System and method for relaying authentication at network attachment

• US 20090064291A1
• Filed: 08/27/2008
• Published: 03/05/2009
• Est. Priority Date: 08/28/2007
• Status: Abandoned Application

• Current Assignee: Mark Frederick Wahl
• Original Assignee: Mark Frederick Wahl
• Inventors: Wahl, Mark Frederick
• Application Number:
  US12/229,766
• Publication Number:
  US 20090064291A1
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

An information processing system for remote access computing comprising a network access server and a local authentication server is augmented with the capability for relaying authentication requests by tunneling interactions between the requesting client and an identity provider.

Claims

1. A method for authenticating a client to a network access server, said method comprising

(a) connecting said client to said network access server,

(b) transmitting from said client to said network access server an identity,

(c) forwarding said identity from said network access server to a local authentication server,

(d) locating an identity provider web server responsible for authenticating said client with said identity,

(e) transmitting from said local authentication server to said client a redirect address,

(f) establishing a tunnel to permit access from said client to said identity provider web server via said network access server and said local authentication server,

(g) transmitting from said client to said identity provider web server within said tunnel an authentication request comprising said identity and comprising said redirect address,

(h) authenticating said client at said identity provider web server based on said authentication request,

(i) transmitting from said identity provider web server to said client within said tunnel a response,

(j) transmitting from said client to said local authentication server said response,

(k) validating said response at said local authentication server, and

(l) transmitting from said local authentication server to said network access server a configuration to permit network access by said client.

2. The method of claim 1, wherein transmitting from said local authentication server to said network access server said configuration to permit network access comprises transmitting an access policy from said local authentication server to said network access server within a message encoded in a remote access dial in user service protocol.

3. The method of claim 1, wherein transmitting from said client to said identity provider web server said authentication request comprises transmitting a credential from said client to said identity provider web server.

4. The method of claim 3, wherein authenticating said client comprises comparing said identity and said credential with a record corresponding to said identity obtained from a database of said identity provider web server.

5. The method of claim 1, wherein locating said identity provider web server comprises retrieving a document from an address corresponding to said identity.

6. The method of claim 1, wherein transmitting from said client to said local authentication server said response comprises transmitting said response in a hypertext transfer protocol.

7. The method of claim 1, wherein establishing said tunnel comprises configuring said client to encode messages destined to said identity provider web server within an extensible authentication protocol.

8. A system for authenticating a client to a network access server, said system comprising

(a) said client,

(b) said network access server,

(c) a local authentication server, and

(d) an identity provider web server, wherein

said client connects to said network access server,

said client transmits an identity to said network access server,

said network access server forwards said identity to said local authentication server,

said local authentication server locates said identity provider web server responsible for authenticating said client with said identity,

said local server transmits a redirect address to said client,

said local authentication server establishes a tunnel to permit access by said client to said identity provider web server,

said client transmits within said tunnel an authentication request comprising said redirect identity and comprising said redirect address to said identity provider web server,

said identity provider web server authenticates said client based on said authentication request,

said identity provider web server transmits within said tunnel a response to said client,

said client transmits said response to said local authentication server,

said local authentication server validates said response, and

said local authentication server configures said network access server to permit network access to said client.

9. The system of claim 8, wherein said local authentication server is implemented as software running on a general-purpose computer system.

10. The system of claim 8, wherein said identity comprises a uniform resource locator.

11. The system of claim 8, wherein said redirect address comprises a uniform resource locator.

12. The system of claim 8, wherein said client transmits within said tunnel an authentication request further comprising a credential.

13. The system of claim 12, wherein said identity provider web server authenticates said client by comparing said identity and said credential with a record corresponding to said identity obtained from a database of said identity provider web server.

14. A computer program product within a computer usable medium with software for authenticating a client to a network access server, said computer program product comprising

(a) instructions connecting said client to said network access server,

(b) instructions for transmitting from said client to said network access server an identity,

(c) instructions for forwarding said identity from said network access server to a local authentication server,

(d) instructions for locating an identity provider web server responsible for authenticating said client with said identity,

(e) instructions for transmitting from said local authentication server to said client a redirect address,

(f) instructions for establishing a tunnel to permit access from said client to said identity provider web server via said network access server and said local authentication server,

(g) instructions for transmitting from said client to said identity provider web server within said tunnel an authentication request comprising said identity and comprising said redirect address,

(h) instructions for authenticating said client at said identity provider web server based on said authentication request,

(i) instructions for transmitting from said identity provider web server to said client within said tunnel a response,

(j) instructions for transmitting from said client to said local authentication server said response,

(k) instructions for validating said response at said local authentication server, and

(l) instructions for transmitting from said local authentication server to said network access server a configuration to permit network access by said client.