Method of providing an access request to a same server based on a unique identifier

• US 7,240,211 B2
• Filed: 10/09/2001
• Issued: 07/03/2007
• Est. Priority Date: 10/09/2001
• Status: Active Grant

• Current Assignee: Activcard Ireland, Limited
• Original Assignee: Activcard Ireland, Limited
• Inventors: Hillhouse, Robert D.
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Heneghan; Matthew
• Application Number:
  US09/972,156
• Publication Number:
  US 20030070090A1
• Time in Patent Office: 2,093 Days
• Field of Search: 709227-229, 709238-244, 709/225, 713/186, 713/201, 713/182, 707201-203, 714/4, 726/4, 726/5, 726/7
• US Class Current: 713/182
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers

Abstract

A method in which a data access request by a user to access data of a destination server, such as the data that needs to be updated when a login and/or password is changed, is provided consistently. The destination servers are redundant, and instead of directing the access request directly to one of the redundant destination servers, an intermediate level of servers is provided that selects one of the destination servers to serve the data access request. This selection is made so that the data access request from a particular source may be directed to the same destination server. The data access request includes data that is unique to the source and/or to the user, and the selection is made in dependence on the result of a transformation, such as a hash function, performed on the unique data. Since the redundant destination servers may each identically serve the data access request, the data access request can be routed to any destination server without any change in the processing of the request.

Claims

1. A method of directing an authentication request comprising:

providing a client terminal;

providing a plurality of first servers, wherein at least one first server from the plurality of first servers is coupled to said client terminal;

providing a plurality of redundant destination servers, each comprising means for identically serving said authentication request, wherein each of said plurality of first servers is connected to each of said plurality of redundant destination servers;

providing said authentication request from said client terminal to a first server, said authentication request including authentication data unique to a user of said client terminal;

selecting a redundant destination server from said plurality of redundant destination servers by said first server by hashing said authentication data unique to said user to determine a value indicative of the selected redundant destination servers such that the same authentication data received from said client terminal with another authentication request results in selection of a same redundant destination server from said plurality of redundant destination servers based on said value; and

providing data access in accordance with said authentication request by said selected destination server.

2. A method according to claim 1 wherein said authentication data unique to said user is hashed by a hash function that hashes a PIN of said user of said client terminal to generate said value indicative of said selected redundant destination server.

3. A method according to claim 2 wherein the plurality of first servers operate for said selection of a redundant destination server independently of previous authentication requests to the destination servers.

4. A method according to claim 2 comprising:

providing biometric information;

performing a biometric authentication process for authenticating the provided biometric information; and

providing password data from redundant destination server in dependence upon the authenticated biometric information.

5. A method according to claim 3 wherein if said selected destination server is inoperative said authentication data unique to said user is hashed again to obtain a value indicating a second other selected redundant destination server.

6. A method according to claim 3 wherein if said selected destination server is inoperative said operatively connected first server according to a same predetermined process as the other first servers obtains a second other selected redundant destination server.

7. A method according to claim 6 including providing the plurality of first servers within the network with network topology knowledge.

8. A method according to claim 7 including providing the plurality of first servers within the network with instructions for carrying out a predetermined process for selecting a LDAP server.

9. A method according to claim 1 wherein said authentication data unique to said user comprises a user login identification.

10. A method according to claim 9 wherein the destination servers are LDAP servers within a network.

11. A method according to claim 10 wherein information stored on an LDAP server takes a finite time to migrate to other LDAP servers within the network.

12. A method according to claim 11 wherein said authentication request is a request for security data.

13. A method according to claim 12 wherein the security data includes access codes and wherein upon changing an access code the data stored within a single LDAP server is updated and then propagated to other LDAP servers within the network and wherein a same user retrieves the updated information upon accessing an LDAP server via any of the plurality of first servers.

14. A method according to claim 13 wherein while the changed access code and data is propagating through LDAP servers within the network the end user has full access to most current LDAP data including new password or entry code information since authentication requests are directed to the same LDAP server based on an IP address.

15. A method according to claim 12 wherein the security data includes access codes and wherein upon changing an access code the data stored within a single destination server is updated and then propagated to other destination servers within the network and wherein a same user retrieves the updated information upon accessing a redundant destination server via any of the plurality of first servers.

16. A method according to claim 1 wherein said authentication request is a request for security data.

17. A computer network for directing an authentication request comprising:

a client terminal;

a plurality of first servers, wherein at least one first server from said plurality of first servers is coupled to said client terminal; and

a plurality of redundant destination servers, each comprising means for identically serving said authentication request;

wherein each of said plurality of first servers is connected to each of said plurality of redundant destination servers, said at least one client terminal comprising means for providing said authentication request to a first server, said authentication request including authentication data unique to a user of said client terminal, the first server including selection means for selection of a redundant destination server from said plurality of redundant destination servers by hashing said authentication data unique to said user to determine a value indicative of the selected redundant destination server,

such that the same authentication data received from said client terminal with another authentication request results in selection of a same redundant destination server from said plurality of redundant destination servers based on said value,

said selected redundant destination server including means for providing data access in accordance with said authentication request.

18. A computer network according to claim 17 wherein the plurality of destination servers are LDAP servers.

19. A computer network as in claim 17, wherein the selection means includes a hash process that hashes a login name or a PIN of said user of the client terminal to determine said value.

20. A method of directing an authentication request from a client terminal through at least one of a plurality of first servers to at least one redundant destination server that is configured to identically serve the authentication request from the client terminal, comprising:

receiving an authentication request from said client terminal at a first server, said authentication request including authentication data unique to a user of said client terminal;

selecting a redundant destination server by hashing said authentication data unique to said user to a value indicative of the selected redundant destination server such that the same authentication data received from said client terminal with another authentication request results in selection of a same redundant destination server based on said value; and

providing data access in accordance with said authentication request by said selected destination server.

21. A method according to claim 20 wherein said authentication data unique to said user is hashed by a hash function that hashes a PIN of said user of said client terminal to generate said value indicative of said selected redundant destination server.

22. A method according to claim 21 wherein the plurality of first servers operate for said selection of a redundant destination server independently of previous authentication requests to the at least one redundant destination server.

23. A method according to claim 22 wherein if said selected destination server is inoperative said authentication data unique to said user is hashed again to obtain a value indicating a second other selected redundant destination server.

24. A method according to claim 22 wherein if said selected destination server is inoperative said operatively connected first server according to a same predetermined process as the other first servers obtains a second other selected redundant destination server.

25. A method according to claim 20 wherein said authentication data unique to said user comprises a user login identification.

26. A method according to claim 25 wherein the at least one redundant destination server comprises LDAP servers within a network.

27. A method according to claim 26 wherein information stored on an LDAP server takes a finite time to migrate to other LDAP servers within the network.

28. A method according to claim 27 wherein said authentication request is a request for security data.

29. A method according to claim 28 wherein the security data includes access codes and wherein upon changing an access code the data stored within a single LDAP server is updated and then propagated to other LDAP servers within the network and wherein a same user retrieves the updated information upon accessing an LDAP server via any of the plurality of first servers.

30. A method according to claim 29 wherein while the changed access code and data is propagating through LDAP servers within the network the end user has full access to most current LDAP data including new password or entry code information since authentication requests are directed to the same LDAP server based on an IP address.

31. A method according to claim 20 including providing the plurality of first servers within the network with network topology knowledge.

32. A method according to claim 31 including providing the plurality of first servers within the network with instructions for carrying out a predetermined process for selecting a redundant destination server.

33. A method according to claim 20 comprising:

receiving biometric information;

performing a biometric authentication process for authenticating the provided biometric information; and

providing password data from a redundant destination server in dependence upon the authenticated biometric information.

34. A server for directing an authentication request from a client terminal to at least one of a plurality of redundant destination servers that is configured to identically serve the authentication request from the client terminal, wherein said server is connected to each of said plurality of redundant destination servers, comprising:

means for receiving said authentication request from said client terminal, said authentication request including authentication data unique to a user of said client terminal; and

selection means for selection of a redundant destination server from said plurality of redundant destination servers by hashing said authentication data unique to said user to determine a value indicative of the selected redundant destination server such that the same authentication data received from said client terminal with another authentication request results in selection of a same redundant destination server from said plurality of redundant destination servers based on said value.

35. A server as in claim 34, wherein the selection means includes a hash process that hashes a login name or a PIN of said user of the client terminal to determine said value.