Method and system for maintaining client server security associations in a distributed computing system

• US 6,141,758 A
• Filed: 07/14/1997
• Issued: 10/31/2000
• Est. Priority Date: 07/14/1997
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Rathi, Mahesh Kumar, Benantar, Messaoud, High, Robert Howard Jr.
• Primary Examiner(s): Beausoliel, Jr., Robert W.
• Assistant Examiner(s): Baderman, Scott T.
• Application Number:
  US08/892,222
• Time in Patent Office: 1,205 Days
• Field of Search: 395/187.01, 395/188.01, 395/186, 395/200.55, 395/200.57, 395/200.59, 395/200.58, 380/23, 380/25, 364/286.5, 713/172, 713/176, 705/65, 705/66, 705/67
• US Class Current: 726/10
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets

Abstract

A method and system for maintaining a secure association between a client and a server in a distributed computing system by computing a session identifier as a function of a Kerberos-based authentication ticket. The session identifier is independently derived or verified by the client and the server upon a first request by the client to the server, and each subsequent request by the client to the server is tagged with this session identifier to provide a reliable security association.

Claims

1. A method for maintaining a secure association between a client and a server in a distributed computing system, said method comprising the steps of:

issuing a security token to the client;

sending, by the client, the security token to the server with a first request by the client to the server;

validating, for the server, the security token sent by the client;

computing a session identifier as a cryptographic signature function of the security token at the client; and

tagging each subsequent request by the client to the server with the session identifier such that the session identifier may be cryptographically verified at the server.

2. The method, as set forth in claim 1, further comprising the step of determining, by the server, if a request by the client to the server has been tagged with the session identifier.

3. The method, as recited in claim 1, wherein the security token is a Kerberos-based authentication ticket.

4. The method, as recited in claim 1, wherein the security token is issued and validated by a security server.

5. A distributed computing system comprising:

at least one client;

at least one server;

a communications network interconnecting the client and the server;

means for issuing a security token to the client;

means for sending, by the client, the security token to the server with a first request by the client to the server;

means for validating, for the server, the security token sent by the client;

means for computing a session identifier as a cryptographic signature function of the security token at said at least one client; and

means for tagging each subsequent request by the client to the server with the session identifier such that the session identifier may be cryptographically verified at the server.

6. The distributed computing system, as recited in claim 5, further comprising means for determining, by the server, if a request by the client to the server has been tagged with the session identifier.

7. The distributed computing system, as recited in claim 5, wherein the security token is a Kerberos-based authentication ticket.

8. The distributed computing system, as recited in claim 5, wherein the security token is issued and validated by a security server.

9. A computer readable medium comprising means for maintaining a secure association between a client and a server in a distributed computing system, including:

means for issuing a security token to the client;

means for sending, by the client, the security token to the server with a first request by the client to the server;

means for validating, for the server, the security token sent by the client;

means for computing a session identifier as a cryptographic signature function of the security token at the client; and

means for tagging each subsequent request by the client to the server with the session identifier such that the session identifier may be cryptographically verified at the server.

10. The computer readable medium, as recited in claim 9, further comprising means for determining, by the server, if a request by the client to the server has been tagged with the session identifier.

11. The computer readable medium, as recited in claim 9, wherein the security token is a Kerberos-based authentication ticket.

12. The computer readable medium, as recited in claim 9, wherein the security token is issued and validated by a security server.