Authentication of users in a computer network

Patent metadata

Field	Value
Publication number	US-10764263-B2
Application number	US-201615361672-A
Country	US
Kind code	B2
Filing date	Nov 28, 2016
Priority date	Nov 28, 2016
Publication date	Sep 1, 2020
Grant date	Sep 1, 2020

Abstract

Apparatuses and methods for authenticating a user to a host by an agent are disclosed. In the method the agent receives a connection request to the host from the user. In response to the received connection request, the agent determines an ephemeral authenticator, and acquires using the ephemeral authenticator a second authenticator. The second authenticator is based at least in part on use of the ephemeral authenticator. The agent then authenticates the user to the host using the second authenticator.

First claim

I claim:

1. A network device comprising at least one processor, and memory storing instructions that, when executed, are configured to provide an authentication agent entity to:
receive, via a network, by the authentication agent entity provided in the network device, and from a user device, a connection request to a host,
in response to receiving the connection request, determine, by the authentication agent entity, at least one user role for the user device,
acquire, by the authentication agent entity and from an authorization device, an ephemeral authenticator based on the determined at least one user role, and
perform, by the authentication agent entity, based on the connection request, and with the host, authentication using the acquired ephemeral authenticator.

2. The network device of claim 1 , configured to acquire the ephemeral authenticator from an apparatus configured to provide a certificate authority.

3. The network device of claim 1 , configured to store ephemeral authenticators in the memory, and to retrieve the ephemeral authenticator from the memory based on the determined at least one user role in response to receiving the connection request.

4. The network device of claim 3 , wherein the memory comprises a volatile memory.

5. The network device of claim 1 , wherein the ephemeral authenticator comprises a certificate.

6. The network device of claim 5 , wherein the certificate includes at least part of a public key part of another ephemeral authenticator.

7. The network device of claim 1 , wherein the ephemeral authenticator has a further restriction, the further restriction comprising a limitation in a number of times the ephemeral authenticator can be used and/or a limitation in uses of the ephemeral authenticator.

8. The network device of claim 1 , further configured to acquire a second authenticator using the acquired ephemeral authenticator, wherein the second authenticator is based at least in part on the ephemeral authenticator.

9. The network device of claim 8 , wherein the second authenticator is based on use of an ephemeral keypair and at least one permanent authenticator.

10. The network device of claim 1 , wherein the authentication agent entity is distinct from the authorization device.

11. The network device of claim 1 , wherein the acquired ephemeral authenticator is associated with a validity period.

12. A method for authenticating a user device to a host by an authentication agent entity provided in a network device, comprising:
receiving, via a network, by the authentication agent entity provided in the network device, and from the user device, a connection request to the host,
in response to the received connection request, determining, by the authentication agent entity, at least one user role for the user device,
acquiring, by the authentication agent entity and from an authorization device, an ephemeral authenticator based on the determined at least one user role for the user device, and
authenticating, by the authentication agent entity and based on the connection request, the user device to the host using the acquired ephemeral authenticator,
wherein the authentication agent entity is distinct from the authorization device.

13. The method of claim 12 , wherein the step of acquiring the ephemeral authenticator comprises creating the ephemeral authenticator.

14. The method of claim 12 , comprising storing ephemeral authenticators in a memory of the authentication agent entity, the step of acquiring comprising retrieving the ephemeral authenticator from the memory.

15. The method of claim 12 , wherein the ephemeral authenticator comprises a certificate.

16. The method of claim 15 , wherein the certificate includes at least part of a public key part of another ephemeral authenticator.

17. The method of claim 12 , wherein the ephemeral authenticator has a further restriction, the further restriction comprising a limitation in a number of times the ephemeral authenticator can be used and/or a limitation in uses of the ephemeral authenticator.

18. The method of claim 12 , wherein the ephemeral authenticator is based on use of an ephemeral keypair and at least one permanent authenticator.

19. A non-transitory computer readable media comprising program code for causing a processor to perform instructions for a security method in an authentication agent between hosts and devices requesting for access to the hosts in a computerized network, the security method performed comprising:
receiving, via the computerized network, by the authentication agent provided in a network device, and from a device of a user, a connection request to a host,
in response to the received connection request and by the authentication agent, determining at least one user role for the user,
acquiring, by the authentication agent and from an authorization device, an ephemeral authenticator based on the determined at least one user role, and
authenticating, by the authentication agent and based on the connection request, the device of the user to the host using the acquired ephemeral authenticator.

20. The non-transitory computer readable media of claim 19 , wherein the security method performed further comprises storing ephemeral authenticators in a memory of the network device, and wherein the acquiring comprises retrieving the ephemeral authenticator from the memory.

21. The non-transitory computer readable media of claim 20 , wherein the memory comprises a volatile memory.

22. The non-transitory computer readable media of claim 19 , wherein the ephemeral authenticator comprises a certificate.

Assignees

• Ssh Communications Security Oyj

Inventors

• Rossi Markku

Classifications

• H04L9/3268 Primary

  using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL] · CPC title

• H04L63/0281

  Proxies · CPC title

• H04L63/0884

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L63/068 Primary

  using time-dependent keys, e.g. periodically changing keys (cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088) · CPC title