Method and apparatus for detecting grid intrusions

• US 7,380,129 B2
• Filed: 04/22/2004
• Issued: 05/27/2008
• Est. Priority Date: 04/22/2004
• Status: Expired due to Fees

• Current Assignee: Trend Micro Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Shieh, Johnny Meng-Han, Keohane, Susann Marie, McBrearty, Gerald Francis, Mullen, Shawn Patrick, Murillo, Jessica Kelley
• Primary Examiner(s): JUNG, DAVID YIUK
• Application Number:
  US10/829,856
• Publication Number:
  US 20050240777A1
• Time in Patent Office: 1,496 Days
• Field of Search: 713/185, 713/150, 713/153
• US Class Current: 713/185
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

A method, apparatus, and computer instructions for authorizing a user to access grid resources. A request is received from the user to access a resource on the data processing system. This request includes a certificate. An authentication process is performed using the certificate when the request is received. In response to successfully authenticating the user in the authentication process, a first host name for the certificate is requested from a trusted source. A reply containing the first host name is received. Access to the resource is provided if the first host name returned by the trusted source matches a second host name for the user from which the request originated.

Claims

1. A method in a data processing system for authorizing a user to access grid resources, the method comprising:

receiving a request from the user to access a resource on the data processing system, wherein the request includes a certificate;

responsive to receiving the request, performing an authentication process using the certificate;

responsive to successfully authenticating the user in the authentication process, requesting a first host name for the certificate from a trusted source; and

responsive to receiving the first host name, providing access to the resource if the first host name returned by the trusted source matches a second host name for the user from which the request originated.

2. The method of claim 1, wherein the trusted source is a certificate authority.

3. The method of claim 1 further comprising:

responsive to successfully authenticating the user in the authentication process, requesting a revocation list from the trusted source;

determining whether the certificate has been revoked using the revocation list; and

preventing access to the resource if the certificate has been revoked.

4. The method of claim 1, wherein the certificate is a proxy certificate, wherein the proxy certificate is valid only for a selected period of time.

5. The method of claim 1, wherein the first host name is for a client data processing system for the user and is registered with the trusted source when the certificate is issued.

6. The method of claim 1, wherein the certificate is an X.509 certificate.

7. The method of claim 1, wherein the access to the resource is to run a task on the data processing system.

8. The method of claim 1, wherein the data processing system is part of a grid.