Method and apparatus for processing requests in a network data processing system based on a trust association between servers

• US 6,965,939 B2
• Filed: 01/05/2001
• Issued: 11/15/2005
• Est. Priority Date: 01/05/2001
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Nagaratnam, Nataraj, Cuomo, Gennaro A., Jamison, Wilfred C.
• Primary Examiner(s): Follansbee, John
• Assistant Examiner(s): PEREZ DAPLE, AARON C
• Application Number:
  US09/755,351
• Publication Number:
  US 20020091757A1
• Time in Patent Office: 1,775 Days
• Field of Search: 709/203, 709/219, 709/225, 713/155, 713/156, 713/159, 713/160, 713/172, 713/154, 713/165, 713/168, 713/175, 713/176, 713200-202
• US Class Current: 709/229
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/561 Adding application-functional data or data for application control, e.g. adding metadata

Abstract

A method, apparatus, and computer implemented instructions for handling requests in a network data processing system. The network data processing system includes a network and clients connected to the network. A first server is present in which the first server receives a request from a client to access a resource, performs an authentication process with the client, add information to the request in which the information indicates that the request is from a trusted source to form a modified request, and sends the modified request for processing. This modified request is received by a second server. This second server determines whether the first server is a trusted server based on the information, and provides access to the resource in response to a determination that the first server is a trusted server. If the second server receives the request directly from a client, it would process the request by itself instead of basing its trust on any of the known first servers.

Claims

1. A method in a data processing system for authenticating a request, the method comprising:

receiving, by a first security server, a request from a client;

performing authentication of the request by the first security server;

adding, by the first security server, information to the request to form a modified request, wherein the information indicates that the request is from a trusted source;

sending, by the first security server, the modified request to a web application server;

presenting the modified request to each of a plurality of components of the web application server, wherein each of the plurality of components correspond with a respective one of a plurality of security servers; and

validating, by a one of the plurality of components that corresponds with the first security server, the modified request.

2. The method of claim 1, wherein the request is a request to access data.

3. The method of claim 1, wherein the first security server is a reverse proxy server.

4. The method of claim 1, wherein the information includes a user identification.

5. The method of claim 4, wherein the user identification is a user name and password.

6. The method of claim 1, wherein the information includes an identification of the first security server.

7. The method of claim 1, wherein the step of validating further comprises determining that a value of the information is an expected value located in a data structure.

8. The method of claim 1, wherein each of the plurality of components is implemented as a respective interceptor.

9. A data processing system comprising:

a bus system;

a communications unit connected to the bus system;

a memory connected to the bus system, wherein the memory includes a plurality of components as a set of instructions; and

a processing unit connected to the bus system, wherein the processing unit, responsive to receiving a modified request from a first security server of a plurality of security servers, executes the set of instructions and presents the modified request to each of the plurality of components of the data processing system, wherein each of the plurality of components corresponds with a respective one of the plurality of security servers, and wherein the processing unit, responsive to execution of one of the plurality of components that corresponds with the first security server, determines whether an expected value of information added to the modified request by the first security server is present in the modified request and processes the modified request, in response to the expected value being present in the modified request, wherein the modified request is generated from a request originated by a client and modified by the first security server to include the added information.

10. A network data processing system comprising:

a network;

a plurality of clients connected to the network;

a first security server connected to the network, wherein the first security server receives a request from a client to access a resource, performs an authentication process with the client, adds information to the request in which the information indicates that the request is from a trusted source to form a modified request, and sends the modified request for processing; and

a second server connected to the network and having a plurality of components, wherein the second server receives the modified request from the first security server, presents the modified request to each of the plurality of components each respectively corresponding to one of a plurality of security servers, determines whether the first server is a trusted server based on a determination made by a first component of the plurality of components that corresponds with the first security server, and provides access to the resource in response to a determination that the first server is a trusted server.

11. The network data processing system of claim 10 further comprising a second security server connected to the network, wherein the second security server receives requests from clients to access the resource, performs an authentication process with the clients, adds information to the requests in which the information indicates that the requests are from a trusted source to form modified requests, and sends the modified requests to the second server for processing, wherein the second server presents the modified requests of the second security server to each of the plurality of components and determines whether the second security sever is a trusted server based on a determination made by a second component that corresponds with the second security server, wherein the first component and the second component provide different security restrictions.

12. The network data processing system of claim 10, wherein the network is at least one of a local area network, an intranet, an extranet and an Internet.

13. The network data processing system of claim 10, wherein the plurality of components comprise a set of interceptors in which the set of interceptors are used to determine whether the first security server is a trusted sewer, wherein the request is sent to each of the set of interceptors to determine whether the interceptors can handle the request.

14. The network data processing system of claim 10, wherein the second server receives the request directly from the client.

15. A data processing server for processing a request, the data processing server comprising:

receiving means for receiving a modified request from a first security server of a plurality of security serves, wherein the modified request is generated from a request originated by a client and the modified request includes information added by the first security server;

a plurality of determining means, each of which receives the modified request, for determining whether the information present in the modified request has an expected value, wherein each of the plurality of determining means corresponds to one of the plurality of security servers; and

processing means for processing the modified request in response to a one of the plurality of determining means determining the information has the expected value.

16. The data processing system of claim 15, wherein the modified request requests access to a resource, the data processing system further comprising:

second determining means for determining whether a user of the client is authorized to access the resource; and

accessing means for accessing the resource using the modified request in response to a determination that the user is authorized.

17. The data processing system of claim 15, wherein the first security server is a reverse proxy server.

18. The data processing system of claim 15, wherein the information is an identification of the first security server.

19. The data processing system of claim 15, wherein the information is a user name and password of a user of the client.

20. The data processing system of claim 15, wherein the plurality of determining means includes a set of interceptors that can provide different security restrictions to a resource.

21. A computer program product in a computer readable medium for processing a request, the computer program product comprising:

first instructions for receiving a modified request from a first security server, wherein the modified request is generated by the first security server by modifying information in a request originated by a client;

second instructions for determining one of a plurality of interceptors that can process the modified request by presenting the modified request to each of the plurality of interceptors, wherein each of the plurality of interceptors corresponds to one of the plurality of security servers;

third instructions for determining whether a value of the information present in the modified request is an expected value; and

fourth instructions, responsive to the value of the information being the expected value, for processing the modified request.