Centralized pluggable authentication and authorization

Patent metadata

Field	Value
Publication number	US-2016234196-A1
Application number	US-201514742239-A
Country	US
Kind code	A1
Filing date	Jun 17, 2015
Priority date	Feb 11, 2015
Publication date	Aug 11, 2016
Grant date	—

Abstract

In particular embodiments, a first computing device may receive a request from a second computing device to access a first entity of an infrastructure, the second computing device being coupled to the first computing device, then determining an eligibility of the second computing device to access as least the first entity of the infrastructure, and if the second computing device is determined to be eligible to access the first entity, then assigning a second ticket to the second computing device responsive to the received request.

First claim

What is claimed is:

1 . A method comprising, by a first computing device of an infrastructure:
receiving a request from a second computing device to access a first entity of the infrastructure, the second computing device being coupled to the first computing device, wherein the request comprises a first ticket previously assigned by the first computing device, and wherein the first ticket authenticates and authorizes the second computing device for access to at least a second entity of the infrastructure; determining an eligibility of the second computing device to access at least the first entity of the infrastructure based at least on the first ticket and the first entity; and if the second computing device is determined to be eligible to access the first entity, assigning a second ticket to the second computing device responsive to the received request, wherein the second ticket authenticates and authorizes the second computing device for access to at least the first entity of the infrastructure.

2 . The method of claim 1 , wherein the first computing device comprises a third-party pluggable authentication and authorization (PAA) ticket server.

3 . The method of claim 1 , wherein assigning the second ticket to the second computing device comprises:
nullifying the first ticket previously assigned by the first computing device; and sending the second ticket to the second computing device.

4 . The method of claim 1 , wherein an entity comprises one or more of a computing device, a data, or software.

5 . The method of claim 1 , wherein the infrastructure comprises an enterprise infrastructure.

6 . The method of claim 1 , wherein the first computing device is associated with a third-party encryption service, and wherein accessibility of the second computing device to pre-determined entities of the infrastructure is provided by the third-party encryption service.

7 . The method of claim 6 , wherein the assigned second ticket comprises one or more keys for the second computing device to access at least the first entity of the infrastructure, the first entity being associated with the pre-determined entities of the infrastructure.

8 . The method of claim 1 , wherein determining the eligibility of the second computing device to access at least the first entity of the infrastructure comprises determining an eligibility of a user of the second computing device to access at least the first entity of the infrastructure.

9 . The method of claim 1 , wherein the second entity comprises a remote desktop gateway of the infrastructure.

10 . The method of claim 1 , wherein the access to the first entity comprises a modification to the first entity.

11 . One or more computer-readable non-transitory storage media embodying logic that is operable when executed to:
by a first computing device of an infrastructure:
receiving a request from a second computing device to access a first entity of the infrastructure, the second computing device being coupled to the first computing device, wherein the request comprises a first ticket previously assigned by the first computing device, and wherein the first ticket authenticates and authorizes the second computing device for access to at least a second entity of the infrastructure;
determining an eligibility of the second computing device to access at least the first entity of the infrastructure based at least on the first ticket and the first entity; and
if the second computing device is determined to be eligible to access the first entity, assigning a second ticket to the second computing device responsive to the received request, wherein the second ticket authenticates and authorizes the second computing device for access to at least the first entity of the infrastructure.

12 . The media of claim 11 , wherein the first computing device comprises a third-party pluggable authentication and authorization (PAA) ticket server.

13 . The media of claim 11 , wherein the first computing device is associated with a third-party encryption service, and wherein accessibility of the second computing device to pre-determined entities of the infrastructure is provided by the third-party encryption service.

14 . The media of claim 13 , wherein the assigned second ticket comprises one or more keys for the second computing device to access at least the first entity of the infrastructure, the first entity being associated with the pre-determined entities of the infrastructure.

15 . The media of claim 11 , wherein the second entity comprises a remote desktop gateway of the infrastructure.

16 . An information handling system comprising:
one or more processors; and a memory coupled to the processors comprising instructions executable by the processors, the processors being operable when executing the instructions to:
by a first computing device of an infrastructure:
receiving a request from a second computing device to access a first entity of the infrastructure, the second computing device being coupled to the first computing device, wherein the request comprises a first ticket previously assigned by the first computing device, and wherein the first ticket authenticates and authorizes the second computing device for access to at least a second entity of the infrastructure;
determining an eligibility of the second computing device to access at least the first entity of the infrastructure based at least on the first ticket and the first entity; and
if the second computing device is determined to be eligible to access the first entity, assigning a second ticket to the second computing device responsive to the received request, wherein the second ticket authenticates and authorizes the second computing device for access to at least the first entity of the infrastructure.

17 . The information handling system of claim 16 , wherein the first computing device comprises a third-party pluggable authentication and authorization (PAA) ticket server.

18 . The information handling system of claim 16 , wherein the first computing device is associated with a third-party encryption service, and wherein accessibility of the second computing device to pre-determined entities of the infrastructure is provided by the third-party encryption service.

19 . The information handling system of claim 18 , wherein the assigned second ticket comprises one or more keys for the second computing device to access at least the first entity of the infrastructure, the first entity being associated with the pre-determined entities of the infrastructure.

20 . The information handling system of claim 16 , wherein the second entity comprises a remote desktop gateway of the infrastructure.

Assignees

• Dell Products Lp

Inventors

• Fausak Andrew T
• Rombakh Oleg

Classifications

• H04L12/4679

  Arrangements for the registration or de-registration of VLAN attribute values, e.g. VLAN identifiers, port VLAN membership · CPC title

• H04L67/148 Primary

  Migration or transfer of sessions · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L63/0807 Primary

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• H04L67/1001

  for accessing one among a plurality of replicated servers · CPC title