Pluggable authentication modules for telecommunications management network

• US 6,950,935 B1
• Filed: 04/21/2000
• Issued: 09/27/2005
• Est. Priority Date: 04/21/2000
• Status: Expired due to Term

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Allavarpu, Sai V., Bhalerao, Anand J.
• Primary Examiner(s): Morse, Gregory A.
• Assistant Examiner(s): Tran, Tongoc
• Application Number:
  US09/553,967
• Time in Patent Office: 1,985 Days
• Field of Search: 713/155, 713/162, 713200-202, 713150-154, 713164-167, 713168-175, 713184-186, 380/229, 380/232, 380/255, 380/258, 705/50
• US Class Current: 713/168
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

A system and method for authenticating users over a network. At least one pluggable authentication module (PAM) is used to authenticate users of network services. Each PAM includes a client-side authentication library and a server-side authentication library which may each be implemented in accordance with a specification expressed in an interface definition language (IDL), wherein the IDL is operable to define interfaces across a plurality of platforms and programming languages. The client-side authentication library is implemented for a particular client platform and deployed on the client computer system to provide a client-side interface to retrieve and encrypt a user profile. The server-side authentication library is implemented for a particular server platform and deployed on the server computer system to provide a server-side interface to receive the encrypted user profile from the client-side authentication library and decrypt the user profile to authenticate the user for network services. The client-side authentication library may be shared by a plurality of management applications and the server-side authentication library may be shared by a plurality of gateway components.

Claims

1. A network management system comprising:

a client-side authentication library deployed on one or more client computer systems, wherein the client-side authentication library comprises a client-side interface which is operable to retrieve and encrypt a user profile associated with a user, and wherein the client-side library is implemented in accordance with a platform-independent interface specification and implemented for one or more client platforms respectively corresponding to each of the one or more client computer systems; and

a server-side authentication library deployed on a server computer system coupled to the client computer system, wherein the server-side authentication library comprises a server-side interface which is operable to receive the encrypted user profile from the client-side authentication library and decrypt the user profile to authenticate the user for one or more network services, and wherein the server-side library is implemented in accordance with the platform-independent interface specification and implemented for a server platform corresponding to the server computer system.

2. The network management system of claim 1, wherein the client-side authentication library is shared by a plurality of management applications.

3. The network management system of claim 1, wherein the server-side authentication library is shared by a plurality of gateway components.

4. The network management system of claim 1, wherein the server-side authentication library is implemented in C++.

5. The network management system of claim 1, wherein the user profile comprises a user name and a password.

6. The network management system of claim 5, wherein the user profile further comprises a designation of a management information server (MIS) to which the user wishes to connect.

7. The network management system of claim 1, wherein the platform-independent interface specification comprises a specification expressed in an interface definition language (IDL), wherein the interface definition language is operable to define object interfaces across a plurality of platforms and across a plurality of programming languages.

8. The network management system of claim 1, wherein the user profile is encrypted and decrypted according to a user-selected encryption scheme.

9. The network management system of claim 1, wherein the client-side authentication library and the server-side authentication library are operable to authenticate requests received by a CORBA gateway, wherein the requests comprise management requests to one or more managed objects, and wherein the management requests are sent by one or more manager applications.

10. A network management system comprising:

a gateway which is coupled to one or more managers, wherein the gateway is configured to provide network management services to the one or more managers; and

one or more pluggable authentication modules which are operable to provide authentication of a manager based upon a user profile, wherein the user profile corresponds to a user of one of the managers, and wherein the one or more pluggable authentication modules are accessible by the gateway and the one or more managers through a platform-independent interface; and

wherein the gateway is configurable to authenticate the user to receive the network management services using the pluggable authentication modules through the platform-independent interface.

11. The network management system of claim 10, wherein the one or more pluggable authentication modules are implemented in accordance with a platform-independent interface specification.

12. The network management system of claim 11, wherein the platform-independent interface specification comprises a specification expressed in an interface definition language (IDL), wherein the interface definition language is operable to define object interfaces across a plurality of platforms and across a plurality of programming languages.

13. The network management system of claim 10, wherein the pluggable authentication modules comprise:

a client-side authentication library deployed on one or more client computer systems, wherein the client-side authentication library comprises functions which are operable to retrieve and encrypt a user profile associated with a user, and wherein the client-side library is implemented for one or more client platforms respectively corresponding to each of the one or more client computer systems; and

a server-side authentication library deployed on a server computer system coupled to the client computer system, wherein the server-side authentication library comprises functions which are operable to receive the encrypted user profile from the client-side authentication library and decrypt the user profile to authenticate the user for one or more network services, and wherein the server-side library is implemented for a server platform corresponding to the server computer system.

14. The network management system of claim 13, wherein the user profile is encrypted and decrypted according to a user-selected encryption scheme.

15. The network management system of claim 13, wherein the client-side authentication library and the server-side authentication library are operable to authenticate requests received by a CORBA gateway, wherein the requests comprise management requests to one or more managed objects, and wherein the management requests are sent by one or more manager applications.

16. The network management system of claim 10, wherein the user profile comprises a user name and a password.

17. The network management system of claim 16, wherein the user profile further comprises a designation of a management information server (MIS) to which the user wishes to connect.

18. A network management method comprising:

implementing a client-side authentication library for a client platform in accordance with a platform-independent interface specification, wherein the client platform corresponds to a client computer system;

installing the client-side authentication library on the client computer system;

implementing a server-side authentication library for a server platform in accordance with the platform-independent interface specification, wherein the server platform corresponds to a server computer system;

installing the server-side authentication library on the server computer system;

encrypting a user profile associated with a user via the client-side authentication library;

receiving the encrypted user profile from the client computer system via the client-side authentication library;

decrypting the user profile to authenticate the user for one or more network services via the server-side authentication library.

19. The network management method of claim 18, wherein the client-side authentication library is shared by a plurality of management applications.

20. The network management method of claim 18, wherein the server-side authentication library is shared by a plurality of gateway components.

21. The network management method of claim 18, wherein the server-side authentication library is implemented in C++.

22. The network management method of claim 18, wherein the user profile comprises a user name and a password.

23. The network management method of claim 22, wherein the user profile further comprises a designation of a management information server (MIS) to which the user wishes to connect.

24. The network management method of claim 18, wherein the platform-independent interface specification comprises a specification expressed in an interface definition language (IDL), wherein the interface definition language is operable to define object interfaces across a plurality of platforms and across a plurality of programming languages.

25. The network management method of claim 18, wherein the user profile is encrypted and decrypted according to a user-selected encryption scheme.

26. The network management method of claim 18, wherein the client-side authentication library and the server-side authentication library are operable to authenticate requests received by a CORBA gateway, wherein the requests comprise management requests to one or more managed objects, and wherein the management requests are sent by one or more manager applications.

27. A network management method comprising:

implementing one or more pluggable authentication modules;

a client manager application encrypting a user profile associated with a user of a client manager application via one of the pluggable authentication modules;

a gateway receiving the encrypted user profile from the client manager application;

the gateway decrypting the user profile to authenticate the user for one or more network services via the one of the pluggable authentication modules.

28. The network management method of claim 27, wherein the one or more pluggable authentication modules are implemented in accordance with a platform-independent interface specification.

29. The network management method of claim 28, wherein the platform-independent interface specification comprises a specification expressed in an interface definition language (IDL), wherein the interface definition language is operable to define object interfaces across a plurality of platforms and across a plurality of programming languages.

30. The network management method of claim 27, wherein the pluggable authentication modules comprise:

a client-side authentication library deployed on one or more client computer systems, wherein the client-side authentication library comprises functions which are operable to retrieve and encrypt a user profile associated with a user, and wherein the client-side library is implemented for one or more client platforms respectively corresponding to each of the one or more client computer systems; and

a server-side authentication library deployed on a server computer system coupled to the client computer system, wherein the server-side authentication library comprises functions which are operable to receive the encrypted user profile from the client-side authentication library and decrypt the user profile to authenticate the user for one or more network services, and wherein the server-side library is implemented for a server platform corresponding to the server computer system.

31. The network management method of claim 30, wherein the client-side authentication library and the server-side authentication library are operable to authenticate requests received by a CORBA gateway, wherein the requests comprise management requests to one or more managed objects, and wherein the management requests are sent by one or more manager applications.

32. The network management method of claim 27, wherein the user profile is encrypted and decrypted according to a user-selected encryption scheme.

33. The network management method of claim 27, wherein the user profile comprises a user name and a password.

34. The network management method of claim 33, wherein the user profile further comprises a designation of a management information server (MIS) to which the user wishes to connect.

35. A carrier medium comprising program instructions for network management,

wherein the program instructions are computer-executable to perform:

encrypting a user profile associated with a user via a client-side authentication library, wherein the client-side authentication library is implemented for a client platform in accordance with a platform-independent interface specification expressed in an interface definition language (IDL), and wherein the client platform corresponds to a client computer system;

receiving the encrypted user profile from the client computer system via the client-side authentication library;

decrypting the user profile to authenticate the user for one or more network services via a server-side authentication library, wherein the server-side authentication library is implemented for a server platform in accordance with the platform-independent interface specification, and wherein the server platform corresponds to a server computer system.

36. The carrier medium of claim 35, wherein the client-side authentication library is shared by a plurality of management applications.

37. The carrier medium of claim 35, wherein the server-side authentication library is shared by a plurality of gateway components.

38. The carrier medium of claim 35, wherein the server-side authentication library is implemented in C++.

39. The carrier medium of claim 35, wherein the user profile comprises a user name and a password.

40. The carrier medium of claim 39, wherein the user profile further comprises a designation of a management information server (MIS) to which the user wishes to connect.

41. The carrier medium of claim 35, wherein the platform-independent interface specification comprises a specification expressed in an interface definition language (IDL), wherein the interface definition language is operable to define object interfaces across a plurality of platforms and across a plurality of programming languages.

42. The carrier medium of claim 35, wherein the user profile is encrypted and decrypted according to a user-selected encryption scheme.

43. The carrier medium of claim 35, wherein the client-side authentication library and the server-side authentication library are operable to authenticate requests received by a CORBA gateway, wherein the requests comprise management requests to one or more managed objects, and wherein the management requests are sent by one or more manager applications.

44. A carrier medium comprising program instructions for network management,

wherein the program instructions are computer-executable to perform:

implementing one or more pluggable authentication modules;

a client manager application sending a user profile associated with a user of a client manager application via one of the pluggable authentication modules;

a gateway receiving the user profile from the client manager application;

the gateway authenticating the user for one or more network services via the one of the pluggable authentication modules.

45. The carrier medium of claim 44,

wherein the client manager application sending the user profile comprises encrypting the user profile prior to delivery of the user profile,

wherein the gateway receiving the user profile from the client manager application comprises receiving the encrypted user profile from the client manager application, and

wherein the gateway authenticating the user for one or more network services comprises decrypting the user profile to authenticate the user for one or more network services.

46. The carrier medium of claim 44, wherein the one or more pluggable authentication modules are implemented in accordance with a platform-independent interface specification.

47. The carrier medium of claim 46, wherein the platform-independent interface specification comprises a specification expressed in an interface definition language (IDL), wherein the interface definition language is operable to define object interfaces across a plurality of platforms and across a plurality of programming languages.

48. The carrier medium of claim 44, wherein the pluggable authentication modules comprise:

a client-side authentication library deployed on one or more client computer systems, wherein the client-side authentication library comprises functions which are operable to retrieve and encrypt a user profile associated with a user, and wherein the client-side library is implemented for one or more client platforms respectively corresponding to each of the one or more client computer systems; and

a server-side authentication library deployed on a server computer system coupled to the client computer system, wherein the server-side authentication library comprises functions which are operable to receive the encrypted user profile from the client-side authentication library and decrypt the user profile to authenticate the user for one or more network services, and wherein the server-side library is implemented for a server platform corresponding to the server computer system.

49. The carrier medium of claim 48, wherein the client-side authentication library and the server-side authentication library are operable to authenticate requests received by a CORBA gateway, wherein the requests comprise management requests to one or more managed objects, and wherein the management requests are sent by one or more manager applications.

50. The carrier medium of claim 44, wherein the user profile is encrypted and decrypted according to a user-selected encryption scheme.

51. The carrier medium of claim 44, wherein the user profile comprises a user name and a password.

52. The carrier medium of claim 51, wherein the user profile further comprises a designation of a management information server (MIS) to which the user wishes to connect.