Single sign-on framework with trust-level mapping to authentication requirements

• US 6,892,307 B1
• Filed: 08/05/1999
• Issued: 05/10/2005
• Est. Priority Date: 08/05/1999
• Status: Expired due to Term

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Wood, David L., Wilson, Yvonne, Ferris, Chris, Norton, Derk, Weschler, Paul
• Primary Examiner(s): Barron, Gilberto
• Assistant Examiner(s): STULBERGER, CAS P
• Application Number:
  US09/368,507
• Time in Patent Office: 2,105 Days
• Field of Search: 713/175, 713/201, 713/155, 713/156, 713/200, 388/25
• US Class Current: 726/8
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 2211/009 Trust
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A security architecture has been developed in which a single sign-on is provided for multiple information resources. Rather than specifying a single authentication scheme for all information resources, the security architecture associates trust-level requirements with information resources. Authentication schemes (e.g., those based on passwords, certificates, biometric techniques, smart cards, etc.) are associated with trust levels and a log-on service obtains credentials for an entity commensurate with the trust-level requirement(s) of an information resource (or information resources) to be accessed. Once credentials have been obtained for an entity and the entity has been authenticated to a given trust level, access is granted, without the need for further credentials and authentication, to information resources for which the authenticated trust level is sufficient.

Claims

1. An information security system comprising:

plural information resources distributed amongst and executable on one or more servers coupled via a communication network to a client entity, the plural information resources having associated trust level requirements, wherein the information security system provides plural trust levels, each of the trust levels corresponding to a respective set of credential types;

a gatekeeper interposed between the client entity and the information resources; and

a credential gathering service common to the plural information resources,

wherein upon receipt of a first request for access to a first of the plural information resources without prior authentication to a sufficient trust level, the gatekeeper redirects the first request to the common credential gathering service and the common credential gathering service obtains a login credential for the client entity in accordance with a mapping rule establishing a correspondence between the sufficient trust level and the respective set of credential types therefor.

2. An information security system, as recited in claim 1,

wherein the first request without prior authentication includes an initial request for access to the first information resource.

3. An information security system, as recited in claim 1,

wherein the first request without prior authentication includes a subsequent request for access to the first information resource, the subsequent request for access requiring a higher trust level than an initial access request.

4. An information security system, as recited in claim 1,

wherein upon receipt of a second request for access to a second of the plural information resources, the second request is serviced without redirection to the credential gathering service, the second information resource having a trust level requirement no greater than that of the first information resource.

5. An information security system, as recited in claim 1,

wherein the correspondence established by the mapping rule is a function of session environment information.

6. An information security system as recited in claim 5,

wherein the session environment information includes one or more of connection speed, source domain, HTTP environment information, browser type, authentication type, request method, MIME typing, user agent, referrer identity, date and time.

7. A credential gathering service providing a single sign-on for sessions that potentially include access to plural information resources having differing security requirements, the credential gathering service comprising:

an input port configured to receive an access request identifying an initiating client entity;

means for associating a trust level requirement with the access request;

an encoding of correspondence between trust levels and credential types, wherein each of the trust levels corresponds to a respective set of the credential types;

selection logic for selecting in accordance with the encoding, a credential type corresponding to the trust level requirement; and

a credential obtaining interface for requesting and receiving a credential of the selected credential type for the initiating client entity.

8. A credential gathering service as in claim 7,

wherein the credential obtaining interface is with the initiating client entity.

9. A credential gathering service as in claim 7, wherein the credential obtaining interface is with a credentialing authority.

10. A credential gathering service as in claim 7,

wherein the credential obtaining interface is with a credentialing device selected from the set of retinal scan device, a voiceprint analysis device, a fingerprint analysis device, and a card reader.

11. A credential gathering service as in claim 7, further comprising:

an authentication interface for authenticating the received credential.

12. A credential gathering service as in claim 11,

wherein the authentication interface includes a communications interface to an authentication service with one or more pluggable authentication modules corresponding to the credential types.

13. A credential gathering service as in claim 7,

wherein the initiating client entity is not initially authenticated to a trust level required by a first of the information resources;

and

wherein an attempted access to the first information resource by the initiating client entity is redirected to the credential gathering service with an associated trust level requirement corresponding to that required by the first information resource.

14. A credential gathering service as in claim 13,

wherein the initiating client entity in not initially authenticated.

15. A credential gathering service as in claim 7,

wherein the log-on request and associated trust level-requirement are supplied by the initiating client entity.

16. A credential gathering service as in claim 7,

wherein the trust level requirement is supplied by the initiating client entity.

17. A credential gathering service as in claim 7,

wherein the initiating client entity is one of an application and a user.

18. A credential gathering service as in claim 7,

wherein the credential types include at least two of passwords, certificates, username/password pairs, one time passwords, biometric indicia, and smart cards.

19. A credential gathering service as in claim 7,

wherein more than one credential type corresponds to a given trust level.

20. A credential gathering service as in claim 7,

wherein the correspondence between trust levels and credential types is dynamic and the encoding thereof is updateable.

21. A credential gathering service as in claim 7,

wherein the set of credential types and corresponding trust levels is dynamic and the encoding thereof is updateable.

22. The credential gathering service of claim 7, encoded in a machine readable medium as software executable in a networked computing environment to provide the plural information resources with the single sign-on.

23. The credential gathering service of claim 22, wherein the machine readable medium is selected from the set of a disk, tape or other magnetic, optical, or electronic storage medium and a network, wired, wireless or other communications medium.

24. A method of providing a single sign-on for plural information resources in an environment that provides plural trust levels, the method comprising:

associating credential types with respective ones of the trust levels;

specifying for each information resource, required ones of the trust levels for accesses thereto;

obtaining at least one credential corresponding to a client entity and authenticating the client entity thereby; and

permitting access to any of the information resources having a specified trust level requirement commensurate with the trust level associated with the authenticated at least one credential.

25. A method, as recited in claim 24, further comprising:

denying access to any of the information resources having a specified trust level requirement greater th an with the trust level associated with the authenticated at least one credential.

26. A method, as recited in claim 24 further comprising:

for access to any of the information resources having a specified trust level requirement greater than the trust level associated with the authenticated at least one credential, obtaining at least one additional credential corresponding to a client entity and authenticating the client entity thereby;

the at least one additional credential having an associated trust level commensurate with specified trust level requirement.

27. A method, as recited in claim 24,

wherein the credentials types include at least two of passwords, certificates, username/password pairs, one time passwords, biometric indicia, and smart cards.

28. A method of providing sign-on in a networked information environment that provides plural trust levels, the method comprising:

directing a request for access to a first information resource from an insufficiently authenticated client entity to a credential gathering service;

associating a first trust level requirement with the access to the first information resource;

selecting from plural credential types, a credential type having an associated trust level commensurate with the first trust level requirement;

obtaining a credential of the selected credential type for the client entity; and

authenticating the obtained credential.

29. A method, as recited in claim 28, the method further comprising:

proxying the access request upon successful completion of the authenticating.

30. A method, as recited in claim 28, the method further comprising:

supplying a cryptographically secured session token to the client entity based on the authenticated credential.

31. A method, as recited in claim 28, the method further comprising:

after successful completion of the authenticating, proxying a second access request without additional authentication.

32. A method, as recited in claim 31,

wherein the second access request is directed to the first information resource.

33. A method, as recited in claim 31,

wherein the second access request is directed to a second information resource, a second trust level requirement associated with access thereto being no greater than the first trust level requirement.

34. A method, as recited in claim 28,

wherein the associating is by a mapping rule encoded as one or more of a static or dynamic table, a hierarchy of predicates, weighted logic and fuzzy sets.

35. A method, as recited in claim 28,

wherein the associating is a function of at least resource identifier and environment information.

36. A method of providing a security interface common to plural information resources, the method comprising:

associating credential types with trust levels, wherein each of the trust levels correspond to a respective set of the credential types;

specifying for each information resource, a required one of the trust levels for accesses thereto;

with a login service common to the plural information resources, obtaining at least one credential corresponding to a client entity and authenticating an identity of the client entity thereby, wherein the obtained at least one credential is of one of the credential types associated with the required one of the trust levels;

granting or denying access to a first of the information resources based on correspondence between the required trust-level therefor and an authenticated trust level associated with the obtained at least one credential; and

granting or denying access to a second of the information resources based on correspondence between the required trust-level therefor and the authenticated trust level.

37. A method, as recited in claim 36,

wherein the at least one credential is selected from a set of credential types with associated authentication modules.

38. A method, as recited in claim 36,

wherein differing trust levels are required for access to the first and second information resources.