Dynamic cache lookup based on dynamic data

• US 7,752,452 B2
• Filed: 02/02/2009
• Issued: 07/06/2010
• Est. Priority Date: 06/30/2004
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Chao, Ching-Yun, Birk, Peter Daniel, Chung, Hyen Vui
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Powers; William S
• Application Number:
  US12/364,207
• Publication Number:
  US 20090138951A1
• Time in Patent Office: 519 Days
• Field of Search: 726/2, 726/8, 713/185
• US Class Current: 713/185
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

A system and method for tracking user security credentials in a distributed computing environment. The security credentials of an authenticated user includes not just his unique user identifier, but also a set of security attributes such as the time of authentication, the location where the user is authenticated (i.e., intranet user v. internet user), the authentication strength, and so on. The security attributes are used in access control decisions. The same user can be given different authorization if he has a different security attribute value. Security credentials may be generated either by WebSphere security code or by third party security provider code. This invention stores the user credentials in a distributed cache and provides a system and method to compute the unique key based on the dynamic security credentials for cache lookup.

Claims

1. A system for authenticating a user, comprising:

a server in a computer network, the server comprising;

means for receiving an access request by a login user;

means for authenticating the login user based on security credentials forwarded by the login user and for sending a token back to the login user, wherein the token comprises a single-sign on token and contains the security credentials forwarded by the login user;

means for receiving a later access request by the login user, the later access request including the token;

means for generating a unique lookup key using the token, the unique lookup key comprising a one-way hash of unique security attributes, wherein the unique security attributes comprises static security attributes including an accessID, and dynamic security attributes including a login time and a login location, and wherein the dynamic security attributes are selected based on a login module;

means for using the generated unique lookup key to find security credentials of the login user in a distributed cache; and

means for granting the later access request by granting access rights to the login user according to the security credentials in the distributed cache, wherein the security credentials in the distributed cache vary according to both the static security attributes and the dynamic security attributes such that the login user having the same static security attributes is granted different access rights according to differences in the dynamic security attributes.

2. The system of claim 1, wherein the server further comprises:

means for providing the login module with the dynamic security attributes.

3. The system of claim 1, wherein the server further comprises:

means for simultaneously logging the accessID into the network as two different login users based on the dynamic security attributes.

4. A computer program product in a tangible computer readable storage medium, the computer program product comprising:

first instructions for a server in a computer network to receive an access request by a login user;

second instructions for the server to authenticate the login user based on security credentials forwarded by the login user and to send a token back to the login user, wherein the token comprises a single-sign on token and contains the security credentials forwarded by the login user;

third instructions for the server to receive a later access request by the login user, the later access request including the token;

fourth instructions for the server to generate a unique lookup key using the token, the unique lookup key comprising a one-way hash of unique security attributes, wherein the unique security attributes comprises static security attributes including an accessID, and dynamic security attributes including a login time and a login location, and wherein the dynamic security attributes are selected based on a login module;

fifth instructions for the server to use the generated unique lookup key to find security credentials of the login user in a distributed cache; and

sixth instructions for the server to grant the later access request by granting access rights to the login user according to the security credentials in the distributed cache, wherein the security credentials in the distributed cache vary according to both the static security attributes and the dynamic security attributes, such that the login user having the same static security attributes is granted different access tights according to differences in the dynamic security attributes.

5. The computer program product of claim 4, further comprising:

seventh instructions for providing the login module with the dynamic security attributes.

6. The computer program product of claim 4, wherein the accessID is simultaneously logged into the network as two different login users based on the dynamic security attributes.

7. A method of caching authentication data on a computer network, comprising the steps of:

receiving a first access request by a third party security provider from a login user;

collecting, by the third party security provider, authentication data including static security attributes and flint dynamic security attributes from the login user;

authenticating, by the third party security provider, the login user based on the authentication data and the first dynamic security attributes;

granting the first access request by granting first access rights to the login user;

creating by a login module a plurality of tokens including a single-sign on token based on the authentication data and the first dynamic security attributes received by the login module; and

creating by the login module a unique key for a distributed cache lookup based on a one-way hash of unique security attributes comprising the static security attributes and the first dynamic security attributes;

receiving a second access request from the login user including the static security attributes and second dynamic security attributes that differ from the first dynamic security attributes;

using the unique key to find security credentials of the login user in the distributed cache; and

granting the second access request to the login user by granting second access rights that differ from the first access rights based on differences between the first dynamic security attributes and The second dynamic security attributes.

8. The method of claim 7, wherein the third party security provider comprises a reverse proxy server.

9. The method of claim 7, wherein the dynamic security attributes include a time of login and a location.

10. The method of claim 7, wherein the plurality of the tokens represent the authentication data and The dynamic security attributes of the login user.

11. The method of claim 7, further comprising:

sending the single-sign on token comprising the unique key back to the login user in response to the granting of the first access request.

12. The method of claim 7, wherein said first dynamic security attributes include a first login time and a first login location, and the second dynamic security attributes include a second login time and a second login location.