Cross domain authentication and security services using proxies for HTTP access

• US 7,370,351 B1
• Filed: 03/22/2001
• Issued: 05/06/2008
• Est. Priority Date: 03/22/2001
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: Novell Incorporated (Open Text Corporation)
• Inventors: Doshi, Kshitij Arun, Ramachandran, Viyyokaran Raman, Sitaram, Dinkar
• Primary Examiner(s): JUNG, DAVID YIUK
• Application Number:
  US09/815,454
• Time in Patent Office: 2,602 Days
• Field of Search: 713 20-202, 726/2, 726/8, 726/5, 726/4, 726/11, 726/3
• US Class Current: 726/8
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

Two identity spaces form a federation by agreeing to use a secret key to facilitate secure access of resources between them. When one identity space receives a request for a resource from a user in the other identity space, the first identity space checks to see if the resource is protected. If the resource is protected, the first identity space requests that a mediator in the second identity space authenticate the external user. The mediator verifies the external user'"'"'s authenticity. Once the external user is authenticated, the mediator securely informs the first identity space, using the secret key, that the external user is authenticated to access the resource. The identity space then grants the user access to the resource if the user is allowed access as per the access control policy of the identity space.

Claims

1. A cross-domain authentication apparatus, the apparatus comprising:

a first computer on a first domain and a second computer on a second domain;

a network connecting the first and second computers;

a secret shared between the first and second computers; and

a federation access policy identifying access permission on the first computer on the first domain for a user local to the second computer on the second domain over the network.

2. A cross-domain authentication apparatus according to claim 1, wherein the first domain is different from the second domain.

3. A cross-domain authentication apparatus according to claim 1, wherein the second domain includes means for authenticating the user local to the second computer.

4. An apparatus according to claim 1, the apparatus further comprising an HTTP reverse proxy coupled to the first computer, the proxy designed to request an authentication challenge of the user from the second computer.

5. An apparatus according to claim 4, the apparatus further comprising an HTTP forward proxy coupled to the second computer designed to respond to the authentication challenge for the user and forward the authentication to the reverse proxy.

6. An apparatus according to claim 5, wherein the response to the authentication challenge includes an encrypted response keyed to the shared secret.

7. An apparatus according to claim 1, the apparatus further comprising a security module designed to implement the federation access policy.

8. An apparatus according to claim 1, wherein:

the federation access policy includes an access for a role identity; and

the apparatus further comprises an identity mapping from the user to the role identity.

9. An apparatus according to claim 8, wherein the identity mapping is designed to enable access to a resource on the first computer across different formats and encodings of user names.

10. An apparatus according to claim 1, the apparatus further comprising an access control entry in the federation access policy designed to enable access to a resource on the first computer by a user on the second computer.

11. An apparatus according to claim 10, wherein the federation access policy is designed to permit a second user on the first computer to define the access control entry without requiring assistance from an administrator.

12. An apparatus according to claim 11, wherein the access control entry includes a permission for the user on the second computer that is equal to or less than a permission available to the second user on the first computer.

13. An apparatus according to claim 10, wherein the access control entry refers to a public key certificate for the user on the second computer whose access is controlled by the access control entry.

14. An apparatus according to claim 13, wherein the apparatus further comprises means for automatically retrieving from the second computer the public key certificate for the user on the second computer without human intervention.

15. An apparatus according to claim 14, wherein the means for automatically retrieving includes a background mutual authenticator operable through a Secure Sockets Layer (SSL) protocol.

16. An apparatus according to claim 10, wherein the federation access policy is designed to permit a second user on the first computer to remove or modify the access control entry, the second user having a privilege to remove or modify the access control entry.

17. An apparatus according to claim 16, wherein the second user is the user who defined the access control entry.

18. An apparatus according to claim 6, wherein the access control entry is designed to enable access to the resource on the first computer across different formats and encodings of user names.

19. An apparatus according to claim 1, wherein the federation access policy includes a resource to which the user is permitted access.

20. An apparatus according to claim 1, the apparatus further comprising a temporary data file indicating that the user has been properly authenticated.

24. A method according to claim 17, wherein receiving a request includes:

receiving the request at a forward proxy coupled to the second computer; and

forwarding the request to a reverse proxy on the first computer.

25. A method according to claim 17, wherein receiving a request includes requesting the resource by the user from the second computer.

26. A method according to claim 17, wherein challenging the user includes sending a challenge authentication from the first computer to the second computer.

29. A method according to claim 24, wherein authenticating the user includes authenticating the user using the mediator.

30. A method according to claim 29, wherein authenticating the user further includes sending from the forward proxy a keyed hash response to the challenge authentication using a shared secret between the first computer and second computer.

31. A method according to claim 17, the method further comprising negotiating a session secret key needed for encrypting or integrity protecting the response to the access request.

32. A method according to claim 31, wherein accessing the resource includes encrypting a response using the negotiated session secret key.

33. A method according to claim 32, wherein encrypting a response includes encrypting the response using the session secret key at a reverse proxy of the first computer before sending the response to a forward proxy of the second computer over the network.

37. A method according to claim 31, wherein accessing the resource includes integrity-verifying the response at a forward proxy of the second computer before sending the response to the user at the second computer.

38. A method according to claim 17, wherein accessing the resource includes accessing the resource from the first computer over the network.

39. A method according to claim 17, wherein accessing the resource includes determining whether the user has permission to access the resource.

40. A method according to claim 39, wherein determining whether the user has permission includes checking a federation access policy to determine whether the user has permission to access the resource.

45. A method according to claim 17, wherein authenticating the user includes authenticating the user using a third party as a mediator.

46. A method according to claim 45, wherein accessing the resource with the second computer includes maintaining channel integrity between the first computer and the second computer over the network.

47. A method according to claim 17, wherein decrypting or integrity verifying the access response at the forward proxy of the second computer network is done before the response is sent to user at the second computer network.

48. A computer-readable medium containing a program to perform cross domain authentication on a computer system, the program being executable on the computer system to implement the method of claim 17.

21. A method for performing cross domain authentication, the method comprising:

receiving a request for a resource on a first computer on a first domain from a user local to a second computer on a second domain over a network;

challenging the user to be authenticated;

authenticating the user in the second domain;

informing the first computer on the first domain that the user is authenticated in the second domain; and

accessing the resource from the first computer on the first domain using the second computer on the second domain.

22. A method according to claim 21, wherein authenticating the user includes authenticating the user at the second computer.

23. A method according to claim 22, wherein informing the first computer includes returning the authentication to the first computer.

27. A method according to claim 22, wherein sending a challenge authentication includes sending a challenge authentication from a reverse proxy at the first computer to a forward proxy at the second computer.

28. A method according to claim 22, wherein sending a challenge authentication from a reverse proxy includes redirecting the user to a mediator coupled to a forward proxy at the second computer.

34. A method according to claim 28, wherein accessing the resource includes decrypting the response at a forward proxy of the second computer before sending the response to the user at the second computer.

35. A method according to claim 27, wherein accessing the resource includes integrity-protecting a response using the session secret key.

36. A method according to claim 35, wherein integrity-protecting a response includes integrity-protecting the response using the session secret key at a reverse proxy of the first computer before sending the response to a forward proxy of the second computer over the network.

41. A method according to claim 36, wherein checking a federation access policy includes:

using an identity mapping in the federation access policy to map the user to a local identity; and

checking that the local identity is permitted to access the resource.

42. A method according to claim 41, wherein using an identity mapping includes using the identity mapping in the federation access policy to map the user to the local identity, allowing for different formats and encodings of user names between the first and second computers.

43. A method according to claim 36, wherein checking a federation access policy includes using an access control entry in the federation access policy to determine if the user is permitted to access the resource.

44. A method according to claim 43, wherein using an access control entry includes using the access control entry in the federation access policy to determine if the user is permitted to access the resource, allowing for different formats and encodings between the first and second computers.