Network-based authentication of computer user

• US 6,338,138 B1
• Filed: 06/29/1998
• Issued: 01/08/2002
• Est. Priority Date: 01/27/1998
• Status: Expired due to Term

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Gupta, Abhay, Wilson, Yvonne, Raduchel, William J.
• Primary Examiner(s): Decady, Albert
• Assistant Examiner(s): Callahan, Paul
• Application Number:
  US09/106,304
• Time in Patent Office: 1,289 Days
• Field of Search: 713/159, 713/165, 713/166, 713/183, 713/185, 713/2, 713/152, 713/155, 713/164, 713/172, 705/67, 705/65, 705/72, 705/73, 380/232
• US Class Current: 713/155
• CPC Class Codes: G06F 16/10 File systems; File servers
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G11B 2220/2562 DVDs [digital versatile discs]; Digital video discs; MMCDs; HDCDs
• CPC Class Codes: G11B 27/034 on discs G11B27/036, G11B27/038 take precedence
• CPC Class Codes: G11B 27/34 Indicating arrangements indicating means incorporated in magazine or cassette G11B23/046 and G11B23/0875; indicating measured values in general G01D

Abstract

A network-based authentication scheme is provided that performs authentication in a centralized manner for the stand-alone computers of a particular organization. Since authentication is centralized, the individual computers do not need to store authentication information, and control over all of the computers rests in a single location, enabling the system administrator to manage access and utilization of the computers from this location. The network-based authentication scheme includes an authentication manager, remotely located with respect to a local computer, that performs authentication for the local computer. The authentication manager receives login information from the local computer, verifies this information against an authentication file, and returns indications of the services on the local computer that the user is able to utilize. The local computer receives these indications and displays icons representing the services available to that user. The user may then select an icon, causing an applet to be downloaded from the authentication manager onto the local computer to facilitate the user'"'"'s utilization of the corresponding service.

Claims

1. A method in a data processing system having at least one stand-alone computer system and a security node that is remotely located with respect to the at least one computer system and connected via a network, the security node having an authentication manager that is capable of authenticating a plurality of stand-alone computer systems, the at least one stand-alone computer system having a set of services, the method comprising:

starting up the at least one stand-alone computer system;

inhibiting a user from utilizing the services of the at least one stand-alone computer system responsive to the starting up of the at least one stand-alone computer system;

displaying a browser with a login screen prompting the user for identification;

receiving the identification from the user and sending the identification to the authentication manager;

attempting to authenticate the user by the authentication manager;

determining by the browser whether the authentication manager has authenticated the user;

downloading first code to the at least one stand-alone computer system that facilitates use of a portion of the set of services of the at least one stand-alone computer system when the user has not been authenticated; and

downloading second code to the at least one stand-alone computer system that facilitates use of the set of the services of the at least one stand-alone computer system when the user has been authenticated.

2. The method of claim 1 wherein the downloading first code includes:

displaying, by the browser, icons representing the portion of the set of services available to the user, and

providing the first code responsive to user selection of the icons.

3. The method of claim 1 wherein the downloading second code includes:

displaying, by the browser, icons representative of the set of services, and

providing the second code responsive to user selection of the icons.

4. The method of claim 1 wherein each of the services of the stand-alone computer system is facilitated by an applet managed by the authentication manager, and wherein the downloading first code includes:

providing from a remote location applets to facilitate use of the portion of the set of services by the user.

5. The method of claim 1 wherein each of the services of the stand-alone computer system is facilitated by an applet managed by the authentication manager, and wherein the downloading second code includes:

downloading applets to facilitate use of the set of services by the user.

6. The method of claim 1 wherein the downloading first code includes:

running the portion of the set of services on the stand-alone computer system.

7. The method of claim 6 wherein the stand-alone computer system has a virtual machine, and wherein the running includes:

running the portion of the set of services on the virtual machine.

8. The method of claim 1 wherein the downloading second code includes:

running the set of services on the stand-alone computer system.

9. The method of claim 8 wherein the stand-alone computer system has a virtual machine, and wherein the running includes:

running the set of services on the virtual machine.

10. A method for performing authentication in a computer system with services comprising:

receiving information identifying a user;

sending, at least part of the information to a remote location for verification of the user and determination of which among the services the user is authorized to use;

receiving a first code that facilitates access to at least one of the services, the user not being verified; and

receiving second code that facilitates access to at least one of the services, the user being authorized to use the at least one of the services.

11. The method of claim 10, wherein the computer system includes a browser and wherein the receiving includes:

displaying by the browser a log-on screen to the user requesting the identification.

12. The method of claim 10, wherein the receiving an identification includes:

inhibiting use of the services until it is determined which among the services the user is authorized to use.

13. A method of performing authentication in a data processing system having at least one computer system with services and an authentication server, remotely located with respect to the at least one computer system and capable of authenticating a plurality of computer systems, the method performed by the authentication server comprising:

receiving an identification of a user of the at least one computer system;

determining based on the identification of the user which among the services the user was previously authorized to use;

providing a first code that facilitates use of at least one of the services when it is determined that the user is not authorized to use; and

sending to the at least one computer system second code that facilitates use of at least one of the services that the user is authorized to use.

14. The method of claim 13 wherein the code is contained in an applet, and wherein the sending includes:

sending the applet to the computer system to facilitate use of the at least one of the services that the user is authorized to use.

15. A data processing system with services and a user comprising:

a security node with an authentication manager configured to receive an identification of a user, configured to authenticate a user based on the identification, configured to return first code that facilitates use of at least one of the services when a user has not been authenticated and configured to return second code that facilitates use of at least one of the services when the user has been authenticated; and

at least one computer system with a browser configured to receive the identification, configured to send the identification to the authentication manager, configured to receive the first code from the authentication manager, configured to invoke the first code to facilitate use of at least one of the services by the user when the user has not been authenticated, configured to receive the code returned from the authentication manager, and configured to invoke the code to facilitate use of the services by the user when the user has been authenticated,

wherein the security node is remotely located with respect to the at least one computer system, and wherein the authentication manager is capable of authenticating a plurality of computer systems.

16. The data processing system of claim 15 wherein the code is an applet.

17. The data processing system of claim 15 wherein the computer system includes a virtual machine and wherein the browser runs on the virtual machine.

18. A computer-readable medium containing instructions for controlling a computer system to perform a method for performing authentication in a computer system having services, the method comprising:

receiving an identification of a user;

sending the identification to a remote location for verification of the information and determination of which among the services the user is authorized to use;

receiving a first code that facilitates access to at least one of the services, the user not being verified; and

receiving second code that facilitates access to at least one of the services, the user being authorized to use the at least one of the services.

19. The computer-readable medium of claim 18, wherein the computer system includes a browser and wherein the receiving includes:

displaying by the browser a log-on screen to the user requesting the identification.

20. The computer-readable medium of claim 18, wherein the receiving an identification includes:

inhibiting use of the services until it is determined which among the services the user is authorized to use.

21. A computer-readable medium containing instructions for controlling a data processing system to perform a method for performing authentication, the data processing system having at least one computer system with services and an authentication server, remotely located with respect to the at least one computer system, capable of authenticating a plurality of computer systems, the method performed by the authentication server comprising:

receiving an identification of a user of the at least one computer system;

verifying the identification of the user;

determining which among services the user is authorized to use;

sending to the at least one computer system first code that facilitates use of at least one of the services when the user is not verified;

sending to the at least one computer system second code that facilitates use of at least one of the services that the user is authorized to use.

22. The computer-readable medium of claim 21 wherein the code is contained in an applet, and wherein the sending includes:

sending the applet to the computer system to facilitate use of the at least one of the services that the user is authorized to use.

23. A data processing system having at least one stand-alone computer system and a security node that is remotely located with respect to the at least one computer system and connected via a network, the security node having an authentication manager capable of authenticating a plurality of stand-alone computer systems, the at least one stand-alone computer system having a set of services, the data processing system comprising:

means for starting up the at least one stand-alone computer system;

means for inhibiting a user from utilizing the services of the at least one stand-alone computer system responsive to the starting up of the at least one stand-alone computer system;

means for displaying a browser with a login screen prompting the user for identification;

means for receiving the identification from the user and sending the identification to the authentication manager;

means for authenticating the user by the authentication manager;

means for determining by the browser whether the authentication manager has authenticated the user;

means for downloading first code to the at least one stand-alone computer system that facilitates use of a portion of the set of services of the at least one stand-alone computer system when the user has not been authenticated; and

means for downloading second code to the at least one stand-alone computer system that facilitates use of the set of the services of the at least one stand-alone computer system when the user has been authenticated.

24. A method for performing authentication in a network comprising at least one computer system with services and an authentication server, remotely located with respect to the at least one computer system, capable of authenticating a plurality of computer systems, the method performed by the authentication server comprising:

receiving an identification of a user of the at least one computer system;

determining, based on the identification of the user, any of the services the user was previously authorized to use; and

providing an authorization signal to the at least one computer system, wherein the authorization signal authorizes limited access to services of the at least one computer system when it is determined that user was not previously authorized to use any of the services and the authorization signal authorizes unlimited access to services of the at least one computer system that the user was previously authorized to use when it is determined that the user was previously authorized to use those services.

25. A method for performing authentication in a network comprising at least one computer system with services and an authentication server, remotely located with respect to the at least one computer system, capable of authenticating a plurality of computer systems, the method performed by the at least one computer system comprising:

initially preventing a user from all services at start-up of the at least one computer system;

prompting the user to input identification information;

providing the identification information to the authentication server for determination of any services of the at least one computer system previously authorized for use by the user;

receiving from the authentication server an authorization code indicating the services of the at least one computer system available for previously authorized use by the user and an authorization code indicating that the user is permitted limited use of specific services; and

displaying a set of selectable icons, each icon representing a service available for use by the user.