Message authentication using message gates in a distributed computing environment

• US 7,577,834 B1
• Filed: 08/31/2000
• Issued: 08/18/2009
• Est. Priority Date: 05/09/2000
• Status: Active Grant

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Slaughter, Gregory L., Saulpaugh, Thomas E., Traversat, Bernard A., Duigou, Michael J.
• Primary Examiner(s): CHEN, SHIN HON
• Application Number:
  US09/653,227
• Time in Patent Office: 3,274 Days
• Field of Search: 713/200, 713/201, 713/168, 713/153, 713/182, 713/185, 713/156, 713/175, 395/650, 395/200, 395/725, 340/825.52, 370/85, 370/913, 707/10, 726/5, 726/18, 726/19
• US Class Current: 713/156
• CPC Class Codes: G06F 9/547 Remote procedure calls [RPC]; Web services
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services

Abstract

Embodiments of a system and method using message authentication with message gates are described. A message gate is the message endpoint for a client or service in a distributed computing environment. A message gate may provide a secure endpoint that sends and receives type-safe messages. Gates may perform the sending and receiving of messages between clients and services using a protocol specified in a service advertisement. In one embodiment, the messages are eXtensible Markup Language (XML) messages. For a client, a message gate represents the authority to use some or all of a service'"'"'s capabilities. Each capability may be expressed in terms of a message that may be sent to the service. Creation of a message gate may involve an authentication service that may authenticate the client and/or service and that generates an authentication credential. A message gate may perform verification of messages against a message schema to ensure that the messages are allowed. Message gates may embed the authentication credential in outgoing messages so that the receiving message gate may authenticate the message. Messages may also include information to allow the receiving gate to verify that the message has not been compromised prior to receipt.

Claims

1. A method for communicating in a distributed computing environment, comprising:

a client accessing an authentication service to obtain an authentication credential to use a first service;

determining client capabilities for said client, wherein said client capabilities are capabilities of said first service that said client is permitted to use, wherein said determining client capabilities comprises accessing an access policy service to obtain a capability token indicating which capabilities of said first service said client is permitted to access;

binding said client capabilities to said authentication credential;

said client sending a first message to said first service, wherein said first message includes said authentication credential;

said first service using said authentication service to authenticate said authentication credential received in said first message; and

said first service responding to said first message if said authentication credential in said first message is determined to be authentic as from said client.

2. The method as recited in claim 1, further comprising said client obtaining an address for said authentication service from an advertisement for said first service, wherein said accessing an authentication service comprises said client sending a message to said address for said authentication service requesting said authentication credential to use said advertised first service.

3. The method as recited in claim 2, wherein said advertisement for said first service includes a data representation language schema defining a message interface for accessing said first service.

4. The method as recited in claim 3, wherein said first message corresponds to a message defined in said data representation language schema.

5. The method as recited in claim 4, further comprising said client sending additional messages to said first service to use said first service, wherein said authentication credential is included with each one of said additional messages, and wherein each one of said additional messages is defined by said data representation language schema.

6. The method as recited in claim 5, wherein said data representation language schema is an eXtensible Markup Language (XML) schema.

7. The method as recited in claim 1, further comprising:

said client sending a request message to said first service to access a capability of said first service, wherein said request message includes said authentication credential;

said first service determining that the capability requested in said request message is within said client capabilities; and

said first service fulfilling said request message only if the capability requested in said request message is within said client capabilities.

8. The method as recited in claim 1, wherein said accessing an access policy service to obtain a capability token indicating which capabilities of said first service said client is permitted to access is performed by said client.

9. The method as recited in claim 1, wherein said authentication service and said access policy service are combined as a single service and wherein said capability token is included within said authentication credential.

10. The method as recited in claim 1, wherein said determining client capabilities is performed by said first service.

11. The method as recited in claim 1, further comprising said client generating a message gate for accessing said first service, wherein said message gate sends request messages from said client to said first service to access said first service, and wherein said message gate includes said authentication credential in each message to said first service.

12. The method as recited in claim 11, further comprising said client obtaining a service advertisement for said first service before accessing said first service, wherein said service advertisement comprises an address for said authentication service and an address for said first service.

13. The method as recited in claim 12, wherein said service advertisement further comprises a data representation language schema defining a message interface for accessing said first service, wherein said message gate verifies that each message sent from said client to said first service complies with said data representation language schema.

14. The method as recited in claim 1, wherein said authentication service is a separately addressable service from said first service.

15. The method as recited in claim 1, wherein said client accessing an authentication service to obtain an authentication credential to use a first service comprises said authentication service returning said authentication credential to said client only if said client is authorized to access said first service.

16. A method for communication in a distributed computing environment, comprising:

a client obtaining a service advertisement for a first service, wherein said service advertisement includes an address for an authentication service;

said client sending a request message to said authentication service to obtain an authentication credential to use said first service;

said client generating a message gate for accessing said first service, wherein said message gate embeds said authentication credential in every message from said client to said first service; and

said client accessing said first service through said message gate.

17. The method as recited in claim 16, wherein said service advertisement further comprises a data representation language schema defining a message interface for accessing said first service, the method further comprising said message gate verifying that every message sent from said client to said first service complies with said data representation language schema.

18. The method as recited in claim 17, wherein said data representation language schema is an eXtensible Markup Language (XML) schema and said messages from said client to said first service are XML messages.

19. The method as recited in claim 16, further comprising said first service using said authentication service to determine if said authentication credential received in a first message from said client is authentic.

20. The method as recited in claim 19, further comprising, after authenticating said authentication credential received in said first message from said client, said first service determining which capabilities of said first service said client is authorized to use, wherein said first service responds to a request message from said client only if said request message is for an authorized capability for said client.

21. The method as recited in claim 20, further comprising said first service binding a determination of which capabilities of said first service said client is authorized to use to said authentication credential so that said first service does not need to repeat said determining which capabilities of said first service said client is authorized to use.

22. The method as recited in claim 19, further comprising said first service noting whether or not said authentication credential is authentic so that said first service does not need to repeat said using said authentication service to determine if said authentication credential received in a first message from said client is authentic.

23. The method as recited in claim 16, wherein said service advertisement for said first service further includes an address for accessing said first service, wherein said authentication service and said first service are separate services within the distributed computing environment.

24. The method as recited in claim 16, wherein said service advertisement further includes a service identifier token for said first service, wherein said client sending a request message to said authentication service to obtain an authentication credential comprises sending said service identifier token and a client identifier token to said authentication service.

25. The method as recited in claim 24, wherein said authentication service generates said authentication credential from said client identifier token and said service identifier token.

26. A client device configured to:

access an authentication service to obtain an authentication credential to use a first service;

determine client capabilities for said client device, wherein said client capabilities are capabilities of said first service that said client device is permitted to use; and

bind said client capabilities to said authentication credential;

generate a message gate for accessing said first service, wherein said message gate sends request messages from said client to said first service to access said first service, and wherein said message gate includes said authentication credential in each message to said first service;

send a first message to said first service, wherein said first message includes said authentication credential, wherein said first service is configured to use said authentication service to authenticate said authentication credential received in said first message; and

receive a response to said first message from said first service if said authentication credential in said first message is determined to be authentic as from said client device.

27. The client device as recited in claim 26, further configured to:

obtain an address for said authentication service from an advertisement for said first service;

wherein, in said accessing an authentication service, the client device is further configured to;

send a message to said address for said authentication service requesting said authentication credential to use said advertised first service.

28. The client device as recited in claim 27, wherein said advertisement for said first service includes a data representation language schema defining a message interface for accessing said first service, and wherein said first message corresponds to a message defined in said data representation language schema.

29. The client device as recited in claim 28, further configured to send additional messages to said first service to use said first service, wherein said authentication credential is included with each one of said additional messages, and wherein each one of said additional messages is defined by said data representation language schema.

30. The client device as recited in claim 28, wherein said data representation language schema is an eXtensible Markup Language (XML) schema.

31. The client device as recited in claim 26, further configured to:

send a request message to said first service to access a capability of said first service, wherein said request message includes said authentication credential;

wherein said first service is configured to fulfill said request message only if said first service determines that the capability requested in said request message is within said client capabilities.

32. The client device as recited in claim 26, wherein, in said determining client capabilities, the client device is further configured to access an access policy service to obtain a capability token indicating which capabilities of said first service said client is permitted to access.

33. The client device as recited in claim 32, wherein said authentication service and said access policy service are combined as a single service, and wherein said capability token is included within said authentication credential.

34. The client device as recited in claim 26, further configured to:

obtain a service advertisement for said first service before accessing said first service, wherein said service advertisement comprises a data representation language schema defining a message interface for accessing said first service;

wherein said message gate is configured to verify that each message sent from said client device to said first service complies with said data representation language schema.

35. The client device as recited in claim 26, wherein, in said accessing an authentication service to obtain an authentication credential to use a first service, the client device is further configured to receive from said authentication service said authentication credential only if said client device is authorized to access said first service.

36. The client device as recited in claim 26, wherein said authentication service and said first service are configured to execute within a service device, and wherein said client device is further configured to couple to said service device via a network.

37. The client device as recited in claim 26, wherein said client device is further configured to couple to a network via a wireless connection.

38. The client device as recited in claim 26,

wherein said authentication service is configured to execute within an authentication server;

wherein said first service is configured to execute within a service device; and

wherein said client device, said service device, and said authentication server are separate devices comprised in a distributed computing environment.

39. The client device as recited in claim 26, wherein said first service is configured to execute within said client device.

40. A service device configured to:

provide to a client an advertisement for said service device, wherein said advertisement includes a data representation language schema defining a message interface for accessing said service device;

receive from said client a first message including an authentication credential, wherein said first message corresponds to a message defined in said data representation language schema, wherein said client accesses an authentication service to obtain said authentication credential to use said service device;

use said authentication service to authenticate said authentication credential received in said first message;

determine client capabilities for said client, wherein said client capabilities are capabilities of said service device that said client is permitted to use;

bind said client capabilities to said authentication credential;

respond to said first message if said authentication credential in said first message is determined to be authentic as from said client; and

receive additional messages from said client to use said service device, wherein said authentication credential is included with each one of said additional messages, and wherein each one of said additional messages is defined by said data representation language schema.

41. The service device as recited in claim 40, wherein said data representation language schema is an eXtensible Markup Language (XML) schema.

42. The service device as recited in claim 40, further configured to:

receive from said client a request message to access a capability of said service device, wherein said request message includes said authentication credential;

determine that the capability requested in said request message is within said client capabilities; and

fulfill said request message only if the capability requested in said request message is within said client capabilities.

43. The service device as recited in claim 40, wherein said client is configured to execute within a client device, and wherein said service device and said client device are separate devices comprised in a distributed computing environment.

44. A distributed computing system, comprising:

a client device; and

a service device;

wherein said client device is configured to;

obtain an address for an authentication service from an advertisement for said service device;

access said authentication service to obtain an authentication credential to use said service device, wherein to access said authentication service, the client device is further configured to send a message to said address for said authentication service requesting said authentication credential to use said advertised service device; and

determine client capabilities for said client device, wherein said client capabilities are capabilities of said service device that said client device is permitted to use; and

bind said client capabilities to said authentication credential;

send a first message to said service device, wherein said first message includes said authentication credential; and

wherein said service device is configured to;

provide to said client device said advertisement for said service device, wherein said advertisement includes a data representation language schema defining a message interface for accessing said service device;

use said authentication service to authenticate said authentication credential received in said first message; and

respond to said first message if said authentication credential in said first message is determined to be authentic as from said client.

45. The system as recited in claim 44, wherein said advertisement for said service device includes a data representation language schema defining a message interface for accessing said service device, wherein said first message corresponds to a message defined in said data representation language schema.

46. The system as recited in claim 45, wherein the client device is further configured to send additional messages to said service device to use said service device, wherein said authentication credential is included with each one of said additional messages, and wherein each one of said additional messages is defined by said data representation language schema.

47. The system as recited in claim 45, wherein said data representation language schema is an eXtensible Markup Language (XML) schema.

48. The system as recited in claim 44, wherein said authentication service is configured to execute within said service device.

49. The system as recited in claim 44,

wherein said authentication service is configured to execute within an authentication server;

and

wherein said client device, said service device, and said authentication server are separate devices comprised in a distributed computing environment.

50. A distributed computing system, comprising:

a client device;

a service device;

wherein said client device is configured to;

obtain a service advertisement for said service device, wherein said service advertisement includes an address for an authentication service;

send a request message to said authentication service to obtain an authentication credential to use said service device;

generate a message gate for accessing said service device, wherein said message gate is configured to embed said authentication credential in every message from said client device to said service device; and

access said service device through said message gate.

51. The system as recited in claim 50,

wherein said service advertisement further comprises a data representation language schema defining a message interface for accessing said service device;

and

wherein said message gate is further configured to verify that every message sent from said client device to said service device complies with said data representation language schema.

52. The system as recited in claim 51, wherein said data representation language schema is an eXtensible Markup Language (XML) schema and said messages from said client device to said service device are XML messages.

53. The system as recited in claim 50, wherein said service device is configured to:

use said authentication service to determine if said authentication credential received in a first message from said client device is authentic;

determine which capabilities of said service device said client device is authorized to use; and

respond to said first message from said client device only if said first message is for an authorized capability for said client device.

54. A computer-readable, storage medium comprising program instructions, wherein the program instructions are computer-executable to implement:

providing to a client an advertisement for a service, wherein said advertisement includes a data representation language schema defining a message interface for accessing said service, wherein said client accesses an authentication service to obtain an authentication credential to use said service;

determining client capabilities for said client, wherein said client capabilities are capabilities of said service that said client is permitted to use;

binding said client capabilities to said authentication credential;

receiving from said client a first message to said service, wherein said first message corresponds to a message defined in said data representation language schema, wherein said first message includes said authentication credential;

using said authentication service to authenticate said authentication credential received in said first message;

responding to said first message if said authentication credential in said first message is determined to be authentic as from said client; and

receive additional messages from said client to use said service, wherein said authentication credential is included with each one of said additional messages, and wherein each one of said additional messages is defined by said data representation language schema.

55. The computer-readable, storage medium as recited in claim 54, wherein said advertisement further includes

an address for said authentication service.

56. The computer-readable, storage medium as recited in claim 54, wherein said data representation language schema is an eXtensible Markup Language (XML) schema.

57. The computer-readable, storage medium as recited in claim 54, wherein the program instructions are further computer-executable to implement:

determining that a capability requested in one of the messages received from said client is within said client capabilities; and

fulfilling said one of the messages only if the capability requested in said message is within said client capabilities.

58. The computer-readable, storage medium as recited in claim 54, wherein the program instructions are further computer-executable to implement:

receiving said additional messages from a message gate of the client.

59. The computer-readable, storage medium as recited in claim 58, wherein

said message gate verifies that each message sent from said client to said first service complies with said data representation language schema.

60. A computer-readable, storage medium comprising program instructions, wherein the program instructions are computer-executable to implement:

a client obtaining a service advertisement for a first service, wherein said service advertisement includes an address for an authentication service;

said client sending a request message to said authentication service to obtain an authentication credential to use said first service;

said client generating a message gate for accessing said first service, wherein said message gate embeds said authentication credential in every message from said client to said first service; and

said client accessing said first service through said message gate.

61. The computer-readable, storage medium as recited in claim 60, wherein said service advertisement further comprises a data representation language schema defining a message interface for accessing said first service, and wherein the program instructions are further computer-executable to implement:

said message gate verifying that every message sent from said client to said first service complies with said data representation language schema.

62. The computer-readable, storage medium as recited in claim 61, wherein said data representation language schema is an eXtensible Markup Language (XML) schema and said messages from said client to said first service are XML messages.

63. The computer-readable, storage medium as recited in claim 60, wherein the program instructions are further computer-executable to implement:

said first service using said authentication service to determine if said authentication credential received in a first message from said client is authentic;

said first service determining which capabilities of said first service said client is authorized to use; and

said first service responding to said first message from said client only if said first message is for an authorized capability for said client.