A METHOD AND APPARATUS FOR ASSOCIATING TICKETS IN A TICKET HIERARCHY

• US 20060095334A1
• Filed: 09/30/2004
• Published: 05/04/2006
• Est. Priority Date: 09/30/2004
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Simmons, Timothy Ernest
• Granted Patent: US 7,748,032 B2
• Time in Patent Office: Days
• US Class Current: 726/10
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Abstract

A method and apparatus for associating session ticket includes a ticketing authority server. The ticketing authority server receives a ticket generation request and information about a client node. It identifies a master session ticket associated in a storage element with the client node. The ticketing authority server then generates a derivative session ticket for the client node and associates the derivative session ticket with the master session ticket. Finally, the ticketing authority server stores information about the client node and the derivative session ticket in the storage element.

Claims

1. A method of associating session tickets, the method comprising the steps of:

receiving, by a ticketing authority server, a ticket generation request and information about a client node;

identifying, by a ticketing authority server, a master session ticket associated in a storage element with the client node;

generating, by a ticketing authority server, a derivative session ticket for the client node;

associating, by a ticketing authority server, the derivative session ticket with the master session ticket; and

storing, by a ticketing authority server, information about the client node and the derivative session ticket in the storage element.

2. The method of claim 1 wherein step (b) further comprises identifying a master session ticket for the client node by using the received information to query the storage element.

3. The method of claim 1 wherein step (c) comprises generating a master session ticket for the client node.

4. The method of claim 1 wherein step (c) further comprises assigning a session profile type to the derivative session ticket.

5. The method of claim 1 wherein step (d) further comprises associating, by the ticketing authority server, the derivative session ticket and the master session ticket by storing a reference to the derivative session ticket in the storage element entry for the master session ticket.

6. A system for associating session tickets comprising:

a master session ticket;

a derivative session ticket; and

a ticketing authority server receiving a ticket generation request and information about a client node, identifying the master session ticket associated with the client node, generating the derivative session ticket for the client node, associating the derivative session ticket with the master session ticket, and storing information about the client node and the derivative session ticket in a storage element.

7. The system of claim 6 wherein the master session ticket further comprises a client identifier.

8. The system of claim 7 wherein the client identifier comprises a user name.

9. The system of claim 7 wherein the client identifier comprises a domain name.

10. The system of claim 6 wherein the master session ticket further comprises a session profile type.

11. The system of claim 6 wherein the derivative session ticket further comprises a session profile type.

12. The system of claim 6 wherein the derivative session ticket further comprises a reference to the master session ticket.

13. A method of renewing associated session tickets, the method comprising the steps of:

receiving, by a ticket authority server, a session ticket renewal request and a session ticket;

retrieving, by a ticket authority server, the session associated with the received session ticket;

renewing, by a ticket authority server, session expiration date;

retrieving, by a ticket authority server, the master session ticket associated with the received session ticket;

renewing, by a ticket authority server, the session expiration date of the master session ticket;

retrieving, by a ticket authority server, any derivative ticket associated with the master session ticket; and

renewing, by a ticket authority server, the session expiration date of the derivative session ticket associated with the master session ticket.

14. The method of claim 13 wherein step (b) further comprises querying a storage element to retrieve the session information associated with the session ticket.