Centralized pluggable authentication and authorization

• US 9,935,789 B2
• Filed: 06/17/2015
• Issued: 04/03/2018
• Est. Priority Date: 02/11/2015
• Status: Active Grant

• Current Assignee: Dell Products LP (Dell Technologies Inc.)
• Original Assignee: Dell Products LP (Dell Technologies Inc.)
• Inventors: Fausak, Andrew T., Rombakh, Oleg
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): Huang, Cheng-Feng
• Application Number:
  US14/742,239
• Publication Number:
  US 20160234196A1
• Time in Patent Office: 1,021 Days
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 12/4679 Arrangements for the registration or de-registration of VLAN attribute values, e.g. VLAN identifiers, port VLAN membership
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/025 for remote control or remote monitoring of applications
• CPC Class Codes: H04L 67/08 specially adapted for terminal emulation, e.g. Telnet
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/131 Protocols for games, networked simulations or virtual reality
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/142 Managing session states for stateless protocols; Signalling session states; State transitions; Keeping-state mechanisms
• CPC Class Codes: H04L 67/148 Migration or transfer of sessions
• CPC Class Codes: H04L 67/563 Data redirection of data network streams
• CPC Class Codes: H04L 69/04 Protocols for data compression, e.g. ROHC
• CPC Class Codes: H04L 69/14 Multichannel or multilink protocols
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: Y02D 30/50 in wire-line communication networks, e.g. low power modes or reduced link rate

Abstract

In particular embodiments, a first computing device may receive a request from a second computing device to access a first entity of an infrastructure, the second computing device being coupled to the first computing device, then determining an eligibility of the second computing device to access as least the first entity of the infrastructure, and if the second computing device is determined to be eligible to access the first entity, then assigning a second ticket to the second computing device responsive to the received request.

Claims

1. A method comprising, by a first computing device of an infrastructure:

receiving a request from a second computing device to access through a gateway a first entity of the infrastructure, the second computing device being coupled to the first computing device, wherein the request comprises a first ticket previously assigned by the first computing device, and wherein the first ticket authenticates and authorizes the second computing device for access to at least the first entity and a second entity of the infrastructure and one or more back-end services, wherein the first computing device comprises a centralized pluggable authentication and authorization (PAA) ticketing server that is coupled to the gateway and that provides the first ticket, wherein the PAA ticketing server, an HTTPS server and the gateway form a centralized PAA framework, wherein the first ticket is encrypted based at least on one or more of a connection as routed between the first computing device and at least one of the one or more back-end services, a user of the first computing device and data associated with the connection, wherein the first ticket comprises a list of redirection servers, wherein the first computing device is associated with a third-party encryption service, wherein accessibility of the second computing device to pre-determined entities of the infrastructure is provided by the third-party encryption service, and wherein the first entity redirects the second computing device to the second entity;

determining an eligibility of the second computing device to access at least the first entity of the infrastructure based at least on the first ticket and the first entity, wherein the first ticket is usable by the second computing device against one or more resources; and

assigning, by the PAA ticketing server, a second ticket to the second computing device responsive to the received request based on the eligibility determination, wherein the second ticket authenticates and authorizes the second computing device for access to at least the first entity of the infrastructure, wherein the second ticket is based on a relationship to the first ticket, and wherein assigning the second ticket to the second computing device comprises;

nullifying the first ticket previously assigned by the first computing device; and

sending the second ticket to the second computing device.

2. The method of claim 1, wherein an entity comprises one or more of a computing device, a data, or software.

3. The method of claim 1, wherein the infrastructure comprises an enterprise infrastructure.

4. The method of claim 1, wherein the assigned second ticket comprises one or more keys for the second computing device to access at least the first entity of the infrastructure, the first entity being associated with the pre-determined entities of the infrastructure.

5. The method of claim 1, wherein determining the eligibility of the second computing device to access at least the first entity of the infrastructure comprises determining an eligibility of a user of the second computing device to access at least the first entity of the infrastructure.

6. The method of claim 1, wherein the second entity comprises a remote desktop gateway of the infrastructure.

7. The method of claim 1, wherein the access to the first entity comprises a modification to the first entity.

8. One or more computer-readable non-transitory storage media embodying logic that is operable when executed to:

by a first computing device of an infrastructure;

receiving a request from a second computing device to access through a gateway a first entity of the infrastructure, the second computing device being coupled to the first computing device, wherein the request comprises a first ticket previously assigned by the first computing device, and wherein the first ticket authenticates and authorizes the second computing device for access to at least the first entity and a second entity of the infrastructure and one or more back-end services, wherein the first computing device comprises a centralized pluggable authentication and authorization (PAA) ticketing server that is coupled to the gateway and that provides the first ticket, wherein the PAA ticketing server, an HTTPS server and the gateway form a centralized PAA framework, wherein the first ticket is encrypted based at least on one or more of a connection as routed between the first computing device and at least one of the one or more back-end services, a user of the first computing device and data associated with the connection, wherein the first ticket comprises a list of redirection servers, wherein the first computing device is associated with a third-party encryption service, wherein accessibility of the second computing device to pre-determined entities of the infrastructure is provided by the third-party encryption service, and wherein the first entity redirects the second computing device to the second entity;

determining an eligibility of the second computing device to access at least the first entity of the infrastructure based at least on the first ticket and the first entity, wherein the first ticket is usable by the second computing device against one or more resources; and

assigning, by the PAA ticketing server, a second ticket to the second computing device responsive to the received request based on the eligibility determination, wherein the second ticket authenticates and authorizes the second computing device for access to at least the first entity of the infrastructure through the gateway, wherein the second ticket is based on a relationship to the first ticket, and wherein assigning the second ticket to the second computing device comprises;

nullifying the first ticket previously assigned by the first computing device; and

sending the second ticket to the second computing device.

9. The media of claim 8, wherein the assigned second ticket comprises one or more keys for the second computing device to access at least the first entity of the infrastructure, the first entity being associated with the pre-determined entities of the infrastructure.

10. The media of claim 8, wherein the second entity comprises a remote desktop gateway of the infrastructure.

11. An information handling system comprising:

one or more processors; and

a memory coupled to the processors comprising instructions executable by the processors, the processors being operable when executing the instructions to;

by a first computing device of an infrastructure;

receiving a request from a second computing device to access through a gateway a first entity of the infrastructure, the second computing device being coupled to the first computing device, wherein the request comprises a first ticket previously assigned by the first computing device, and wherein the first ticket authenticates and authorizes the second computing device for access to at least the first entity and a second entity of the infrastructure and one or more back-end services, wherein the first computing device comprises a centralized pluggable authentication and authorization (PAA) ticketing server that is coupled to the gateway and that provides the first ticket, wherein the PAA ticketing server, an HTTPS server and the gateway form a centralized PAA framework, wherein the first ticket is encrypted based at least on one or more of a connection as routed between the first computing device and at least one of the one or more back-end services, a user of the first computing device and data associated with the connection, wherein the first ticket comprises a list of redirection servers, wherein the first computing device is associated with a third-party encryption service, wherein accessibility of the second computing device to pre-determined entities of the infrastructure is provided by the third-party encryption service, and wherein the first entity redirects the second computing device to the second entity;

determining an eligibility of the second computing device to access at least the first entity of the infrastructure based at least on the first ticket and the first entity, wherein the first ticket is usable by the second computing device against one or more resources; and

assigning, by the PAA ticketing server, a second ticket to the second computing device responsive to the received request based on the eligibility determination, wherein the second ticket authenticates and authorizes the second computing device for access to at least the first entity of the infrastructure, wherein the second ticket is based on a relationship to the first ticket, and wherein assigning the second ticket to the second computing device comprises;

nullifying the first ticket previously assigned by the first computing device; and

sending the second ticket to the second computing device.

12. The information handling system of claim 11, wherein the assigned second ticket comprises one or more keys for the second computing device to access at least the first entity of the infrastructure, the first entity being associated with the pre-determined entities of the infrastructure.

13. The information handling system of claim 11, wherein the second entity comprises a remote desktop gateway of the infrastructure.