Client side authentication redirection

• US 8,397,077 B2
• Filed: 04/24/2008
• Issued: 03/12/2013
• Est. Priority Date: 12/07/2007
• Status: Active Grant

• Current Assignee: Pistolstar Incorporated
• Original Assignee: Pistolstar Incorporated
• Inventors: Hoey, Thomas J., Browinski, Gregg
• Primary Examiner(s): Tran, Ellen
• Application Number:
  US12/108,922
• Publication Number:
  US 20090150991A1
• Time in Patent Office: 1,783 Days
• Field of Search: 713/184, 713/183, 726/18
• US Class Current: 713/184
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

A device, method and system for authentication by a user are disclosed herein. The exemplary method may authenticate a user password entered by a user. User specific attributes may be accessed and used to produce a generated password. The generated password may be produced using an algorithm and the user attributes. The generated password may be used to log onto a resource for the user.

Claims

1. A computerized method for performing an automated client application login process for a user, the automated client application login process transparent to a user of the computer, the method comprising:

receiving, from a computer operating system, a user name and a clear-text password previously entered by a user for authenticating the user, wherein the act of performing an automated client application login process for a user includes accessing a pre-existing user authentication directory, the pre-existing user authentication directory including a plurality of password protected user specific attributes, each of the plurality of password protected user specific attributes associated with a user name and a clear-text password of one system user;

subsequent to authenticating the user, receiving a user request to access a password protected client application;

responsive to the user request, the automated authentication process invoking a password interceptor process, transparent to the user;

the password interceptor process configured for retrieving an administratively predefined set of user attributes from the pre-existing user authentication directory, and whereby the automated authentication process produces a generated client application password from at least one of the administratively predefined set of user specific attributes using a pre-defined algorithm;

responsive to producing the generated client application password, the automated authentication process registering the generated client application password with the password protected client application as an authorized password for the user to access the password protected client application; and

wherein the computerized method next logs the authenticated user onto the password protected client application, transparent to the user, using the previously registered generated client application password.

2. The method of automated client application login of claim 1, wherein the pre-defined algorithm includes:

reading a random seed value from said user specific attributes in the user authentication directory;

using the random seed with a cascaded hash operation using multiple algorithms to produce a concatenated and encoded value; and

truncating the concatenated and encoded value.

3. The method of automated client application login of claim 1, wherein the generated client application password is made up of a plurality of user specific attributes from said user authentication directory, and wherein the predefined algorithm conceals the user specific attributes.

4. The method of automated client application login of claim 1, wherein said user specific attributes comprise local attributes and general attributes.

5. The method of automated client application login of claim 1, wherein one of the user specific attributes is a random value.

6. The method of automated client application login of claim 5, wherein one of the user specific attributes is selected from the group consisting of:

a) a key encoded into a client application'"'"'s binary files,

b) a MAC address of a network card of a user'"'"'s computer, and

c) a serial number of a user'"'"'s computer'"'"'s hard drive.

7. The method of automated client application login of claim 1, wherein said user specific attributes comprise external attributes.

8. The method of automated client application login of claim 7, wherein said external attributes are selected from the group consisting of:

a) an existing attribute of a USB token,

b) a random key stored on a USB token,

c) an existing attribute of a Smart card,

d) a random key stored on a Smart card,

e) an existing attribute in an Account Directory,

f) a random key stored in an Account Directory,

g) an existing attribute in a database, and

h) a random key stored in a database.

9. The method of automated client application login of claim 1, wherein one of said plurality of user specific attributes of said plurality of user specific attributes includes an automated client application login process generated seed value.

10. The method of automated client application login of claim 9, wherein said seed value for each user is generated from a pre-defined set of user specific attributes from said plurality of user specific attributes in the pre-existing user authentication directory for each said respective user.

11. The method of automated client application login of claim 1, wherein said generated key is a non-clear-text password.

12. The method of automated client application login of claim 1, further comprising the act of:

resetting, by a user or administrator, a user clear-text password stored as one of a plurality of user specific attributes in said pre-existing user authentication directory, and wherein resetting said user clear text password does not affect said generated client application password.

13. A system for performing client side application authentication and password generation of a user accessing a password protected client application, the system comprising:

a client side application authentication module, operating under control of a computer operating system, and configured for;

(1) receiving a user name and a clear-text password entered by a user to the computer operating system, the user name and password configured for identifying the user to the computer operating system, and upon receiving the user name and clear-text password entered by the user, the client side application authentication module configured for authenticating the user name and clear-text password by accessing a pre-existing user authentication directory, the pre-existing user authentication directory including a plurality of password protected user specific attributes, each of the plurality of password protected user specific attributes associated with a user name and a clear-text password of one system user; and

for (2) receiving a user request to access a password protected client application, the user request directed to the password protected client application, the client side application authentication module further configured for, transparently to the user, intercepting the user request to access the password protected client application and for accessing the password protected user specific attributes in the pre-existing user authentication directory of the previously authenticated user;

a password generation module, responsive to the client side application authentication module, and configured for accessing (1) a user specific administratively predefined set of the password protected user specific attributes located in the pre-existing user authentication directory and (2) a pre-defined algorithm, and for producing a generated application password using the pre-defined algorithm and the user specific administratively predefined set of user specific attributes; and

an access module, responsive to the password generation module, and configured for registering the generated application password with the client application, and for transparently to the user providing the generated application to the client application thereby logging the user onto the client application using the generated password.

14. The system for performing client side application authentication and password generation of a user of claim 13, wherein the pre-defined algorithm of the password generation module is configured for:

reading a random seed value from a user specific attribute in the user authentication directory;

using the random seed with a cascaded hash operation using multiple algorithms to produce a concatenated and encoded value; and

truncating the concatenated and encoded value.