Method and apparatus for session management and user authentication

• US 6,484,174 B1
• Filed: 10/31/2000
• Issued: 11/19/2002
• Est. Priority Date: 04/20/1998
• Status: Expired due to Term

• Current Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Hanko, James G., Northcutt, J. Duane, Ruberg, Alan T., Butcher, Lawrence L., Wall, Gerard A.
• Primary Examiner(s): Trammell, James P.
• Assistant Examiner(s): CHEUNG, MARY DA ZHI WANG
• Application Number:
  US09/703,009
• Time in Patent Office: 749 Days
• Field of Search: 709/200-203, 709/225, 709/227-229, 713/200-202, 707/9-10
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 2211/1097 Boot, Start, Initialise, Power
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

Authentication and session management can be used with a system architecture that partitions functionality between a human interface device (HID) and a computational service provider such as a server. An authentication manager executing on a server interacts with the HID to validate the user when the user connects to the system via the HID. A session manager executing on a server manages services running on computers providing computational services on behalf of the user. The session manager notifies each service in a session that the user is attached to the system using a given HID. A service can direct display output to the HID while the user is attached to the system. When a user detaches from the system, each of the service'"'"'s executing for the user is notified via the authentication manager and the session manager. Upon notification that the user is detached from the system, a service can continue to execute while stopping its display to the HID.

Claims

1. A method for interacting with a computer system comprising:

accessing a first computer in said computer system using an identifier;

authenticating a user on a server in said computer system using said identifier; and

directing one or more services to said first computer system, if said user is authenticated on said server;

disconnecting from said first computer;

continuing to execute said services;

re-connecting on a second computer in said computer system using said identifier;

authenticating said user on said server in said computer system using said identifier; and

directing said services to said second computer system, if said user is authenticated on said server wherein said services continued to execute when said user was disconnected from said first computer.

2. The method of claim 1 wherein said first and second computers are human interface devices.

3. The method of claim 1 wherein said identifier is a smart card.

4. The method of claim 1 wherein said identifier is a PIN number.

5. The method of claim 1 wherein said identifier is a bio-metric identifier.

6. The method of claim 1 wherein said step of disconnecting is accomplished by pressing a sign-off button.

7. The method of claim 1 wherein said step of disconnecting is accomplished by removing a smart card.

8. A computer program product comprising:

a computer usable medium having computer readable program code embodied therein configured to interact with a computer system, said computer program product comprising;

computer readable code configured to cause a computer to access a first computer in said computer system using an identifier;

computer readable code configured to cause a computer to authenticate a user on a server in said computer system using said identifier;

computer readable code configured to cause a computer to direct one or more services to said first computer system, if said user is authenticated on said server;

computer readable code configured to cause a computer to disconnect from said first computer;

computer readable code to cause a computer to continuing to execute said services;

computer readable code configured to cause a computer to re-connect on a second computer in said computer system using said identifier;

computer readable code configured to cause a computer to authenticate said user on said server in said computer system using said identifier; and

computer readable code configured to cause a computer to direct said services to said second computer system, if said user is authenticated on said server wherein said services continued to execute when said user was disconnected from said first computer.

9. The computer program product of claim 8 wherein said first and second computers are human interface devices.

10. The computer program product of claim 8 wherein said identifier is a smart card.

11. The computer program product of claim 8 wherein said identifier is a PIN number.

12. The computer program product of claim 8 wherein said identifier is a bio-metric identifier.

13. The computer program product of claim 8 wherein said computer readable code configured to cause a computer to disconnect is accomplished by pressing a sign-off button.

14. The computer program product of claim 8 wherein said computer readable code configured to cause a computer to disconnect is accomplished by removing a smart card.

15. An environment for interacting with a computer system comprising:

a first computer in said computer system configured to be accessed using an identifier;

an authentication manager on a server in said computer system configured to verify a user using said identifier;

a session manager configured to direct one or more services to said first computer system, if said user is verified on said server by said authentication manager;

a disconnector configured to determine when said user disconnects from said first computer wherein said services continue to execute;

a second computer in said computer system wherein said user reconnects to said second computer using said identifier;

said authentication manager configured to verify said user on said server in said computer system using said identifier; and

said session manager configured to direct said services to said second computer system, if said user is verified on said server by said authentication manager wherein said services continued to execute when said user was disconnected from said first computer.

16. The environment of claim 15 wherein said first and second computers are human interface devices.

17. The environment of claim 15 wherein said identifier is a smart card.

18. The environment of claim 15 wherein said identifier is a PIN number.

19. The environment of claim 15 wherein said identifier is a bio-metric identifier.

20. The environment of claim 15 wherein said disconnector operates when said user presses a sign-off button.

21. The environment of claim 15 wherein said disconnector operates when said user removes a smart card.

22. A method for interacting with a computer system comprising:

accessing a first computer in said computer system using an identifier;

authenticating a user on a server in said computer system using said identifier;

connecting one or more services to said first computer, if said user is authenticated on said server; and

re-connecting said one or more services to a second computer in said computer system using said identifier from said first computer, wherein said one or more services continued to execute on said second computer when said user was disconnected from said first computer.

23. A method for interacting with a computer system comprising:

accessing a first computer in said computer system using an identifier;

authenticating a user on a server in said computer system using said identifier;

directing one or more services to said first computer, if said user is authenticated on said server;

associating at least one service within said directed services to a session;

disconnecting from said first computer;

continuing to execute said session associated service;

re-connecting said user; and

directing said session associated service to said user, wherein said session associated service continued to execute when said user was disconnected from said first computer.

24. The method of claim 23 wherein said user is re-reconnected using said identifier.