Distributed authentication user interface system

• US 8,181,010 B1
• Filed: 04/17/2006
• Issued: 05/15/2012
• Est. Priority Date: 04/17/2006
• Status: Active Grant

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Oracle America, Inc. (Oracle Corporation)
• Inventors: Uchil, Mrudul P., Ranganathan, Aravindan
• Primary Examiner(s): Arani, Taghi
• Assistant Examiner(s): Mehedi, Morshed
• Application Number:
  US11/379,008
• Time in Patent Office: 2,220 Days
• Field of Search: 726/2, 726/3, 713/170
• US Class Current: 713/152
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213

Abstract

A system for authenticating a request to access a protected network resource behind two security layers is disclosed. The system includes a client which contains a web browser, a first server tier, and second server tier. The first server tier is protected behind a first security layer and hosts a first software object and second software object. The first server tier is operatively coupled to the client system via a first connection wherein the first software object and second software object are configured to be in communications with the web browser. The second server tier is protected behind the first security layer and second security layer and hosts an authentication service. The second server tier is operatively coupled to the first server tier via a second connection wherein the authentication service is configured to be in communications with the second software object.

Claims

1. A computer implemented method for authenticating a request to access a protected network resource, comprising:

receiving the request to access the protected network resource at a first software object, the request originating from a web browser;

permitting access to the protected network resource by the first software object, if the request includes a required authentication token to access the protected network resource;

re-directing the request to a distributed software object by the first software object, if the request does not include the required authentication token to access the protected network resource, the distributed software object being protected by a first security layer;

translating the re-directed request into a client credentials requirement input call for an authentication service, by the distributed software object;

communicating the client credentials requirement input call by the distributed software object across a second security layer to the authentication service using a backchannel that only allows communication through the distributed software object, the first software object being prevented from accessing the authentication service, the authentication service being protected by the second security layer, the second security layer being behind the first security layer, wherein the authentication service resides in a distinct space that is separate from the space where the first software object, the distributed software object and the protected network resource reside;

requesting input from the authentication service specifying a required authentication solution by the distributed software object based on the client credentials requirement input call;

receiving the input from the authentication service to the distributed software object; and

arbitrating an authentication transaction sequence between the web browser and the authentication service based upon the received input, wherein arbitration between the web browser and the authentication service is only through the distributed software object without utilizing the first software object, wherein the arbitration includes,

receiving a response with the required authentication solution by the distributed software object using the web browser, the response enabling issuance of a new authentication token by the authentication service to the distributed software object so as to allow the distributed software object to re-direct the web browser to the first software object for accessing the protected network resource.

2. The method for authenticating a request to access a protected network resource, as recited in claim 1, wherein:

the authentication transaction sequence includes,

relaying the input to the web browser by the distributed software object;

receiving the response with an authentication solution by the distributed software object using the web browser;

relaying the response to the authentication service by the distributed software object;

determining if the authentication solution has been provided through the authentication service is the required authentication solution; and

issuing the new authentication token by the authentication service to the distributed software object if the required authentication solution is provided in the response, the distributed software object re-directing the web browser to the first software object, the new authentication token enabling the web browser to access the protected network resource through the first software object.

3. The method for authenticating a request to access a protected network resource, as recited in claim 1, wherein the first software object is one of a web agent or web application configured to restrict access to the protected network resource.

4. The method for authenticating a request to access a protected network resource, as recited in claim 1, wherein each of the first security layer and the second security layer is one of a device-based firewall or a software-based firewall.

5. The method for authenticating a request to access a protected network resource, as recited in claim 1, wherein the authentication solution is selected from the group consisting of a personal identification number, a password, a keystroke sequence, biometric data, an Smartcard, or a security token.

6. The method for authenticating a request to access a protected network resource, as recited in claim 2, further comprising:

sending an error message to the distributed software object if the required authentication solution is not provided in the response; and

relaying the error message to the web browser by the distributed software object.

7. A computer system for implementing authentication of a request to access a protected network resource behind two security layers, comprising:

an authentication server, the authentication server hosting a first software object and a second software object, the first software object and the second software object capable of being executed by a microprocessor, the first software object and the second software object being protected by a first security layer, the first software object including a web agent residing within a first web container, the web agent configured to provide access to the protected network resource if the request includes a required authentication token and to communicate with the second software object if the request does not include the required authentication token to access the protected network resource, the second software object including a distributed authentication module residing within a second web container, the distributed authentication module configured to,

translate the request into a client credentials requirement input call for an authentication service;

communicate the client credentials requirement input call to the authentication service using a backchannel that only allows communication through the distributed authentication module, the web agent being prevented from accessing the authentication service;

request input from the authentication service specifying a required authentication solution based on the client credentials requirement input call; and

arbitrate authentication transactions between a web browser requesting the protected network resource outside the two security layers and the authentication service, the authentication service being protected by a second security layer, the second security layer being behind the first security layer, wherein the authentication service resides in a distinct space that is separate from the space where the first software object, the second software object and the protected network resource reside, wherein arbitration between the authentication service and the web browser is provided only through the distributed authentication module without utilizing the web agent, wherein the arbitration includes,

receiving a response with the required authentication solution by the second software object using the web browser based on relaying of the input to the web browser by the second software object, the response enabling issuance of a new authentication token by the authentication service to the second software object so as to allow the second software object to re-direct the web browser to the first software object for accessing the protected network resource.

8. The system for authenticating a request to access a protected network resource behind two security layers, as recited in claim 7, wherein each of the first security layer and the second security layer is one of a device-based firewall or software-based firewall.

9. The system for authenticating a request to access a protected network resource behind two security layers, as recited in claim 7, wherein the authentication service is hosted on an identity server.

10. The system for authenticating a request to access a protected network resource behind two security layers, as recited in claim 7, wherein the distributed authentication module is configured to intercept all authentication transactions between the web browser and the authentication service.

11. The system for authenticating a request to access a protected network resource behind two security layers, as recited in claim 7, wherein the web agent is configured to determine if the request contains an authentication token, the web agent permitting the web browser to access the protected network resource if the request contains the authentication token and re-directing the request to the distributed authentication module if the request does not contain the authentication token.

12. The system for authenticating a request to access a protected network resource behind two security layers, as recited in claim 7, wherein if the response contains the required authentication solution the authentication service generates the new authentication token, the new authentication token enabling the web browser to access the protected network resource.

13. The system for authenticating a request to access a protected network resource behind two security layers, as recited in claim 12, wherein the required authentication solution is selected from the group consisting of a personal identification number (PIN), a password, a keystroke sequence, biometric data, an identification (ID) card, or a security token.

14. A computer system for implementing authentication of a request to access a protected network resource behind two security layers, comprising:

a client, the client containing a web browser;

a first server tier protected behind a first security layer, the first server tier hosting a first software object and a second software object, the first software object and the second software object capable of being implemented by a microprocessor, the first server tier being operatively coupled to the client system via a first connection, wherein the first software object and the second software object are each configured to be in communications with the web browser; and

a second server tier protected behind the first security layer and a second security layer, the second server tier hosting an authentication service, wherein the authentication service resides in a distinct space that is separate from the space where the first software object, the second software object and the protected network resource reside, the second server tier being operatively coupled to the first server tier via a second connection, wherein the authentication service is configured to be in communications with the second software object,

wherein the first software object is configured to provide access to the protected network resource if the request includes a required authentication token and to communicate with the second software object if the request does not include the required authentication token to access the protected network resource and wherein the second software object is configured to,

translate the request into a client credentials requirement input call for an authentication service;

communicate the client credentials requirement input call to the authentication service using a backchannel that only allows communication through the distributed software object in the first server tier, the first software object being prevented from accessing the authentication service;

request input from the authentication service specifying a required authentication solution based on the client credentials requirement input call; and

arbitrate authentication transactions between a web browser requesting the protected network resource outside the two security layers and the authentication service, wherein arbitration between the web browser and the authentication service is provided only through the distributed authentication module without utilizing the first software object, wherein the arbitration includes,

receiving a response with the required authentication solution by the distributed software object using the web browser, the response enabling issuance of a new authentication token by the authentication service to the distributed software object so as to allow the distributed software object to re-direct the web browser to the first software object for accessing the protected network resource.

15. The system for authenticating a request to access a protected network resource behind two security layers, as recited in claim 14, wherein the first server tier and the second server tier are integrated into a single authentication server.

16. The system for authenticating a request to access a protected network resource behind two security layers, as recited in claim 14, wherein the first software object is hosted by a first authentication server and the second software object is hosted by a second authentication server.

17. The system for authenticating a request to access a protected network resource behind two security layers, as recited in claim 14, wherein the first software object is a web agent restricting access to the protected network resource.

18. The system for authenticating a request to access a protected network resource behind two security layers, as recited in claim 14, wherein the second software object is a distributed authentication object, the distributed authentication object being configured to intercept and arbitrate all authentication transactions between the web browser and the authentication service.

19. The system for authenticating a request to access a protected network resource behind two security layers, as recited in claim 16, wherein each of the first security layer and the second security layer is one of a device-based firewall or a software-based firewall.

20. The system for authenticating a request to access a protected network resource behind two security layers, as recited in claim 14, wherein the second connection is a backchannel connection, the backchannel connection being configured to solely permit communication transactions between the distributed authentication object and the authentication service.