Single sign-on over the internet using public-key cryptography

• US 7,246,230 B2
• Filed: 01/29/2002
• Issued: 07/17/2007
• Est. Priority Date: 01/29/2002
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: BEA Systems Incorporated (Oracle Corporation)
• Inventors: Stanko, Joseph A.
• Primary Examiner(s): Moise; Emmanuel L.
• Assistant Examiner(s): Fields; Courtney D
• Application Number:
  US10/059,460
• Publication Number:
  US 20050074126A1
• Time in Patent Office: 1,995 Days
• Field of Search: 713/155, 713/159, 713/150, 709/229, 726/5, 726/10
• US Class Current: 713/155
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/126 the source of the received data

Abstract

A computer program product, apparatus, and method for use in an authentication server for obtaining access to a secure server for a client that has issued a request for access to the secure server, without further intervention by the user of the client, includes receiving an authentication challenge sent by the secure server to the client; and generating a ticket having a digital signature applied using a private key of the authentication server; and wherein the secure server, upon receiving the ticket and verifying the digital signature using a public key corresponding to the private key of the authentication server, grants access to the client.

Claims

1. A method for use in a Web server for obtaining content from a secure server, in response to a request from a client for the content, without further intervention by the user of the client, the method comprising:

sending a request for the content to the secure server;

receiving an authentication challenge from the secure server in response to the request;

sending a forwardable ticket to an authentication server trusted by the secure server, the forwardable ticket previously sent to the Web server by the authentication server based on a successful authentication of the client by the authentication server;

receiving from the authentication server a ticket having a digital signature applied using a private key of a public-private key pair of the authentication server; and

sending the ticket to the secure server, wherein the secure server, upon verifying the digital signature using a public key of said private-public key pair corresponding to the private key of the authentication server, provides the requested content; and

wherein

communications with the client employ a generic application-layer network protocol.

2. The method of claim 1, further comprising:

sending a forwardable challenge to the client in response to the request from the client, the forwardable challenge including the identity of an authentication server trusted by the Web server, wherein the authentication server authenticates the client and generates the forwardable ticket based on authenticating the client; and

receiving the forwardable ticket from the authentication server.

3. A method for use in an authentication server for obtaining content from a secure server for a client that has issued a request for the content from the secure server, without further intervention by the user of the client, the method comprising:

receiving a forwardable ticket sent by a Web server in response to a challenge issued by the secure server in response to the request, the forwardable ticket previously sent to the Web server by the authentication server based on a successful authentication of the client by the authentication server;

generating a ticket having a digital signature applied using a private key of a public-private key pair of the authentication server; and

wherein

the secure server, upon verifying the digital signature using a public key of said public-private key pair corresponding to the private key of the authentication server, provides the requested content; and

wherein

communications with the client employ a generic application-layer network protocol.

4. The method of claim 3, further comprising:

authenticating the client based on a previous successful authentication of the client before generating the ticket.

5. The method of claim 4 wherein authenticating comprises:

verifying the forwardable ticket.

6. The method of claim 3, further comprising:

receiving a security credential from the client, the security credential belonging to a user of the client;

verifying the security credential; and

generating the forwardable ticket when verifying the client is successful.

7. The method of claim 3, further comprising:

receiving a ticket-granting ticket from the client, the ticket-granting ticket sent by a second authentication server to the client based on the previous successful authentication;

generating the forwardable ticket; and

sending the forwardable ticket to the client, whereupon the client sends the forwardable ticket to the Web server.

8. The method of claim 7, further comprising:

receiving a security credential from the client, the security credential belonging to a user of the client;

verifying the security credential; and

generating the ticket-granting ticket when the verification is successful.

9. A method for use in a Web server for obtaining access to a secure server, in response to a request from a client for the access, without further intervention by the user of the client, the method comprising:

sending a request for the content to the secure server;

receiving an authentication challenge from the secure server in response to the request;

sending a forwardable ticket to an authentication server trusted by the secure server, the forwardable ticket previously sent to the Web server by the authentication server based on a successful authentication of the client by the authentication server;

receiving from the authentication server a ticket having a digital signature applied using a private key of a public-private key pair of the authentication server; and

sending the ticket to the secure server, wherein the secure server, upon verifying the digital signature using a public key of said public-private key pair corresponding to the private key of the authentication server, grants the access; and

wherein communications with the client employ a generic application-layer network protocol.

10. The method of claim 9, further comprising:

sending a forwardable challenge to the client in response to the request from the client, the forwardable challenge including the identity of an authentication server trusted by the Web server, wherein the authentication server authenticates the client and generates the forwardable ticket based on authenticating the client; and

receiving the forwardable ticket from the authentication server.

11. A method for use in an authentication server for obtaining access to a secure server for a client that has issued a request for the access, without further intervention by the user of the client, the method comprising:

receiving a forwardable ticket sent by a Web server in response to a challenge issued by the secure server in response to the request, the forward able ticket previously sent to the Web server by the authentication server based on a successful authentication of the client by the authentication server;

generating a ticket having a digital signature applied using a private key of a public-private key pair of the authentication server; and

wherein

the secure server, upon verifying the digital signature using a public key of said public-private key pair corresponding to the private key of the authentication server, grants the access; and

wherein

communications with the client employ a generic application-layer network protocol.

12. The method of claim 11, further comprising:

authenticating the client based on a previous successful authentication of the client before generating the ticket.

13. The method of claim 12, wherein authenticating comprises:

verifying the forwardable ticket.

14. The method of claim 11, further comprising:

receiving a security credential from the client, the security credential belonging to a user of the client;

verifying the security credential; and

generating the forwardable ticket when verifying the client is successful.

15. The method of claim 11, further comprising:

receiving a ticket-granting ticket from the client, the ticket-granting ticket sent by a second authentication server to the client based on the previous successful authentication;

generating the forwardable ticket; and

sending the forwardable ticket to the client, whereupon the client sends the forwardable ticket to the Web server.

16. The method of claim 15, further comprising:

receiving a security credential from the client, the security credential belonging to a user of the client;

verifying the security credential; and

generating the ticket-granting ticket when the verification is successful.

17. Computer-readable media embodying tangible digital code executable by a computer to perform a method for use in a Web server for obtaining content from a secure server, in response to a request from a client for the content, without further intervention by the user of the client, the method comprising:

sending a request for the content to the secure server;

receiving an authentication challenge from the secure server in response to the request;

sending a forwardable ticket to an authentication server trusted by the secure server, the forwardable ticket previously sent to the Web server by the authentication server based on a successful authentication of the client by the authentication server;

receiving from the authentication server a ticket having a digital signature applied using a private key of a public-private key pair of the authentication server; and

sending the ticket to the secure server, wherein the secure server, upon verifying the digital signature using a public key of said public-private key pair corresponding to the private key of the authentication server, provides the requested content; and

wherein

communications with the client employ a generic application-layer network protocol.

18. The media of claim 17, wherein the method further comprises:

sending a forwardable challenge to the client in response to the request from the client, the forwardable challenge including the identity of an authentication server trusted by the Web server, wherein the authentication server authenticates the client and generates the forwardable ticket based on authenticating the client; and

receiving the forwardable ticket from the authentication server.

19. Computer-readable media embodying tangible digital code executable by a computer to perform a method for use in an authentication server for obtaining content from a secure server for a client that has issued a request for the content from the secure server, without further intervention by the user of the client, the method comprising:

receiving a forwardable ticket sent by a Web server in response to a challenge issued by the secure server in response to the request, the forwardable ticket previously sent to the Web server by the authentication server based on a successful authentication of the client by the authentication server;

generating a ticket having a digital signature applied using a private key of a public-private key pair of the authentication server; and

wherein the secure server, upon verifying the digital signature using a public key of said public-private key pair corresponding to the private key of the authentication server, provides the requested content; and

wherein

communications with the client employ a generic application-layer network protocol.

20. The media of claim 19, wherein the method further comprises:

authenticating the client based on a previous successful authentication of the client before generating the ticket.

21. The media of claim 20, wherein authenticating comprises:

verifying the forwardable ticket.

22. The media of claim 19, wherein the method further comprises:

receiving a security credential from the client, the security credential belonging to a user of the client;

verifying the security credential; and

generating the forwardable ticket when verifying the client is successful.

23. The media of claim 19, wherein the method further comprises:

receiving a ticket-granting ticket from the client, the ticket-granting ticket sent by a second authentication server to the client based on the previous successful authentication;

generating the forwardable ticket; and

sending the forwardable ticket to the client, whereupon the client sends the forwardable ticket to the Web server.

24. The media of claim 23, wherein the method further comprises:

receiving a security credential from the client, the security credential belonging to a user of the client;

verifying the security credential; and

generating the ticket-granting ticket when the verification is successful.

25. Computer-readable media embodying tangible digital code executable by a computer to perform a method for use in a Web server for obtaining access to a secure server, in response to a request from a client for the access, without further intervention by the user of the client, the method comprising:

sending a request for the content to the secure server;

receiving an authentication challenge from the secure server in response to the request;

sending a forwardable ticket to an authentication server trusted by the secure server, the forwardable ticket previously sent to the Web server by the authentication server based on a successful authentication of the client by the authentication server;

receiving from the authentication server a ticket having a digital signature applied using a private key of a public-private key pair of the authentication server; and

sending the ticket to the secure server, wherein the secure server, upon verifying the digital signature using a public key of said public-private key pair corresponding to the private key of the authentication server, grants the access; and

wherein

communications with the client employ a generic application-layer network protocol.

26. The media of claim 25, wherein the method further comprises:

sending a forwardable challenge to the client in response to the request from the client, the forwardable challenge including the identity of an authentication server trusted by the Web server, wherein the authentication server authenticates the client and generates the forwardable ticket based on authenticating the client; and

receiving the forwardable ticket from the authentication server.

27. Computer-readable media embodying tangible digital code executable by a computer to perform a method for use in an authentication server for obtaining access to a secure server for a client that has issued a request for the access, without further intervention by the user of the client, the method comprising:

receiving a forwardable ticket sent by a Web server in response to a challenge issued by the secure server in response to the request, the forwardable ticket previously sent to the Web server by the authentication server based on a successful authentication of the client by the authentication server;

generating a ticket having a digital signature applied using a private key of a public-private key pair of the authentication server; and

wherein

the secure server, upon verifying the digital signature using a public key of said public-private key pair corresponding to the private key of the authentication server, grants the access; and

wherein

communications with the client employ a generic application-layer network protocol.

28. The media of claim 27, wherein the method further comprises:

authenticating the client based on a previous successful authentication of the client before generating the ticket.

29. The media of claim 28, wherein authenticating comprises:

verifying the forwardable ticket.

30. The media of claim 27, wherein the method further comprises:

receiving a security credential from the client, the security credential belonging to a user of the client;

verifying the security credential; and

generating the forwardable ticket when verifying the client is successful.

31. The media of claim 27, wherein the method further comprises:

receiving a ticket-granting ticket from the client, the ticket-granting ticket sent by a second authentication server to the client based on the previous successful authentication;

generating the forwardable ticket; and

sending the forwardable ticket to the client, whereupon the client sends the forwardable ticket to the Web server.

32. The media of claim 31, wherein the method further comprises:

receiving a security credential from the client, the security credential belonging to a user of the client;

verifying the security credential; and

generating the ticket-granting ticket when the verification is successful.

33. An apparatus for use in a Web server for obtaining content from a secure server, in response to a request from a client for the content, without further intervention by the user of the client, the apparatus comprising:

means for sending a request for the content to the secure server;

means for receiving an authentication challenge from the secure server in response to the request;

means for sending a forwardable ticket to an authentication server trusted by the secure server, the forwardable ticket previously sent to the Web server by the authentication server based on a successful authentication of the client by the authentication server;

means for receiving from the authentication server a ticket having a digital signature applied using a private key of a public-private key pair of the authentication server; and

means for sending the ticket to the secure server, wherein the secure server, upon verifying the digital signature using a public key of said public-private key pair corresponding to the private key of the authentication server, provides the requested content; and

wherein

communications with the client employ a generic application-layer network protocol.

34. The apparatus of claim 33, further comprising:

means for sending a forwardable challenge to the client in response to the request from the client, the forwardable challenge including the identity of an authentication server trusted by the Web server, wherein the authentication server authenticates the client and generates the forwardable ticket based on authenticating the client; and

means for receiving the forwardable ticket from the authentication server.

35. An apparatus for use in an authentication server for obtaining content from a secure server for a client that has issued a request for the content from the secure server, without further intervention by the user of the client, the apparatus comprising:

means for receiving a forwardable ticket sent by a Web server in response to a challenge issued by the secure server in response to the request, the forwardable ticket previously sent to the Web server by the authentication server based on a successful authentication of the client by the authentication server;

means for generating a ticket having a digital signature applied using a private key of a public-private key pair of the authentication server; and

wherein

the secure server, upon verifying the digital signature using a public key of said public-private key pair corresponding to the private key of the authentication server, provides the requested content; and

wherein

communications with the client employ a generic application-layer network protocol.

36. The apparatus of claim 35, further comprising:

means for authenticating the client based on a previous successful authentication of the client before generating the ticket.

37. The apparatus of claim 36, wherein means for authenticating comprises:

means for verifying the forwardable ticket.

38. The apparatus of claim 35, further comprising:

means for receiving a security credential from the client, the security credential belonging to a user of the client;

means for verifying the security credential; and

means for generating the forwardable ticket when verifying the client is successful.

39. The apparatus of claim 35, further comprising:

means for receiving a ticket-granting ticket from the client, the ticket-granting ticket sent by a second authentication server to the client based on the previous successful authentication;

means for generating the forwardable ticket; and

means for sending the forwardable ticket to the client, whereupon the client sends the forwardable ticket to the Web server.

40. The apparatus of claim 39, further comprising:

means for receiving a security credential from the client, the security credential belonging to a user of the client;

means for verifying the security credential; and

means for generating the ticket-granting ticket when the verification is successful.

41. An apparatus for use in a Web server for obtaining access to a secure server, in response to a request from a client for the access, without further intervention by the user of the client, the apparatus comprising:

means for sending a request for the content to the secure sewer;

means for receiving an authentication challenge from the secure server in response to the request;

means for sending a forwardable ticket to an authentication server trusted by the secure server, the forwardable ticket previously sent to the Web server by the authentication server based on a successful authentication of the client by the authentication server;

means for receiving from the authentication server a ticket having a digital signature applied using a private key of a public-private key pair of the authentication server; and

means for sending the ticket to the secure server, wherein the secure server, upon verifying the digital signature using a public key of said public-private key pair corresponding to the private key of the authentication server, grants the access; and

wherein

communications with the client employ a generic application-layer network protocol.

42. The apparatus of claim 41, further comprising:

means for sending a forwardable challenge to the client in response to the request from the client, the forwardable challenge including the identity of an authentication server trusted by the Web server, wherein the authentication server authenticates the client and generates the forwardable ticket based on authenticating the client; and

means for receiving the forwardable ticket from the authentication server.

43. An apparatus for use in an authentication server for obtaining access to a secure server for a client that has issued a request for the access, without further intervention by the user of the client, the apparatus comprising:

means for receiving a forwardable ticket sent by a Web server in response to a challenge issued by the secure server in response to the request, the forwardable ticket previously sent to the Web server by the authentication server based on a successful authentication of the client by the authentication server;

means for generating a ticket having a digital signature applied using a private key of a public-private key pair of the authentication server; and

wherein

the secure server, upon verifying the digital signature using a public key of said public-private key pair corresponding to the private key of the authentication server, grants the access; and

wherein

communications with the client employ a generic application-layer network protocol.

44. The apparatus of claim 43, further comprising:

means for authenticating the client based on a previous successful authentication of the client before generating the ticket.

45. The apparatus of claim 44, wherein means for authenticating comprises:

means for verifying the forwardable ticket.

46. The apparatus of claim 43, further comprising:

means for receiving a security credential from the client, the security credential belonging to a user of the client;

means for verifying the security credential; and

means for generating the forwardable ticket when verifying the client is successful.

47. The apparatus of claim 43, further comprising:

means for receiving a ticket-granting ticket from the client, the ticket-granting ticket sent by a second authentication server to the client based on the previous successful authentication;

means for generating the forwardable ticket; and

sending the forwardable ticket to the client, whereupon the client sends the forwardable ticket to the Web server.

48. The apparatus of claim 47, further comprising:

means for receiving a security credential from the client, the security credential belonging to a user of the client;

means for verifying the security credential; and

means for generating the ticket-granting ticket when the verification is successful.

49. At least one computer including a processor and one or more tangible digital storage media for programming the processor to execute a process for obtaining content from a secure server, in response to a request from a client for the content, without further intervention by the user of the client, the process comprising:

sending a request for the content to the secure server;

receiving an authentication challenge from the secure server in response to the request;

sending a forwardable ticket to an authentication server trusted by the secure server, the forwardable ticket previously sent to the Web server by the authentication server based on a successful authentication of the client by the authentication server;

receiving from the authentication server a ticket having a digital signature applied using a private key of a public-private key pair of the authentication server; and

sending the ticket to the secure server, wherein the secure server, upon verifying the digital signature using a public key of said public-private key pair corresponding to the private key of the authentication server, provides the requested content; and

wherein

communications with the client employ a generic application-layer network protocol.

50. The computer of claim 49, wherein the process further comprises:

sending a forwardable challenge to the client in response to the request from the client, the forwardable challenge including the identity of an authentication server trusted by the Web server, wherein the authentication server authenticates the client and generates the forwardable ticket based on authenticating the client; and

receiving the forwardable ticket from the authentication server.

51. At least one computer including a processor and one or more tangible digital storage media for programming the processor to execute a process for obtaining content from a secure server for a client that has issued a request for the content from the secure server, without further intervention by the user of the client, the process comprising:

receiving a forwardable ticket sent by a Web server in response to a challenge issued by the secure server in response to the request, the forwardable ticket previously sent to the Web server by the authentication server based on a successful authentication of the client by the authentication server;

generating a ticket having a digital signature applied using a private key of a public-private key pair of the authentication server; and

wherein

the secure server, upon verifying the digital signature using a public key of said public-private key pair corresponding to the private key of the authentication server, provides the requested content; and

wherein

communications with the client employ a generic application-layer network protocol.

52. The computer of claim 51, wherein the process further comprises:

authenticating the client based on a previous successful authentication of the client before generating the ticket.

53. The computer of claim 52, wherein authenticating comprises:

verifying the forwardable ticket.

54. The computer of claim 51, wherein the process further comprises:

receiving a security credential from the client, the security credential belonging to a user of the client;

verifying the security credential; and

generating the forwardable ticket when verifying the client is successful.

55. The computer of claim 51, wherein the process further comprises:

receiving a ticket-granting ticket from the client, the ticket-granting ticket sent by a second authentication server to the client based on the previous successful authentication;

generating the forwardable ticket; and

sending the forwardable ticket to the client, whereupon the client sends the forwardable ticket to the Web server.

56. The computer of claim 55, wherein the process further comprises:

receiving a security credential from the client, the security credential belonging to a user of the client;

verifying the security credential; and

generating the ticket-granting ticket when the verification is successful.

57. At least one computer including a processor and one or more tangible digital storage media for programming the processor to execute a process for obtaining access to a secure server, in response to a request from a client for the access, without further intervention by the user of the client, the process comprising:

sending a request for the content to the secure server;

receiving an authentication challenge from the secure server in response to the request;

sending a forwardable ticket to an authentication server trusted by the secure server, the forwardable ticket previously sent to the Web server by the authentication server based on a successful authentication of the client by the authentication server

receiving from the authentication server a ticket having a digital signature applied using a private key of a public-private key pair of the authentication server; and

sending the ticket to the secure server, wherein the secure server, upon verifying the digital signature using a public key of a public-private key pair corresponding to the private key of the authentication server, grants the access; and

wherein

communications with the client employ a generic application-layer network protocol.

58. The computer of claim 57, wherein the process further comprises:

sending a forwardable challenge to the client in response to the request from the client, the forwardable challenge including the identity of an authentication server trusted by the Web server, wherein the authentication server authenticates the client and generates the forwardable ticket based on authenticating the client; and

receiving the forwardable ticket from the authentication server.

59. At least one computer including a processor and one or more tangible digital storage media for programming the processor to execute a process for obtaining access to a secure server for a client that has issued a request for the access, without further intervention by the user of the client, the process comprising:

receiving a forwardable ticket sent by a Web server in response to a challenge issued by the secure server in response to the request, the forwardable ticket previously sent to the Web server by the authentication server based on a successful authentication of the client by the authentication server;

generating a ticket having a digital signature applied using a private key of a public-private key pair of the authentication server; and

wherein

the secure server, upon verifying the digital signature using a public key of a public-private key pair corresponding to the private key of the authentication server, grants the access; and

wherein

communications with the client employ a generic application-layer network protocol.

60. The computer of claim 59, wherein the process further comprises:

authenticating the client based on a previous successful authentication of the client before generating the ticket.

61. The computer of claim 60, wherein authenticating comprises:

verifying the forwardable ticket.

62. The computer of claim 59, wherein the process further comprises:

receiving a security credential from the client, the security credential belonging to a user of the client;

verifying the security credential; and

generating the forwardable ticket when verifying the client is successful.

63. The computer of claim 59, wherein the process further comprises:

receiving a ticket-granting ticket from the client, the ticket-granting ticket sent by a second authentication server to the client based on the previous successful authentication;

generating the forwardable ticket; and

sending the forwardable ticket to the client, whereupon the client sends the forwardable ticket to the Web server.

64. The computer of claim 63 wherein the process further comprises:

receiving a security credential from the client, the security credential belonging to a user of the client;

verifying the security credential; and

generating the ticket-granting ticket when the verification is successful.