Authentication ticket processing apparatus and method with improved performance for self-contained ticket

• US 8,612,745 B2
• Filed: 11/17/2006
• Issued: 12/17/2013
• Est. Priority Date: 11/22/2005
• Status: Active Grant

• Current Assignee: Ricoh Company Limited
• Original Assignee: Ricoh Company Limited
• Inventors: Oseto, Futoshi, Yamamoto, Kensaku, Kawada, Jun
• Primary Examiner(s): Arani, Taghi
• Assistant Examiner(s): Kabir, Jahangir
• Application Number:
  US11/561,070
• Publication Number:
  US 20070118734A1
• Time in Patent Office: 2,587 Days
• Field of Search: 713/150, 713/155, 713/159, 726 1- 4, 726 16- 20, 726/26, 726/27
• US Class Current: 713/155
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807

Abstract

An authentication ticket processing apparatus includes a temporary data storage unit configured to keep user information upon receiving the user information from a user management database for managing user information, the temporary data storage unit allowing access thereto to be performed at higher speed than access to the user management database. The authentication ticket processing apparatus is configured such that, when there is a need to acquire user information in response to a decoding request from a server, a check is made whether user information corresponding to the decoding request is present in the temporary data storage unit, and the corresponding user information is acquired from the temporary data storage unit if the corresponding user information is present in the temporary data storage unit.

Claims

1. An authentication ticket processing apparatus comprising:

an authentication ticket generator generating an authentication ticket including a valid period for a client in response to an authentication request;

a supplier supplying relevant user information including user ID information in response to a decoding request from a server regarding an authentication ticket associated with a service request when the client is to receive a series of services from a plurality of servers that are independently operable;

a memory storing and managing user information received from a user management database, the memory storing an expiration time period corresponding to a time period from receipt of information and providing access to the user management database, the expiration time period being loaded by the authentication ticket generator into the memory;

a user authentication controller checking, via a processor and when there is a need to acquire user information in response to the decoding request from the server, whether user information corresponding to the decoding request is stored in the memory, and acquiring the corresponding user information from the memory when the corresponding user information is stored in the memory;

a controller controlling data stored in the memory and deleting user information stored in the memory upon passage of the expiration time period,

wherein

the valid period is separate from and independent of the expiration time period,

the memory stores and associates the user information with information indicative of a time of receipt of information, the time of receipt of information being a time at which the user information is received from the user management database, and

the expiration time period is extended in response to an access of data of the memory.

2. The authentication ticket processing apparatus according to claim 1, wherein the corresponding user information is acquired from the user management database instead of the memory when the corresponding user information is not stored in the memory.

3. The authentication ticket processing apparatus according to claim 1, wherein the extension of the expiration time period is restricted to be within a predetermined time limit from the time of receipt of information.

4. The authentication ticket processing apparatus according to claim 1, wherein the client defines a collaboration with the plurality of servers.

5. The authentication ticket processing apparatus according to claim 1, wherein one of the plurality of servers defines an application that defines a collaboration with the plurality of servers.

6. The authentication ticket processing apparatus according to claim 1, wherein authentication ticket includes a definition of services that defines a collaboration with the plurality of servers.

7. An authentication ticket processing method comprising:

generating, at an authentication ticket generator, an authentication ticket including a valid period for a client in response to an authentication request;

supplying, at a supplying unit, relevant user information including user ID information in response to a decoding request from a server regarding an authentication ticket associated with a service request when the client is to receive a series of services from a plurality of servers that are independently operable;

storing and managing, in a memory, user information received from a user management database, the memory storing an expiration time period corresponding to a time period from receipt of information and providing access to the user management database, the expiration time period being loaded by the authentication ticket generator into the memory;

storing and associating, at the memory, the user information with information indicative of a time of receipt of information, the time of receipt of information being a time at which the user information is received from the user management database;

checking, at a user authentication controlling unit via a processor, when there is a need to acquire user information in response to the decoding request from the server, whether user information corresponding to the decoding request is stored in the memory;

acquiring, at the user authentication controlling unit, the corresponding user information from the memory when the corresponding user information is stored in the memory; and

deleting, at a control unit, the user information stored in the memory upon passage of the expiration time period,

wherein

the valid period is separate from and independent of the expiration time period, and

the expiration time period is extended in response to an access of data of the memory.

8. The authentication ticket processing method according to claim 7, wherein the corresponding user information is acquired from the user management database instead of the memory when the corresponding user information is not stored in the memory.

9. The authentication ticket processing method according to claim 7, wherein the extension of the expiration time period is restricted to be within a predetermined time limit from the time of receipt of information.

10. The authentication ticket processing method according to claim 7, further comprising:

defining a collaboration with the plurality of servers from an instruction by the client.

11. The authentication ticket processing method according to claim 7, further comprising:

defining a collaboration with the plurality of servers from an application defined by one of the plurality of servers.

12. The authentication ticket processing method according to claim 7, further comprising:

defining a collaboration with the plurality of servers from a definition of services included with the authentication ticket.