Authorization system for obtaining in single step both identification and access rights of client to server directly from encrypted authorization ticket

• US 5,455,953 A
• Filed: 11/03/1993
• Issued: 10/03/1995
• Est. Priority Date: 11/03/1993
• Status: Expired due to Term

• Current Assignee: Rakuten, Inc. (Rakuten Group, Inc.)
• Original Assignee: Wang Laboratories Incorporated
• Inventors: Russell, Edward A.
• Primary Examiner(s): Lim, Krisna
• Application Number:
  US08/143,163
• Time in Patent Office: 699 Days
• Field of Search: 380/4, 380/25, 395/600, 395/650, 395/575, 395/700, 395/725
• US Class Current: 710/266
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0838 using one-time-passwords

Abstract

An authorization mechanism for providing authorization information for a client requesting access to a server resource in a server, including a directory server for storing client information required by the server in executing an operation call, including client access rights, and a generating a request for an authorization ticket to the server. The request for an authorization ticket includes an identification of the client and an identification of the client information required by the server and is in association with an operation call. The authorization mechanism generates an authorization ticket including the identified information and encrypted with an encryption key derived from the password of the server. The authorization ticket is sent to the server and the server decrypts the authorization ticket with the server password and obtains the client information directly, including the client access rights. Client information is stored in directory server fields identified by generic field tags. The authorization ticket request identifies client information by tag names identifying the fields, the requested information in stored in the authorization ticket in fields identified by the tag names, and the server mechanism then reads the client information by parsing the ticket with the tag names.

Claims

1. In a data processing system including a client mechanism, a server mechanism including a server resource, and an authorization mechanism, the authorization mechanism including a directory server for storing and providing access rights of the client mechanism to the server resource and the client mechanism generating operation requests for operations to be performed by the server with respect to the server resource, wherein the client mechanism generates a request to the authorization mechanism for an authorization ticket to the server resource and the authorization mechanism responds to a request for an authorization ticket by returning an authorization ticket containing an identification of the client, the authorization ticket being encrypted with an encryption key derived from the password of the server, the client mechanism providing the authorization ticket to the server mechanism is associated with an operation request, the server mechanism decrypting the authorization ticket with the server password and using the client identification to obtain the client access rights of the client mechanism to the server resource, an improved authorization mechanism, comprising:

a directory server for storing access rights of the client mechanism and information regarding the client mechanism and required by the server mechanism in executing the operation request,

a client mechanism for generating a request for an authorization ticket to the server mechanism, the request for an authorization ticket including an identification of the client mechanism,

an authorization mechanism for generating a corresponding authorization ticket wherein the authorization ticket includes the access rights of the client mechanism and the information regarding the client mechanism and required by the server mechanism in executing the operation request and is encrypted with an encryption key derived from the password of the server, and

the client mechanism being responsive to the authorization ticket for sending the authorization ticket to the server mechanism in association with the operation request, and

a server mechanism for decrypting the authorization ticket with the server mechanism password and obtaining directly the access rights of the client mechanism to the server resource and the information regarding the client mechanism and required by the server mechanism in executing the operation request, wherein

the client information including the client access rights are stored in the directory server in fields identified by generic field tags,

the authorization ticket request generated by the client mechanism identifies the client information by tag names identifying the fields containing the required client information,

the requested information is stored in the encrypted authorization ticket in fields identified by the corresponding tag names, and

the server mechanism reads the client information from the decrypted authorization ticket by parsing the decrypted authorization ticket with the tag names of the fields containing the necessary client information.

2. In a data processing system including a client mechanism, a server mechanism including a server resource, and an authorization mechanism, the authorization mechanism including a directory server for storing and providing access rights of the client mechanism to the server resource and the client mechanism generating operation requests for operations to be performed by the server with respect to the server resource, wherein the client mechanism generates a request to the authorization mechanism for an authorization ticket to the server resource and the authorization mechanism responds to a request for an authorization ticket by returning an authorization ticket containing an identification of the client, the authorization ticket being encrypted with an encryption key derived from the password of the server, the client mechanism providing the authorization ticket to the server mechanism is associated with an operation request, the server mechanism decrypting the authorization ticket with the server password and using the client identification to obtain the client access rights of the client mechanism to the server resource, an improved method for providing client information to the server mechanism, comprising the steps of:

storing client information including access rights of the client mechanism and information regarding the client mechanism and required by the server mechanism in executing an operation request in the directory server in fields identified by generic field tags,

in the client mechanism and in response to a request from a user for an operation by the server mechanism, generating a request for an authorization ticket to the server mechanism, the request for an authorization ticket including an identification of the client mechanism and including identifying the client information in the authorization ticket request by tag names identifying the fields containing the required client information,

in the authorization mechanism and in response to the request for an authorization mechanism, generating a corresponding authorization ticket wherein the authorization ticket includes the access rights of the client mechanism and the information regarding the client mechanism and required by the server mechanism in executing the operation request and is encrypted with an encryption key derived from the password of the server, including storing the requested information in the encrypted authorization ticket in fields identified by the corresponding tag names

by operation of the client mechanism, sending the authorization ticket to the server mechanism in association with the operation request, and

in the server mechanism, decrypting the authorization ticket with the server mechanism password, parsing the decrypted authorization ticket with the tag names of the fields containing the necessary client information to obtain the client information, and obtaining directly the access rights of the client mechanism to the server resource and the information regarding the client mechanism and required by the server mechanism in executing the operation request.

3. In a data processing system including a client mechanism, a server mechanism including a server resource, and an authorization mechanism, the authorization mechanism including a directory server for storing and providing access rights of the client mechanism to the server resource and the client mechanism generating operation requests for operations to be performed by the server with respect to the server resource, wherein the client mechanism generates a request to the authorization mechanism for an authorization ticket to the server resource and the authorization mechanism responds to a request for an authorization ticket by returning an authorization ticket containing an identification of the client, the authorization ticket being encrypted with an encryption key derived from the password of the server, the client mechanism providing the authorization ticket to the server mechanism is associated with an operation request, the server mechanism decrypting the authorization ticket with the server password, an improved authorization mechanism, comprising:

a directory server for storing access rights of the client mechanism,

a client mechanism for generating a request for an authorization ticket to the server mechanism, the request for an authorization ticket including an identification of the client mechanism,

an authorization mechanism for generating a corresponding authorization ticket wherein the authorization ticket further includes the access rights of the client mechanism and is encrypted with an encryption key derived from the password of the server, and

the client mechanism being responsive to the authorization ticket for sending the authorization ticket to the server mechanism in association with the operation request, and

a server mechanism for decrypting the authorization ticket with the server mechanism password and obtaining the identification of the client and the access rights of the client mechanism to the server resource directly from the authorization ticket.

4. The improved authorization mechanism of claim 3, wherein:

the directory server further stores information regarding the client mechanism and required by the server mechanism in executing the operation request,

the authorization ticket request generated by the client mechanism further includes an identification of the client information required by the server mechanism in executing the operation request,

the authorization mechanism is responsive to the ticket request for placing the requested information into the encrypted authorization ticket, and

the server mechanism decrypts the authorization ticket and reads the information for executing the operation request directly from the decrypted authorization ticket.

5. In a data processing system including a client mechanism, a server mechanism including a server resource, and an authorization mechanism, the authorization mechanism including a directory server for storing and providing access rights of the client mechanism to the server resource and the client mechanism generating operation requests for operations to be performed by the server with respect to the server resource, wherein the client mechanism generates a request to the authorization mechanism for an authorization ticket to the server resource and the authorization mechanism responds to a request for an authorization ticket by returning an authorization ticket containing an identification of the client, the authorization ticket being encrypted with an encryption key derived from the password of the server, the client mechanism providing the authorization ticket to the server mechanism is associated with an operation request, the server mechanism decrypting the authorization ticket with the server password, an improved method for providing client information to the server mechanism, comprising the steps of:

storing access rights of the client mechanism in the directory server,

by operation of the client server and in response to a user request, generating a request for an authorization ticket to the server mechanism, the request for an authorization ticket including an identification of the client mechanism,

in the authorization mechanism and in response to a request for an authorization ticket, generating a corresponding authorization ticket wherein the authorization ticket further includes the access rights of the client mechanism and is encrypted with an encryption key derived from the password of the server, and

by operation of the client mechanism, sending the authorization ticket to the server mechanism in association with the operation request, and

in the server mechanism, decrypting the authorization ticket with the server mechanism password and obtaining the identification of the client and the access rights of the client mechanism to the server resource directly from the authorization ticket.

6. The improved method for providing client information to the server mechanism of claim 5, further comprising the steps of:

storing information regarding the client mechanism and required by the server mechanism in executing the operation request in the directory server,

by operation of the client mechanism and in response to the request by the user for an authorization ticket, including an identification of the client information required by the server mechanism in executing the operation request in the authorization ticket request,

by operation of the authorization mechanism and in response to the request for an authorization ticket, placing the requested information into the encrypted authorization ticket, and

in the server mechanism, decrypting the authorization ticket and reading the information for executing the operation request directly from the decrypted authorization ticket.