Method and apparatus for associating tickets in a ticket hierarchy

• US 7,748,032 B2
• Filed: 09/30/2004
• Issued: 06/29/2010
• Est. Priority Date: 09/30/2004
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Simmons, Timothy Ernest
• Primary Examiner(s): Cervetti; David Garcia
• Application Number:
  US10/711,729
• Publication Number:
  US 20060095334A1
• Time in Patent Office: 2,098 Days
• Field of Search: 726/10
• US Class Current: 726/10
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Abstract

A method and apparatus for associating session ticket includes a ticketing authority server. The ticketing authority server receives a ticket generation request and information about a client node. It identifies a master session ticket associated in a storage element with the client node. The ticketing authority server then generates a derivative session ticket for the client node and associates the derivative session ticket with the master session ticket. Finally, the ticketing authority server stores information about the client node and the derivative session ticket in the storage element.

Claims

1. A method of associating session tickets, the method comprising the steps of:

(a) receiving, by a ticketing authority server, a ticket generation request and information about a client node;

(b) identifying, by the ticketing authority server, a master session ticket stored in a storage element and associated with the client node;

(c) generating, by the ticketing authority server, a derivative session ticket for the client node;

(d) assigning to the derivative session ticket, by the ticketing authority server, one of a plurality of session profile types configured by a policy engine, the assigned session profile type including a session expiration date for the derivative session ticket;

(e) associating, by the ticketing authority server, the derivative session ticket with the master session ticket; and

(f) storing, by the ticketing authority server, information about the client node and the derivative session ticket in the storage element.

2. The method of claim 1 wherein step (b) further comprises identifying a master session ticket for the client node by using the received information to query the storage element.

3. The method of claim 1 wherein step (c) comprises generating a master session ticket for the client node.

4. The method of claim 1 wherein step (c) further comprises assigning, by the ticketing authority server, the session profile type to the derivative session ticket, the session profile type including at least one of:

session renewable rights and session failure reconnection rights.

5. The method of claim 1 wherein step (e) further comprises associating, by the ticketing authority server, the derivative session ticket and the master session ticket by storing a reference to the derivative session ticket in the storage element entry for the master session ticket.

6. A system for associating session tickets comprising:

a master session ticket;

a derivative session ticket;

a policy engine configuring a plurality of session profile types; and

a ticketing authority server receiving a ticket generation request and information about a client node, identifying the master session ticket associated with the client node, generating the derivative session ticket for the client node, assigning to the derivative session ticket one of the plurality of session profile types, associating the derivative session ticket with the master session ticket, and storing information about the client node and the derivative session ticket in a storage element, wherein the assigned session profile type includes a session expiration date for the derivative session ticket.

7. The system of claim 6 wherein the master session ticket further comprises a client identifier.

8. The system of claim 7 wherein the client identifier comprises a user name.

9. The system of claim 7 wherein the client identifier comprises a domain name.

10. The system of claim 6 wherein the master session ticket further comprises one of the plurality of session profile types configured via a policy engine.

11. The system of claim 6 wherein the assigned session profile type includes at least one of:

session renewable rights and session failure reconnection rights.

12. The system of claim 6 wherein the derivative session ticket further comprises a reference to the master session ticket.

13. A method of renewing associated session tickets, the method comprising the steps of:

receiving, by a ticket authority server, a session ticket renewal request and a session ticket;

retrieving, by the ticket authority server, the session associated with the received session ticket;

renewing, by the ticket authority server, a session expiration date of the session;

retrieving, by the ticket authority server, a master session ticket associated with the received session ticket;

renewing, by the ticket authority server, a session expiration date of the master session ticket;

retrieving, by the ticket authority server, any derivative ticket associated with the master session ticket; and

renewing, by the ticket authority server, a session expiration date of the derivative session ticket associated with the master session ticket.

14. The method of claim 13 wherein step (b) further comprises querying a storage element to retrieve session information associated with the received session ticket.