Session tickets for a backup and recovery system

• US 9,442,808 B1
• Filed: 12/30/2014
• Issued: 09/13/2016
• Est. Priority Date: 12/30/2014
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Drozd, Michal J, Roche, Michael G, Shtop, Aliaksandr
• Primary Examiner(s): REVAK, CHRISTOPHER A
• Application Number:
  US14/586,227
• Time in Patent Office: 623 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 11/1464 for networked environments
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807

Abstract

A ticket request is transmitted from an execution engine to an authentication engine. In response, a ticket comprising privileges is received from the authentication engine. The ticket is transmitted to a client, and a service request including the ticket is received back from the client. A service is executed in response to the ticket received from the client and results are transmitted to the client.

Claims

1. A method for authorizing a client to access a service, the method comprising:

transmitting a ticket request from an execution engine executing remotely from a client to to an authorization engine;

receiving a ticket in response to the request, wherein the ticket comprises encrypted privileges for executing at least one of a backup process and a recovery process;

transmitting the ticket to the client;

receiving a service request at a server from the client, wherein the service request includes the ticket;

determining whether the server is a legacy server;

disregarding the ticket when the server is the legacy server;

executing a service requested by the service request; and

transmitting a result of the executed service to the client.

2. The method of claim 1, wherein the ticket comprises an encrypted time-to-live (“

TTL”

).

3. The method of claim 2, further comprises determining the TTL has not expired prior to executing the service.

4. The method of claim 1, further comprising the ticket grants permission to execute the service prior to executing the service.

5. The method of claim 1, wherein the authorization engine is executing on the server.

6. A computer program product for authorizing a client to access a service, the computer program product comprising a non-transitory computer readable medium encoded with computer executable program, the code enabling:

transmitting a ticket request from an execution engine executing remotely from a client to an authorization engine;

receiving a ticket in response to the request, wherein the ticket comprises encrypted privileges for executing at least one of a backup process and a recovery process;

transmitting the ticket to the client;

receiving a service request at a server from the client, wherein the service request includes the ticket;

determining whether the server is a legacy server;

disregarding the ticket when the server is the legacy server;

executing a service requested by the service request; and

transmitting a result of the executed service to the client.

7. The computer program product of claim 6, wherein the ticket comprises an encrypted time-to-live (“

TTL”

).

8. The computer program product of claim 7, further comprises determining the TTL has not expired prior to executing the service.

9. The computer program product of claim 6, further comprising the ticket grants permission to execute the service prior to executing the service.

10. The computer program product of claim 6, wherein the authorization engine is executing on the server.

11. A system for authorizing a client to access a service, comprising a non-transitory computer readable storage medium and a processor executing instructions for:

transmitting a ticket request from an execution engine executing remotely from a client to an authorization engine;

receiving a ticket in response to the request, wherein the ticket comprises encrypted privileges for executing at least one of a backup process and a recovery process;

transmitting the ticket to the client;

receiving a service request at a server from the client, wherein the service request includes the ticket;

determining whether the server is a legacy server;

disregarding the ticket when the server is the legacy server;

executing a service requested by the service request; and

transmitting a result of the executed service to the client.

12. The computer program product of claim 11, wherein the ticket comprises an encrypted time-to-live (“

TTL”

).

13. The computer program product of claim 12, further comprises determining the TTL has not expired prior to executing the service.

14. The computer program product of claim 11, further comprising the ticket grants permission to execute the service prior to executing the service.

15. The computer program product of claim 11, wherein the authorization engine is executing on the server.