Authenticating a requestor without providing a key

• US 8,015,243 B2
• Filed: 07/07/2008
• Issued: 09/06/2011
• Est. Priority Date: 11/12/2004
• Status: Expired due to Fees

• Current Assignee: Digital Reasoning Systems, Inc (Smarsh Incorporated)
• Original Assignee: International Business Machines Corporation
• Inventors: Frazier, Giles R., Pfister, Gregory F., Brey, Thomas M., Rooney, William J.
• Primary Examiner(s): Backer; Firmin
• Assistant Examiner(s): EDWARDS, JAMES A
• Application Number:
  US12/168,201
• Publication Number:
  US 20080271133A1
• Time in Patent Office: 1,156 Days
• Field of Search: 709/225
• US Class Current: 709/203
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

A method for authenticating a requesting entity in a communications environment. In an exemplary embodiment, the method includes determining a client identification of a client node associated with the requesting entity, and determining whether the requesting entity associated with the client node is acting in a supervisor capacity. A key to the requesting entity is returned from a resource provider node upon determining that the client identification of the client node indicates that the client node is permitted to access one or more resources of the provider node, and that the client node is acting in a supervisor capacity.

Claims

1. A tangible, non-transitory computer readable storage medium having computer readable instructions stored thereon that, when executed by a computer, implement a method for authenticating a requesting entity in a subnet communications environment, the method further comprising:

determining a client identification of a client node associated with the requesting entity by receiving a source identifier from the requesting entity and associating the source identifier with one or more permanent identifiers of the client node, wherein the source identifier is a source logical identifier (SLID), and the one or more permanent identifiers are one or more globally unique identifiers (GUID) of the client node;

determining whether the requesting entity associated with the client node is acting in a supervisor capacity by defining a supervisor only privileged key for each client node in the communications environment, and by determining whether a connection request received from the requested entity includes the supervisor only privileged key corresponding to the client node of the requesting entity; and

returning, from a resource provider node, a key to the requesting entity upon determining that the client identification of the client node indicates that the client node is permitted to access one or more resources of the provider node, and that the client node is acting in a supervisor capacity;

wherein the associating the SLID with one or more globally unique identifiers (GUID) of the client node further comprises;

forwarding the SLID to a subnet administrator; and

receiving, from the subnet administrator, the one or more GUIDs corresponding to the SLID.

2. The computer readable storage medium of claim 1, wherein the method further comprises maintaining a first table within the resource provider node, the first table associating accessible resources for each of a plurality of known GUIDs.

3. The computer readable storage medium of claim 2, wherein the method further comprises maintaining a second table within the resource provider node, the second table associating GUIDs to SLIDs.

4. The computer readable storage medium of claim 3, wherein the method further comprises maintaining a third table in the resource provider node, the third table comprising an association of keys for each GUID known to the resource provider node.