Secure Distribution of Non-Privileged Authentication Credentials

• US 20130291078A1
• Filed: 04/10/2013
• Published: 10/31/2013
• Est. Priority Date: 04/11/2012
• Status: Active Grant

• Current Assignee: TeleCommunication Systems Inc (Comtech Telecommunications Corporation)
• Original Assignee: TeleCommunication Systems Inc (Comtech Telecommunications Corporation)
• Inventors: McFarland, Keith A., Ghozati, Kambiz, Stevens, John, Wells, Wiliam P.
• Granted Patent: US 9,338,153 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 67/01 Protocols

Abstract

An authentication credentials push service (ACPS) that securely pushes non-privileged authentication credentials to registered client entities. The ACPS comprises a classification server and a push server to provide access to non-privileged authentication credentials absent a pull transaction. The classification server in the ACPS classifies authentication credentials as either privileged (i.e. private, forgeable) or non-privileged (i.e. non-forgeable, non-sensitive). Credentials identified as being of a privileged nature are treated with restricted access. Alternatively, credentials classified as being of a non-privileged nature are made available for the push service. Authentication servers register with the ACPS to become consumers of the push service. A push server within the ACPS pushes non-privileged authentication credentials to registered authentication servers at predetermined intervals. Individual authentication credentials push services (ACPS) have access to different authentication credentials. An authentication server can use a dynamic name service (DNS) lookup to find a specific authentication credentials push service (ACPS).

Claims

1. An authentication credentials push service, comprising:

a classification server to classify a given authentication credential either as a privileged authentication credential or as a non-privileged authentication credential, based on a predetermined rule; and

a push server to push said non-privileged authentication credential to a registered client entity.

2. The authentication credentials push service according to claim 1, wherein said privileged authentication credential comprises:

private, forgeable information.

3. The authentication credentials push service according to claim 1, wherein said non-privileged authentication credential comprises:

non-sensitive, non-forgeable information.

4. The authentication credentials push service according to claim 1, wherein:

access to said privileged authentication credential is restricted.

5. The authentication credentials push service according to claim 1, wherein said registered client entity comprises:

an authentication server.

6. The authentication credentials push service according to claim 1, wherein:

said push server pushes said non-privileged authentication credential to said registered client entity, at a predetermined interval.

7. The authentication credentials push service according to claim 1, wherein:

said authentication credentials push service is registered with a domain name service (DNS) system.

8. The authentication credentials push service according to claim 1, wherein:

said registered client entity uses a domain name service (DNS) lookup to acquire information sufficient to connect with said authentication credentials push service.

9. A method of authenticating pushed credentials, comprising:

classifying a given authentication credential received at a classification server either as a privileged authentication credential or as a non-privileged authentication credential, based on a predetermined rule; and

pushing said non-privileged authentication credential to a registered client entity.

10. The method of authenticating pushed credentials according to claim 9, wherein said privileged authentication credential comprises:

private, forgeable information.

11. The method of authenticating pushed credentials according to claim 9, wherein said non-privileged authentication credential comprises:

non-sensitive, non-forgeable information.

12. The method of authenticating pushed credentials according to claim 9, further comprising:

restricting access to said privileged authentication credential.

13. The method of authenticating pushed credentials according to claim 9, wherein said registered client entity comprises:

an authentication server.

14. The method of authenticating pushed credentials according to claim 9, wherein:

said non-privileged authentication credential is pushed to said registered client entity at a predetermined interval.

15. The method of authenticating pushed credentials according to claim 9, wherein:

said authentication credentials push service is registered with a domain name service (DNS) system.

16. The method of authenticating pushed credentials according to claim 9, further comprising:

communicating via a domain name service (DNS) lookup to acquire information sufficient to connect with said authentication credentials push service.