Middleware program with enhanced security

• US 5,768,503 A
• Filed: 09/25/1995
• Issued: 06/16/1998
• Est. Priority Date: 09/25/1995
• Status: Expired due to Term

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Olkin, Terry Michael
• Primary Examiner(s): Beausoliel, Jr., Robert W.
• Assistant Examiner(s): Palys, Joseph E.
• Application Number:
  US08/533,466
• Time in Patent Office: 995 Days
• Field of Search: 395/187.01, 395/186, 395/188.01, 395/200.01, 395/200.03, 395/200.12, 395/200.14, 395/200.2, 380/4, 380/21, 380/23, 380/25
• US Class Current: 726/5
• CPC Class Codes: G06F 21/31 User authentication

Abstract

The authentication and security mechanism in a first program is used to access an application program which requires a different type of authentication and password. A server program runs in the same machine as the application program. The server program communicates with the first program and it is accessed and it authenticates the user utilizing the security and authentication mechanism of the first program. After the user ID of a user who desires access to the second program has been authenticated using the authentication mechanism of the first program, the server program (a) generates a temporary password for the authenticated user I.D., (b) changes the password for the authenticated user ID to the temporary password, (c) accesses the second program using the authenticated ID and the temporary password, and (d) receives data and/or commands from the first program using the security mechanism from the first program and transmits this data and/or commands to the second program and (e) receives data and/or commands from the second program and transmits the data and/or commands to the user using the security mechanism of the first program.

Claims

1. A distributed computer system including,

a network operating program that includes a distributed network security protocol,

an application program that includes a second security protocol, a first sign-on ID and a second sign-on ID, said second sign-on ID having an associated password, said first sign-on ID being a privileged ID which can change said password of said second sign-on ID, and

a server connected to a network using said distributed network security protocol, said server including means for signing on to said application program using said second security protocol and said first ID and for changing the password of said second ID to a temporary password, means for signing on to said application program using said second security protocol, said second ID and said temporary password, and means for passing data between said server and said network using said network security protocol.

2. The system recited in claim 1 wherein said network operating program conforms to the specification for a DCE (Distributed Computer Environment) program.

3. The system recited in claim 1 wherein said distributed network security protocol is a Kerberos protocol.

4. The system recited in claim 1 including an application computer, said application program and said server both being located in said application computer.

5. In a distributed computer system that includes a network operating program that includes a distributed network security protocol, and an application program that includes a second security protocol, said application program including a first sign-on ID and a second sign-on ID, said second sign-on ID having an associated password, said first sign-on ID being a privileged ID which can change the password of said second sign-on ID,

the improvement comprising;

a server connected to a network using said distributed network security protocol, said server including means for signing on to said application program using said second security protocol and said first ID and for changing the password of said second ID to a temporary password, means for signing on to said application program using said second security protocol, said second ID and said temporary password, and means for passing data between said server and said network using said network security protocol

whereby data passes from said network to said server using said distributed network protocol and between said server and said application program using said second security protocol.

6. The system recited in claim 5 wherein said network operating program conforms to the specification for a DCE (Distributed Computer Environment) program.

7. The system recited in claim 5 wherein said distributed network security protocol is a Kerberos protocol.