agent program defining a corresponding second authentication policy independently of said operating system;

receiving and processing with said second machine said authentication information communicated from said machine to said second machine;

acquiring and transmitting with said second machine a second authentication acknowledgement from said second machine to said first machine; and

comparing with said first machine said first authentication acknowledgement and said second received authentication acknowledgement for determining a second authentication of said service process.

4. The method of claim 3 further including

deleting said second authentication agent program and substituting therefore a corresponding third authentication policy independently of said operating system.