METHOD, SYSTEM, AND AUTHENTICATION DEVICE

• US 20150371031A1
• Filed: 04/27/2015
• Published: 12/24/2015
• Est. Priority Date: 06/23/2014
• Status: Abandoned Application

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Amemiya, Kouichirou, UENO, Masaru
• Application Number:
  US14/696,769
• Publication Number:
  US 20150371031A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data

Abstract

A method includes: receiving a request for processing, the processing having to be preceded by an authorization process for a source of the request, the authorization process being performed based on authorization information which a term of validity is set; storing historical information indicative of a history of a request for the processing from the source; and setting, by a processor, the term of validity of the authorization information based on the historical information.

Claims

1. A method comprising:

receiving a request for processing, the processing having to be preceded by an authorization process for a source of the request, the authorization process being performed based on authorization information which a term of validity is set;

storing historical information indicative of a history of a request for the processing from the source; and

setting, by a processor, the term of validity of the authorization information based on the historical information.

2. The method according to claim 1, wherein the setting includes:

determining a frequency with which the process is requested based on the historical information, and

deciding the term of validity of the authorization information based on a relationship between the frequency and a reference.

3. The method according to claim 2, wherein

when the frequency is higher than the reference, the deciding decides a duration of validity of the authorization information in accordance with a second period longer than a first period used when the frequency is lower than the reference.

4. The method according to claim 2, wherein

when the frequency is lower than the reference, the deciding decides a duration of validity of the authorization information in accordance with a second period shorter than a first period used when the frequency is higher than the reference.

5. The method according to claim 1, wherein

the processing includes a plurality of kinds of processing,

the historical information includes identification information for identifying a kind of the processing, and

the setting sets, for each piece of the identification information, the term of validity of the authorization information, based on the historical information.

6. The method according to claim 1, further comprising:

receiving a new request for the processing from the source after the setting; and

prior to performing processing indicated by the new request for the processing, performing the authorization process for the source based on the authorization information having the set term of validity.

7. A system that manages a virtualization infrastructure in which a physical resource for processing information is virtualized, the system comprising:

a management device including a first processor and a first memory coupled to the first processor; and

an authentication device including a second processor and a second memory coupled to the second processor,

wherein the first processor of the management device is configured to;

upon accepting a request for processing related to a virtual system constructed in the virtualization infrastructure, from a user who uses the virtualization infrastructure, request, before performing the processing, the authentication device to perform an authorization process in which it is determined whether or not to authorize the user to use the virtualization infrastructure, and

with regard to the request for the authorization process, providing, to the authentication device, notification of processing identification information for identifying the processing from which the authorization process arises and user identification information for identifying the user,

the second processor of the authentication device is configured to;

upon accepting a request for the authorization process from the management device, perform the authorization process, based on authorization information having a term of validity for determining whether or not to authorize the user to use the virtualization infrastructure,

store a history of processing requested by the user by storing, in association with each other, the processing identification information and the user identification information provided,

estimate, based on the history, a time period taken until, when specific processing is requested by the user, an authorization process arising from subsequent processing following the specific processing is requested, and

update a term of validity of the authorization information having the term of validity based on the time period when the user is authorized in the authorization process arising from the specific processing.

8. The system according to claim 7, wherein the second processor of the authentication device is configured to:

extract, from the history, a plurality of records for the authorization process that has arisen from the specific processing,

for each of the plurality of records, acquire a time period elapsed until the authorization process arising from subsequent processing following the specific processing is requested,

calculate an average time period of a plurality of the elapsed time periods for the plurality of records, and

estimate the time period based on the average time period.

9. The system according to claim 7, wherein the second processor of the authentication device is configured to:

set the term of validity of the authorization information having a term of validity to a first time period when the estimated time period is longer than a specific reference, and

set the term of validity of the authorization information having a term of validity to a second time period longer than the first time period when the estimated time period is less than or equal to the specific reference.

10. The system according to claim 7, wherein the second processor of the authentication device is configured to:

accept a request for an authentication process based on the user identification information and a password associated with the user identification information,

perform the requested authentication process,

generate the authorization information having a term of validity upon success of the authentication process, and

issue the authorization information having the term of validity to the user.

11. The system according to claim 10, wherein the second processor of the authentication device is configured to:

register the generated authorization information having a term of validity in a database, and

delete the authorization information having the term of validity from the database upon completion of the term of validity of the authorization information having a term of validity within the database.

12. The system according to claim 7, wherein

the first processor of the management device is configured to:

in accordance with a kind of a virtual resource of the virtualization infrastructure, execute a plurality of components for performing the processing related to a virtual system constructed in the virtualization infrastructure,

wherein each of the plurality of components requests the authentication device to perform the authentication process before performing the processing.

13. The system according to claim 7, further comprising:

an acceptance device including a third processor and a third memory coupled to the third processor,

wherein the third processor of the acceptance device is configured to;

upon accepting a request for the process from the user, request the management device to perform the process, by executing a specific program in accordance with a kind of the process accepted, and

notify the management device of program identification information for identifying the specific program, as the process identification information.

14. The system according to claim 7, wherein

the processing from which the authorization process arises is processing involving changing usage details of a virtual resource in the virtualization infrastructure.

15. An authentication device comprising:

a memory; and

a processor coupled to the memory and configured to;

upon accepting a request for an authorization process in which it is determined whether or not to authorize a user to use a virtualization infrastructure, perform the authorization process, based on authorization information having a term of validity for determining whether or not to authorize the user to use the virtualization infrastructure,

store a history of processing requested by the user by storing, in association with each other, processing identification information for identifying processing from which the authorization process arises and user identification information provided with regard to the request for the authorization process,

estimate, based on the history, a time period taken until, when specific processing is requested by the user, an authorization process arising from subsequent processing following the specific processing is requested, and

update a term of validity of the authorization information having the term of validity based on the time period when the user is authorized in the authorization process arising from the specific processing.