Centralized user authentication system apparatus and method

• US 8,978,098 B2
• Filed: 04/17/2013
• Issued: 03/10/2015
• Est. Priority Date: 06/08/2006
• Status: Active Grant

• Current Assignee: Dell Software, Inc. (Dell Technologies Inc.)
• Original Assignee: Dell Software, Inc. (Dell Technologies Inc.)
• Inventors: Robinson, Kyle Lane, Bowers, John Joseph
• Primary Examiner(s): Mehedi, Morshed
• Application Number:
  US13/864,866
• Publication Number:
  US 20130340055A1
• Time in Patent Office: 692 Days
• Field of Search: 726/2
• US Class Current: 726/2
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

An identification module receives a password request for a specified user and communicates an encrypted password field in response thereto, wherein the encrypted password field references a directory object corresponding to the specified user. The present invention also teaches an authentication module that communicates the password request to the identification module and receives the encrypted password field therefrom. Upon receiving the encrypted password field, the authentication module authenticates the specified user against the referenced directory object. In some embodiments, the encrypted password field is stored in an identification data store of an identification server and the directory object is stored in an authentication data store of an authentication server.

Claims

1. A system to authenticate a user, the system comprising:

a computer system comprising computer hardware, the computer system programmed to implement;

a directory-based authentication server that authenticates users based on directory objects;

a non-directory based legacy identification subsystem that is not configured for directory-based authentication;

an enhanced authentication module in communication with the directory-based server and the non-directory based legacy identification subsystem wherein the enhanced authentication module obtains a directory object reference from a data field of an identification data store of the legacy identification system and provides the directory object reference to the directory-based authentication system;

wherein the non-directory based legacy identification subsystem comprises an identification data store that includes a data field having a directory object reference stored therein, the directory object reference configured to reference a directory object that is stored separately from the legacy identification system, wherein the directory object is configured to uniquely identify a specified user, and wherein the directory object reference is stored in the data field in place of authentication information native to the legacy identification system;

wherein the authentication module is configured to generate a request for authentication information of a specified user from the identification subsystem, and in response to receiving a response to the request, to access the data field in the identification data store of the legacy system to obtain the directory object reference stored therein, and

wherein the authentication module further configured to obtain the directory object reference from the data field of the identification data store of the legacy system rather than authentication information native to the legacy system and to transmit the directory object reference to the directory-based authentication server; and

wherein the directory-based authentication server accesses the directory object stored separately from the non-directory based legacy system based on the directory object reference provided by the enhanced authentication module to authenticate the specified user against the directory object.

2. The system of claim 1, wherein the data field of the identification data store comprises a principal name.

3. The system of claim 1, wherein the identification subsystem is configured to identify the specified user upon receiving a username.

4. The system of claim 1, wherein the authentication subsystem comprises a pluggable authentication module.

5. The system of claim 1, wherein the identification subsystem comprises a plurality of identification modules selected from the group consisting of a NSS-NIS module, a NSS-LDAP module, and a NSS-File module.

6. A method to authenticate a user, the method comprising:

by a computer system comprising computer hardware;

modifying an identification data store that is configured to store authentication information native to a legacy identification system to store a directory object reference therein, wherein the directory object reference references a directory object that is stored separately from the legacy identification system, and wherein the directory object is configured to uniquely identify a specified user within the identification data store instead of storing authentication information native to the legacy identification system within the identification data store;

providing an identification module configured to receive a request for authentication information corresponding to the specified user;

accessing the identification data store in the legacy system to obtain the directory object reference stored therein;

communicating the directory object reference stored in the identification data store to an authentication module in response to receiving the request; and

transmitting the directory object reference from the authentication module to an authentication server configured to access the directory object stored separately from the legacy system based on the directory object reference and to authenticate the specified user against the directory object referenced by the identification data store.

7. The method of claim 6, wherein providing an authentication module comprises providing a pluggable authentication module.

8. The method of claim 6, wherein the authentication information comprises a principal name.

9. The method of claim 6, wherein the providing an identification module comprises providing a plurality of identification modules selected from the group consisting of a NSS-NIS module, a NSS-LDAP module, and a NSS-Files module.

10. The method of claim 6, wherein the providing an identification module comprises providing an identification module configured to identify the specified user upon receiving the username.