Single sign-on system for shared resource environments

• US 9,576,140 B1
• Filed: 08/24/2012
• Issued: 02/21/2017
• Est. Priority Date: 07/01/2009
• Status: Active Grant

• Current Assignee: Dell Products LP (Dell Technologies Inc.)
• Original Assignee: Dell Products LP (Dell Technologies Inc.)
• Inventors: Ghostine, Peter E., McDonald, Michael
• Primary Examiner(s): Gergiso, Techane
• Application Number:
  US13/594,273
• Time in Patent Office: 1,642 Days
• Field of Search: 726/8, 713/168, 709/217
• US Class Current: 1/1
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key

Abstract

Systems and methods for enhancing security of single sign-on are described. These systems and methods can reduce the amount of sensitive information stored on a client device while still providing single sign-on access to shared resources such as virtual desktops or Terminal Servers. For example, storage of authentication information on client devices can be avoided while still allowing client devices to connect to the shared resources. Instead, such information can be stored at a broker server that brokers connections from client devices to the shared resources. The broker server can facilitate more secure single sign-on by providing a single-use ticket to a client device that authenticates with the broker server. The client device can use this single-use ticket to authenticate with a shared resource.

Claims

1. A method of employing single sign-on in shared services environments, the method comprising:

by a broker server system comprising computer hardware, performing pass-through authentication, the performing comprising;

receiving credentials from a client system, the credentials corresponding to a user of the client system;

attempting to authenticate, using the credentials, an identity of the user by communicating the credentials to an authentication server;

receiving, from the authentication server, an indication that the credentials are expired;

passing the expired credentials to a target resource to which the client system has requested access so as to cause the target resource to initiate a process for changing the expired credentials;

generating, after the credentials have been changed, a ticket comprising a reference to the credentials; and

providing the ticket to the client system, wherein the client system is enabled to provide the ticket to the target resource to obtain access to the target resource.

2. The method of claim 1, wherein the authentication server comprises an active directory server.

3. The method of claim 1, further comprising:

providing, prior to establishing an authenticated connection with the client system, an authorized list of named resources.

4. A method of employing single sign-on in shared services environments, the method comprising:

by a broker server comprising computer hardware;

receiving authentication information of a user from a client system;

authenticating, using the authentication information, an identity of the user by communicating the authentication information to an authentication server;

wherein if the broker server receives from the authentication server an indication that the authentication information includes expired credentials, the broker server causes the user to change the expired credentials at a particular resource to which the client system has requested access;

communicating to the client system a list of one or more authorized resources that the client system is permitted to access;

receiving a request from the client system to access a target resource from the one or more authorized resources;

generating a ticket comprising a reference to the authentication information;

providing the ticket to the client system, wherein the client system is enabled to provide the ticket to the target resource to obtain access to the target resource;

subsequent to the ticket being sent from the client system to the target resource, receiving the ticket from the target resource; and

sending the authentication information to the target resource in response to receiving the ticket from the target resource, wherein the ticket enables the client system to authenticate to the target resource without storing user credentials and connection information on the client system.

5. The method of claim 4, wherein the ticket further comprises connection information for the target resource.

6. The method of claim 5, wherein the authentication information comprises one or more of the following:

credentials, a Kerberos ticket, and NT Lan Manager (NTLM) authentication information.

7. The method of claim 6, wherein the credentials comprise a username, a password, and a domain name associated with the client system.

8. The method of claim 4, wherein the ticket is valid for a single use by the client system.

9. The method of claim 8, wherein the ticket authenticates with a single shared resource.

10. The method of claim 4, wherein the ticket is configured to expire beyond a specified time frame.

11. The method of claim 4, further comprising:

providing, prior to establishing an authenticated connection with the client system, an authorized list of named resources.

12. The method of claim 4, wherein the ticket comprises an authentication file identifier.

13. The method of claim 12, wherein the authentication file identifier comprises a reference to a security cookie generated by the broker server.