System and method for authentication to an application

• US 7,356,697 B2
• Filed: 06/20/2003
• Issued: 04/08/2008
• Est. Priority Date: 06/20/2003
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Barnabo, Christopher E., Greenlee, Gordan G.
• Primary Examiner(s): Barrón, Jr.; Gilberto
• Assistant Examiner(s): Cervetti; David Garcia
• Application Number:
  US10/600,215
• Publication Number:
  US 20040260925A1
• Time in Patent Office: 1,754 Days
• Field of Search: 713/168
• US Class Current: 713/168
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

Authenticating a first user in a protected network to an application in a DMZ network shared simultaneously with a second user in an unprotected network. The first user supplies a userID and a password to a first server within the protected network for authentication for the application. The first sewer checks authentication of the first user based on the userID and password. If the first user is authentic, the first server forwards to the application an authentication key for the first user and a selection by the first user pertaining to the application. The application checks authentication of the key, and if authentic, complies with the selection by the first user. The second user supplies another userID and another password to the application. If the other userID and other password are authentic, the application complies with a selection made by the second user pertaining to the application.

Claims

1. A method for authenticating a first user in a protected network to an application shared concurrently with a second user in an unprotected network, said method comprising the steps of:

the first user supplying a userID and a password to a first server within said protected network for authentication for said application, said application residing in a third network configured as a buffer between said protected network and said unprotected network;

said first server determining that said userID and password are authentic, and in response, said first server forwarding to said application an authentication key for said first user and a selection by said first user pertaining to said application, said password not being sent from said protected network into said third network to access said application;

said application determining that said key is authentic, and in response, said application complying with said selection by said first user; and

said second user supplying another userID and another password to said application, said application determining that said other userID and said other password are authentic, and in response, said application complying with a selection made by said second user pertaining to said application.

2. A method as set forth in claim 1 wherein said application complies with said selection made by said second user without said second user supplying an authentication key to said third network.

3. A method as set forth in claim 1 wherein said protected network and said third network are both controlled by a same entity.

4. A method as set forth in claim 3 wherein said unprotected network is an Internet.

5. A method as set forth in claim 1 wherein said third network is a Demilitarized Zone (“

DMZ”

) network and acts as a security buffer for said protected network.

6. A method as set forth in claim 1 wherein said unprotected network is an Internet.

7. A method as set forth in claim 1 wherein said selection by said first user is a request to said application, and said selection by said second user is a request to said application.

8. A method as set forth in claim 1 wherein said application is an electronic meeting application, both said first user and said second user concurrently participate in a same meeting, and said first user selects a screen that is concurrently presented to both said first user and said second user.

9. A method as set forth in claim 8 wherein said selection by said first user is a selection of an electronic meeting in which to participate.

10. A method as set forth in claim 1 further comprising the step of said application sending to said first server said authentication key before the step of said first server forwarding to said application said authentication key.

11. A method as set forth in claim 1 wherein said authentication key is self authenticating based on whether a period during which the key is valid matches a scheduled period of use of said application, and whether an IP address of said first user is from said protected network.

12. An authentication system comprising:

an application on a first server in a first network;

a second server in a second, protected network to receive from a first user within said second network a userID and a password for authentication for said application, said second server including means for checking authentication of said first user based on said userID and password, and if said first user is authentic, forwarding to said application an authentication key for said first user and a selection by said first user pertaining to said application, said password not being sent from said protected network into said first network to access said application; and

said application including means for checking authentication of said key, and if authentic, complying with said selection by said first user; and

a workstation in a third, unprotected network for a second user, said application being shared concurrently with said first and second users, said first network configured as a buffer between said second, protected network and said third, unprotected network; and

wherein

said application receives from said second user another userID and another password, and includes means for determining that said other userID and other password are authentic, and in response, complying with a selection made by said second user pertaining to said application.

13. A system as set forth in claim 12 wherein said application complies with said selection made by said second user without said second user supplying an authentication key to said first network.

14. A system as set forth in claim 12 wherein said first and second servers and said first and second networks are all controlled by a same entity.

15. A system as set forth in claim 12 wherein said first network is a Demilitarized Zone (“

DMZ”

) network and acts as a security buffer for said protected network.

16. A system as set forth in claim 12 wherein said unprotected network is an Internet.

17. A computer program product for authenticating a first user in a protected network to an application shared simultaneously with a second user in an unprotected network, and authenticating said second user to said application, said program product comprising:

a computer readable medium;

first program instructions, for execution on a first server within said protected network, to receive from the first user a userID and a password for authentication for said application, said application residing in a third network configured as a security buffer between said protected network and said unprotected network;

second program instructions, for execution on said first server, to check authentication of said first user based on said userID and password, and if said first user is authentic, to forward to said application an authentication key for said first user and a selection by said first user pertaining to said application, said password not being sent from said protected network into said third network to access said application;

third program instructions in said application to check authentication of said key, and if authentic, comply with said selection by said first user;

fourth program instructions in said application to receive from said second user another userID and another password, determine if said other userID and other password are authentic, and if so, instruct said application to comply with a selection made by said second user pertaining to said application; and

wherein

said first, second, third and fourth program instructions are recorded on said medium in functional form.

18. A computer program product as set forth in claim 17 wherein said application complies with said selection made by said second user without said second user supplying an authentication key to said third network.

19. A method for authenticating a first user of a first computer in a protected network to a second computer executing an application, a second user of a third computer in an unprotected network and said first user of said first computer concurrently sharing said application, said second computer residing in a third network configured as a buffer between said protected network and said unprotected network;

said method comprising the steps of;

the first computer supplying a userID and a password of the first user to a fourth computer in said protected network for authentication for said application;

said fourth computer determining that said userID and password are authentic, and in response, forwarding to said second computer an authentication key for said first user, said password not being sent from said protected network into said third network to access said application;

said second computer determining that said key is authentic, and in response, complying with a selection by said first user pertaining to said application; and

said third computer supplying another userID and another password of said second user to said second computer, said second computer determining that said other userID and said other password are authentic, and in response, said application complying with a selection made by said second user pertaining to said application.

20. A method as set forth in claim 19 wherein said application complies with said selection made by said second user without said second user or said third computer supplying an authentication key to said second computer or said third network.

21. A method as set forth in claim 19 wherein said protected network and said third network are both controlled by a same entity.

22. A method as set forth in claim 19 wherein said third network acts as a security buffer for said protected network.