Method and system for authenticating a requestor without providing a key

• US 7,437,447 B2
• Filed: 11/12/2004
• Issued: 10/14/2008
• Est. Priority Date: 11/12/2004
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Pfister, Gregory F., Brey, Thomas M., Rooney, William J., Frazier, Giles R.
• Primary Examiner(s): Hu; Jinsong
• Application Number:
  US10/987,280
• Publication Number:
  US 20060117103A1
• Time in Patent Office: 1,432 Days
• Field of Search: 709/223, 709/224, 709/225, 709/226, 380/228, 380/229, 713/171, 726/17, 726/21
• US Class Current: 709/223
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

A method for authenticating a requesting entity in a communications environment. In an exemplary embodiment, the method includes determining a client identification of a client node associated with the requesting entity, and determining whether the requesting entity associated with the client node is acting in a supervisor capacity. A key to the requesting entity is returned from a resource provider node upon determining that the client identification of the client node indicates that the client node is permitted to access one or more resources of the provider node, and that the client node is acting in a supervisor capacity.

Claims

1. A method for authenticating a requesting entity in a subnet communications environment, the method comprising:

determining a client identification of a client node associated with the requesting entity by receiving a source identifier from said requesting entity and associating said source identifier with one or more permanent identifiers of said client node, wherein said source identifier is a source logical identifier (SLID), and said one or more permanent identifiers are one or more globally unique identifiers (GUID) of said client node;

determining whether the requesting entity associated with said client node is acting in a supervisor capacity by defining a supervisor only privileged key for each client node in the communications environment, and by determining whether a connection request received from said requested entity includes said supervisor only privileged key corresponding to said client node of said requesting entity; and

returning, from a resource provider node, a key to said requesting entity upon determining that said client identification of said client node indicates that said client node is permitted to access one or more resources of said provider node, and that said client node is acting in a supervisor capacity;

wherein said associating said SLID with one or more globally unique identifiers (GUID) of said client node further comprises;

forwarding said SLID to a subnet administrator; and

receiving, from said subnet administrator, said one or more GUIDs corresponding to said SLID.

2. The method of claim 1, further comprising maintaining a first table within said resource provider node, said first table associating accessible resources for each of a plurality of known GUIDs.

3. The method of claim 2, further comprising maintaining a second table within said resource provider node, said second table associating GUIDs to SLIDs.

4. The method of claim 3, further comprising maintaining a third table in said resource provider node, said third table comprising an association of keys for each GUID known to said resource provider node.