Methods, devices, and computer program products for discovering authentication servers and establishing trust relationships therewith

• US 8,220,032 B2
• Filed: 01/29/2008
• Issued: 07/10/2012
• Est. Priority Date: 01/29/2008
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Brenneman, Robert J., Browne, Michael E., Huie, William J., Sheppard, Sarah J., Smith, Kyle M.
• Primary Examiner(s): Flynn, Nathan
• Assistant Examiner(s): Su, Sarah
• Application Number:
  US12/021,559
• Publication Number:
  US 20090193508A1
• Time in Patent Office: 1,624 Days
• Field of Search: 726/2, 726/3, 726/4, 726/5, 726/9, 726/26, 726/27, 726/29, 705/64, 705/65, 709/223, 709/225
• US Class Current: 726/3
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services

Abstract

Using an authentication server to discover one or more additional authentication servers and to dynamically establish a trust relationship with the one or more additional authentication servers. The authentication server searches for the one or more additional authentication servers to discover one or more sources of authentication tokens, and inspects an incoming authentication request from the one or more additional authentication servers to determine if the request is carrying one or more authentication tokens from a newly discovered realm. Once the authentication server determines a newly discovered realm to be trustworthy, the authentication server receives a directory schema from the newly discovered realm and compares the received directory schema with a known directory schema retrieved by the authentication server to identify an intersection of the received directory schema and the known directory schema. The authentication server uses the intersection to identify a primary key, and to identify any unique information that is specific to either the authentication server or the newly discovered realm.

Claims

1. A method for dynamically establishing a trust relationship between authentication servers, the method comprising:

initiating by, a first authentication server, searching for one or more additional authentication servers for the purpose of discovering one or more sources of authentication tokens, the searching comprising a processor node of the first authentication server initiating a communication exchange with at least one other processor node of the one or more additional authentication servers, and inspecting an incoming authentication request from the one or more additional authentication servers to determine if the incoming authentication request is carrying one or more authentication tokens from a newly discovered realm, wherein the first authentication server and the one or more additional authentication servers include one or more processing devices;

responsive to the request carrying one or more authentication tokens from the newly discovered realm, determining, by the first authentication server, whether or not the newly discovered realm is trustworthy by initiating communications with at least one trusted authentication server with respect to the first authentication server to ascertain whether or not there is an existing trust relationship between the at least one trusted authentication server and the newly discovered realm;

responsive to an existing trust relationship between the at least one trusted authentication server and the newly discovered realm, the first authentication server determining that the newly discovered realm is trustworthy;

responsive to a trust relationship not existing between the at least one trusted authentication server and the newly discovered realm, the first authentication server determining that the newly discovered realm is not yet trustworthy, with the first authentication server making one or more attempts to use a plurality of additional authentication tokens to validate information provided by the newly discovered realm before accepting any authentications from the newly discovered realm;

responsive to receiving a plurality of correct authentication tokens from the newly discovered realm, the first authentication server then determining that the newly discovered realm is trustworthy;

responsive to the first authentication server determining the newly discovered realm to be trustworthy, receiving a directory schema from the newly discovered realm and comparing the received directory schema with a known directory schema retrieved by the first authentication server to identify an intersection of the received directory schema and the known directory schema;

the first authentication server using the intersection to identify a primary key, and to identify any unique information that is specific to either the first authentication server or the newly discovered realm.

2. The method of claim 1 wherein the incoming authentication request includes authentication data associated therewith.

3. The method of claim 2 wherein the authentication data includes an authentication token of the one or more authentication tokens from the newly discovered realm that the first authentication server cannot validate.

4. The method of claim 3 further comprising the first authentication server passing the incoming authentication request to the one or more additional servers of the newly discovered realm.

5. The method of claim 1 wherein the first authentication server searches for the one or more additional authentication servers using a service discovery method.

6. The method of claim 1 further comprising, subsequent to the first authentication server inspecting the incoming authentication request, adding the newly discovered realm to a discovery list.

7. A computer program product including a non-transitory storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for facilitating a method for dynamically establishing a trust relationship between authentication servers, the method comprising:

initiating by, a first authentication server, searching for the one or more additional authentication servers for the purpose of discovering one or more sources of authentication tokens, the searching comprising a processor node of the first authentication server initiating a communication exchange with at least one other processor node of the one or more additional authentication servers, and inspecting an incoming authentication request from the one or more additional authentication servers to determine if the incoming authentication request is carrying one or more authentication tokens from a newly discovered realm;

responsive to the request carrying one or more authentication tokens from the newly discovered realm, determining, by the first authentication server, determining whether or not the newly discovered realm is trustworthy by initiating communications with at least one trusted authentication server with respect to the first authentication server to ascertain whether or not there is an existing trust relationship between the at least one trusted authentication server and the newly discovered realm;

responsive to an existing trust relationship between the at least one trusted authentication server and the newly discovered realm, the first authentication server determining that the newly discovered realm is trustworthy;

responsive to a trust relationship not existing between the at least one trusted authentication server and the newly discovered realm, the authentication server determining that the newly discovered realm is not yet trustworthy, with the first authentication server making one or more attempts to use a plurality of additional authentication tokens to validate information provided by the newly discovered realm before accepting any authentications from the newly discovered realm;

responsive to receiving a plurality of correct authentication tokens from the newly discovered realm, the authentication server the determining that the newly discovered realm is trustworthy;

responsive to the first authentication server determining the newly discovered realm to be trustworthy, receiving a directory schema from the newly discovered realm and comparing the received directory schema with a known directory schema retrieved by the first authentication server to identify an intersection of the received directory schema and the known directory schema;

the first authentication server using the intersection to identify a primary key, and to identify any unique information that is specific to either the first authentication server or the newly discovered realm.

8. The computer program product of claim 7 wherein the incoming authentication request includes authentication data associated therewith.

9. The computer program product of claim 8 wherein the authentication data includes an authentication token of the one or more authentication tokens from the newly discovered realm that the authentication server cannot validate.

10. The computer program product of claim 9 wherein the method further comprises the first authentication server passing the authentication request to the one or more additional servers of the newly discovered realm.

11. The computer program product of claim 7 wherein the first authentication server searches for the one or more additional authentication servers using a service discovery method.

12. The computer program product of claim 7 wherein, subsequent to the first authentication server inspecting the incoming authentication request, adding the newly discovered realm to a discovery list.

13. A system for dynamically establishing a trust relationship between authentication servers, comprising:

a first authentication server, including one or more processing devices, the first authentication server capable of searching for one or more additional authentication servers for the purpose of discovering one or more sources of authentication tokens, the searching comprising a processor node of the first authentication server initiating a communication exchange with at least one other processor node of the one or more additional authentication servers, and inspecting an incoming authentication request from the one or more additional authentication servers to determine if the incoming authentication request is carrying one or more authentication tokens from a newly discovered realm;

the first authentication server configured to determine, responsive the request is carrying one or more authentication tokens from the newly discovered realm, whether or not the newly discovered realm is trustworthy by initiating communications with at least one trusted authentication server with respect to the first authentication server to ascertain whether or not there is an existing trust relationship between the at least one trusted authentication server and the newly discovered realm;

the first authentication server configured to, responsive to an existing trust relationship between the at least one trusted authentication server and the newly discovered realm, determine that the newly discovered realm is trustworthy, and responsive to a trust relationship not existing between the at least one trusted authentication server and the newly discovered realm, determine that the newly discovered realm is not yet trustworthy, with the first authentication server configure to make one or more attempts to use a plurality of additional authentication tokens to validate information provided by the newly discovered realm before accepting any authentications from the newly discovered realm, and responsive to receiving a plurality of correct authentication tokens from the newly discovered realm, determine that the newly discovered realm is trustworthy;

the first authentication server configured to, responsive to determining the newly discovered realm to be trustworthy, receiving a directory schema from the newly discovered realm and comparing the received directory schema with a known directory schema retrieved by the first authentication server to identify an intersection of the received directory schema and the known directory schema; and

the first authentication server configured to use the intersection to identify a primary key, and to identify any unique information that is specific to either the first authentication server or the newly discovered realm.

14. The system of claim 13 wherein the incoming authentication request includes authentication data associated therewith.

15. The system of claim 14 wherein the authentication data includes an authentication token of the one or more authentication tokens from the newly discovered realm that the authentication server cannot validate.

16. The system of claim 15 wherein the first authenticating server is configured to pass the authentication request to the one or more additional servers of the newly discovered realm.

17. The system of claim 13 wherein the first authentication server searches for the one or more additional authentication servers using a service discovery method.

18. The system of claim 13 wherein the first authentication server is configured to, subsequent to inspecting the incoming authentication request, add the newly discovered realm to a discovery list.