Method and apparatus for associating tickets in a ticket hierarchy

• US 8,286,230 B2
• Filed: 05/19/2010
• Issued: 10/09/2012
• Est. Priority Date: 09/30/2004
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Simmons, Timothy
• Primary Examiner(s): Cervetti, David Garcia
• Application Number:
  US12/783,266
• Publication Number:
  US 20100229228A1
• Time in Patent Office: 874 Days
• Field of Search: 726/6, 726/10
• US Class Current: 726/10
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Abstract

A method and apparatus for associating session ticket includes a ticketing authority server. The ticketing authority server receives a ticket generation request and information about a client node. It identifies a master session ticket associated in a storage element with the client node. The ticketing authority server then generates a derivative session ticket for the client node and associates the derivative session ticket with the master session ticket. Finally, the ticketing authority server stores information about the client node and the derivative session ticket in the storage element.

Claims

1. A method of associating session tickets, the method comprising

(a) identifying, by a device, a master session ticket for a client node, the master session ticket identifying one or more session tickets generated for the client node;

(b) generating, by the device, a session ticket for the client node;

(c) determining, by the device, a session profile type to assign to the session ticket based on information about the client node, the profile session type identifying one or more of a plurality of differing session access rights; and

(d) associating, by the device, the session ticket with the master session ticket.

2. The method of claim 1, wherein step (a) further comprises generating the master session ticket for the client node.

3. The method of claim 1, wherein step (b) further comprises generating the session ticket as a derivative session ticket of the master session ticket.

4. The method of claim 1, wherein step (c) further comprises assigning, by the device, the session profile type to the session ticket, the session profile type identifying a session renewable right as one or more of the plurality of differing session access rights.

5. The method of claim 1, wherein step (c) further comprises assigning, by the device, the session profile type to the session ticket, the session profile type identifying a session failure connection right as one of the plurality of differing session access rights.

6. The method of claim 1, wherein step (c) further comprises assigning, by the device, the session profile type to the session ticket, the session profile type defining authentication information required from the client node for the session ticket to issue.

7. The method of claim 1, wherein step (c) further comprises assigning, by the device, the session profile type to the session ticket, the session profile type defining a session lifetime.

8. The method of claim 1, wherein step (c) further comprises assigning, by the device, the session profile type to the session ticket, the session profile type defining an expiration date for the session ticket.

9. The method of claim 1, wherein step (d) further comprises storing, by the device, an identifier of the session ticket with an identifier of the master session ticket in a ticket storage element.

10. The method of claim 1, wherein step (d) further comprises storing, by the device, the client node information with an identifier of the session ticket.

11. A system for associating session tickets, the system comprising:

a device comprising a processor executing

a ticketing authority server, configured for;

identifying a master session ticket for a client node, the master session ticket identifying one or more session tickets generated for the client node,

generating a session ticket for the client node, and

associating the session ticket with the master session ticket; and

a policy engine, configured for;

determining a session profile type to assign to the session ticket based on information about the client node, the profile session type identifying one or more of a plurality of differing session access rights.

12. The system of claim 11, wherein the ticket authority generates the master session ticket for the client node.

13. The system of claim 11, wherein the ticket authority generates the session ticket as a derivative session ticket of the master session ticket.

14. The system of claim 11, wherein the policy engines assigns the session profile type to the session ticket, the session profile type identifying a session renewable right as one of the plurality of differing session access rights.

15. The system of claim 11, wherein the policy engines assigns the session profile type to the session ticket, the session profile type identifying a session failure connection right as one of the plurality of differing session access rights.

16. The system of claim 11, wherein the policy engines assigns the session profile type to the session ticket, the session profile type defining authentication information required from the client node for the session ticket to issue.

17. The system of claim 11, wherein the policy engines assigns the session profile type to the session ticket, the session profile type defining a session lifetime.

18. The system of claim 11, wherein the policy engine assigns the session profile type to the session ticket, the session profile type defining an expiration date for the session ticket.

19. The system of claim 11, wherein the device stores an identifier of the session ticket with an identifier of the master session ticket in a ticket storage element.

20. The system of claim 11, wherein the device stores the client node information with an identifier of the session ticket.