System, method and program for user authentication, and recording medium on which the program is recorded

• US 7,712,129 B2
• Filed: 02/14/2005
• Issued: 05/04/2010
• Est. Priority Date: 03/30/2004
• Status: Expired due to Fees

• Current Assignee: AirBNB Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Takehi, Masahiro
• Primary Examiner(s): Korzuch; William R
• Assistant Examiner(s): Vaughan; Michael R
• Application Number:
  US10/598,875
• Publication Number:
  US 20070199059A1
• Time in Patent Office: 1,905 Days
• Field of Search: None
• US Class Current: 726/6
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24

Abstract

Method and system for user authentication in a federated computing environment. The method includes a first method for recording server authentication information, including: establishing a trusting relationship between a first and second server, obtaining an authentication policy of the second server, and registering the authentication policy of the second server within the first server. The method includes a second method for registering new user authentication information of a new user, including: verifying that the new user authentication information conforms to an authentication policy of the first server, and registering the new user authentication information in the first server. The method includes a third method for authenticating a user, including: receiving an access request from the user to access the federated computing environment, receiving notification based on input authentication information that the user has been authorized for the requested access, and permitting the user to access the federated computing environment.

Claims

1. A method for recording server authentication information, said method comprising:

establishing, by a first server of a plurality of servers in a federated computing environment, a trusting relationship between the first server and a second server of the plurality of servers, wherein said establishing the trusting relationship comprises exchanging, by the first server, an electronic certificate of the first server with an electronic certificate of the second server in accordance with a Public Key Infrastructure (PKI) method;

after said establishing the trusting relationship, obtaining by the first server an authentication policy of the second server, wherein an authentication policy for each server of the plurality of servers is defined as at least one rule of each server for authenticating users of the federated computing environment; and

after said obtaining the authentication policy of the second server, registering by the first server the authentication policy of the second server within the first server, wherein the at least one rule consists of four rules, said four rules consisting of a number of alphabetic characters of a user identification (ID), a number of numeric characters of the user ID, a data size for fingerprint authentication, and a data size for voice print authentication.

2. The method of claim 1, wherein said registering the authentication policy of the second server comprises registering the authentication policy of the second server in an authentication policy table of the first server, wherein the authentication policy table of the first server comprises an authentication policy of each server of the plurality of servers registered therein, and wherein the authentication policy table of the first server further comprises:

a server address of each server registered therein; and

a relative priority of each server of a group of servers having a same authentication policy in the authentication policy table.

3. The method of claim 1, wherein said registering the authentication policy of the second server comprises registering the authentication policy of the second server in an authentication policy table of the first server, wherein the authentication policy table of the first server comprises an authentication policy of each server of the plurality of servers registered therein, wherein the authentication policy of the second server is identical to an authentication policy of the first server, wherein a first common user identifier (ID) exists in an authentication information Lightweight Directory Access Protocol (LDAP) of the first server and in an authentication information LDAP of the second server, wherein the first common user ID is used by a first user in the first server and by a second user in the second server such that the second user differs from the first user, and wherein the method further comprises:

after said registering the authentication policy of the second server, registering by the first server the first common user ID in a exceptional ID table of the first server, wherein the exceptional ID table of the first server stores common user IDs and an indication of one or more servers associated with each common user ID stored in the exceptional ID table of the first server.

4. A method for recording server authentication information, said method comprising:

establishing, by a first server of a plurality of servers in a federated computing environment, a trusting relationship between the first server and a second server of the plurality of servers, wherein said establishing the trusting relationship comprises exchanging, by the first server, an electronic certificate of the first server with an electronic certificate of the second server in accordance with a Public Key Infrastructure (PKI) method;

after said establishing the trusting relationship, obtaining by the first server an authentication policy of the second server, wherein an authentication policy for each server of the plurality of servers is defined as at least one rule of each server for authenticating users of the federated computing environment; and

after said obtaining the authentication policy of the second server, registering by the first server the authentication policy of the second server within the first server,

wherein the method further comprises;

receiving, by the first server, an access request from a user to access the federated computing environment, wherein the first server comprises an authentication policy table that comprises the authentication policy of each server of the plurality of servers registered therein;

after said receiving the access request, receiving by the first server input authentication information from the user;

obtaining, by the first server, a server address of the second server, wherein the authentication policy of the second server matches an authentication policy of the first server;

transmitting, by the first server to the second server via the server address of the second server, the input authentication information;

after said transmitting the input authentication information to the second server, receiving by the first server from the second server a notification that the second server has successfully authorized the user; and

after said receiving the notification that the second server has successfully authorized the user, permitting the user to access the federated computing environment, wherein said permitting is performed by the first server.

5. The method of claim 4, wherein after said transmitting the input authentication information to the second server and before said permitting the user to access the federated computing environment, the method further comprises:

receiving by the first server from the second server a token that may be used by the user to access the federated computing environment; and

sending, by the first server, the token to the user.

6. The method of claim 5, wherein the token is a credential and a cookie.

7. The method of claim 4, wherein the at least one rule includes a data size for fingerprint authentication, a data size for voice print authentication, or a combination thereof.

8. A system for recording server authentication information, said system comprising:

a first server of a plurality of servers in a federated computing environment; and

a computer readable storage medium;

first program code for establishing, by the first server, a trusting relationship between the first server and a second server comprised by the plurality of servers, wherein said establishing the trusting relationship comprises exchanging, by the first server, an electronic certificate of the first server with an electronic certificate of the second server in accordance with a Public Key Infrastructure (PKI) method;

second program code for obtaining by the first server an authentication policy of the second server after said establishing the trusting relationship, wherein an authentication policy for each server of the plurality of servers is defined as at least one rule of each server for authenticating users of the federated computing environment; and

third program code for registering by the first server the authentication policy of the second server within the first server after said obtaining the authentication policy of the second server, wherein the first program code, the second program code, and the third program code are stored on the computer readable storage medium, and wherein the at least one rule consists of four rules, said four rules consisting of a number of alphabetic characters of a user identification (ID), a number of numeric characters of the user ID, a data size for fingerprint authentication, and a data size for voice print authentication.

9. The system of claim 8, wherein said third program code for registering the authentication policy of the second server comprises code for registering the authentication policy of the second server in an authentication policy table of the first server, wherein the authentication policy table of the first server comprises an authentication policy of each server of the plurality of servers registered therein, wherein the authentication policy table of the first server further comprises:

a server address of each server registered therein; and

a relative priority of each server of a group of servers having a same authentication policy in the authentication policy table.

10. The system of claim 8, wherein said third program code for registering the authentication policy of the second server comprises code for registering the authentication policy of the second server in an authentication policy table of the first server, wherein the authentication policy table of the first server comprises an authentication policy of each server of the plurality of servers registered therein, wherein the authentication policy of the second server is identical to an authentication policy of the first server, wherein a first common user identifier (ID) exists in an authentication information Lightweight Directory Access Protocol (LDAP) of the first server and in an authentication information LDAP of the second server, wherein the first common user ID is used by a first user in the first server and by a second user in the second server such that the second user differs from the first user, and wherein the system further comprises:

program code, stored on the computer readable storage medium, for registering by the first server the first common user ID in a exceptional ID table of the first server after said registering the authentication policy of the second server, wherein the exceptional ID table of the first server stores common user IDs and an indication of one or more servers associated with each common user ID stored in the exceptional ID table of the first server.

11. A system for recording server authentication information, said system comprising:

a first server of a plurality of servers in a federated computing environment; and

a computer readable storage medium;

first program code for establishing, by the first server, a trusting relationship between the first server and a second server comprised by the plurality of servers, wherein said establishing the trusting relationship comprises exchanging, by the first server, an electronic certificate of the first server with an electronic certificate of the second server in accordance with a Public Key Infrastructure (PKI) method;

second program code for obtaining by the first server an authentication policy of the second server after said establishing the trusting relationship, wherein an authentication policy for each server of the plurality of servers is defined as at least one rule of each server for authenticating users of the federated computing environment; and

third program code for registering by the first server the authentication policy of the second server within the first server after said obtaining the authentication policy of the second server,

wherein the first program code, the second program code, and the third program code are stored on the computer readable storage medium, and

wherein the system further comprises;

fourth program code for receiving, by the first server, an access request from a user to access the federated computing environment, wherein the first server comprises an authentication policy table that comprises the authentication policy of each server of the plurality of servers registered therein;

fifth program code for receiving by the first server input authentication information from the user after said receiving the access request;

sixth program code for obtaining, by the first server, a server address of the second server, wherein the authentication policy of the second server matches an authentication policy of the first server;

seventh program code for transmitting, by the first server to the second server via the server address of the second server, the input authentication information;

eighth program code for receiving by the first server from the second server a notification that the second server has successfully authorized the user after said transmitting the input authentication information to the second server; and

ninth program code for permitting the user to access the federated computing environment, wherein said permitting is performed by the first server after said receiving the notification that the second server has successfully authorized the user,

wherein the fourth program code, the fifth program code, the sixth program code, the seventh program code, the eighth program code, and the ninth program code are stored on the computer readable storage medium.

12. The system of claim 11, wherein the system further comprises:

tenth program code for receiving by the first server from the second server a token that may be used by the user to access the federated computing environment after said transmitting the input authentication information to the second server and before said permitting the user to access the federated computing environment; and

eleventh program code for sending, by the first server, the token to the user,

wherein the tenth program code and the eleventh program code are stored on the computer readable storage medium.

13. The system of claim 12, wherein the token is a credential and a cookie.

14. The system of claim 11, wherein the at least one rule includes a data size for fingerprint authentication, a data size for voice print authentication, or a combination thereof.

15. A computer program product for recording server authentication information, said computer program product comprising:

a computer readable storage medium;

first program code for establishing, by a first server of a plurality of servers, a trusting relationship between the first server and a second server comprised by the plurality of servers, wherein said establishing the trusting relationship comprises exchanging, by the first server, an electronic certificate of the first server with an electronic certificate of the second server in accordance with a Public Key Infrastructure (PKI) method;

second program code for obtaining by the first server an authentication policy of the second server after said establishing the trusting relationship, wherein an authentication policy for each server of the plurality of servers is defined as at least one rule of each server for authenticating users of the federated computing environment; and

third program code for registering by the first server the authentication policy of the second server within the first server after said obtaining the authentication policy of the second server,

wherein the first program code, the second program code, and the third program code are stored on the computer readable storage medium and wherein the at least one rule consists of four rules, said four rules consisting of a number of alphabetic characters of a user identification (ID), a number of numeric characters of the user ID, a data size for fingerprint authentication, and a data size for voice print authentication.

16. The computer program product of claim 15, wherein said third program code for registering the authentication policy of the second server comprises code for registering the authentication policy of the second server in an authentication policy table of the first server, wherein the authentication policy table of the first server comprises an authentication policy of each server of the plurality of servers registered therein, wherein the authentication policy table of the first server Further comprises:

a server address of each server registered therein; and

a relative priority of each server of a group of servers having a same authentication policy in the authentication policy table.

17. The computer program product of claim 15, wherein said third program code for registering the authentication policy of the second server comprises code for registering the authentication policy of the second server in an authentication policy table of the first server, wherein the authentication policy table of the first server comprises an authentication policy of each server of the plurality of servers registered therein, wherein the authentication policy of the second server is identical to an authentication policy of the first server, wherein a first common user identifier (ID) exists in an authentication information Lightweight Directory Access Protocol (LDAP) of the first server and in an authentication information LDAP of the second server, wherein the first common user ID is used by a first user in the first server and by a second user in the second server such that the second user differs from the first user, and wherein the computer program product further comprises:

program code, stored on the computer readable storage medium, for registering by the first server the first common user ID in a exceptional ID table of the first server after said registering the authentication policy of the second server, wherein the exceptional ID table of the first server stores common user IDs and an indication of one or more servers associated with each common user ID stored in the exceptional ID table of the first server.

18. A computer program product for recording server authentication information, said computer program product comprising:

a computer readable storage medium;

first program code for establishing, by a first server of a plurality of servers, a trusting relationship between the first server and a second server comprised by the plurality of servers, wherein said establishing the trusting relationship comprises exchanging, by the first server, an electronic certificate of the first server with an electronic certificate of the second server in accordance with a Public Key Infrastructure (PKI) method;

second program code for obtaining by the first server an authentication policy of the second server after said establishing the trusting relationship, wherein an authentication policy for each server of the plurality of servers is defined as at least one rule of each server for authenticating users of the federated computing environment; and

third program code for registering by the first server the authentication policy of the second server within the first server after said obtaining the authentication policy of the second server,

wherein the first program code, the second program code, and the third program code are stored on the computer readable storage medium, and

wherein the computer program product further comprises;

fourth program code for receiving, by the first server, an access request from a user to access the federated computing environment, wherein the first server comprises an authentication policy table that comprises the authentication policy of each server of the plurality of servers registered therein;

fifth program code for receiving by the first server input authentication information from the user after said receiving the access request;

sixth program code for obtaining, by the first server, a server address of the second server, wherein the authentication policy of the second server matches an authentication policy of the first server;

seventh program code for transmitting, by the first server to the second server via the server address of the second server, the input authentication information;

eighth program code for receiving by the first server from the second server a notification that the second server has successfully authorized the user after said transmitting the input authentication information to the second server; and

ninth program code for permitting the user to access the federated computing environment, wherein said permitting is performed by the first server after said receiving the notification that the second server has successfully authorized the user,

wherein the fourth program code, the fifth program code, the sixth program code, the seventh program code, the eighth program code, and the ninth program code are stored on the computer readable storage medium.

19. The computer program product of claim 18, wherein the computer program product further comprises:

tenth program code for receiving by the first server from the second server a token that may be used by the user to access the federated computing environment after said transmitting the input authentication information to the second server and before said permitting the user to access the federated computing environment; and

eleventh program code for sending, by the first server, the token to the user,

wherein the tenth program code and the eleventh program code are stored on the computer readable storage medium.

20. The computer program product of claim 19, wherein the token is a credential and a cookie.

21. The computer program product of claim 18, wherein the at least one rule includes a data size for fingerprint authentication, a data size for voice print authentication, or a combination thereof.