Broker-Based Authentication System Architecture and Design

Patent metadata

Field	Value
Publication number	US-2016259936-A1
Application number	US-201514639713-A
Country	US
Kind code	A1
Filing date	Mar 5, 2015
Priority date	Mar 5, 2015
Publication date	Sep 8, 2016
Grant date	—

Abstract

A system and method that grants a token to authenticate a user requesting access to an application in a domain is disclosed. The method includes receiving a response from an identity (ID) provider in a second domain responsive to a first request from a user to access an application provided by an application server in a first domain, the response indicating the authenticity of the user in the second domain, randomly selecting a first key and a second key from a key store, generating a secret by randomly permuting the first key and the second key, generating a signature by signing user information associated with the user using the secret, generating an authentication token including the signature, determining whether the authentication token is valid, and responsive to determining that the authentication token is valid, granting access to the first application to the user based on the authentication token.

First claim

What is claimed is:

1 . A computer-implemented method comprising:
receiving, with one or more processors, a response from an identity provider in a second domain responsive to a first request from a user to access an application provided by an application server in a first domain, the response indicating the authenticity of the user in the second domain; randomly selecting a first key and a second key from a key store; generating, with the one or more processors, a secret by randomly permuting the first key and the second key; generating, with the one or more processors, a signature by signing user information associated with the user using the secret; and generating an authentication token including the signature.

2 . The method of claim 1 , wherein the authentication token is used for both session-based and session-less authentication.

3 . The method of claim 1 , wherein generating the authentication token including the signature is independent from an authentication scheme utilized by the identity provider.

4 . The method of claim 1 , comprising:
determining, at an application server, whether the authentication token is valid; and responsive to determining that the authentication token is valid, granting, at the application server, access to the first application to the user based on the authentication token.

5 . The method of claim 4 , wherein determining, at the application server, whether the authentication token is valid comprises:
reforming a secret based on first information included in the authentication token; reforming a signature by signing second information included in the authentication token using the reformed secret; comparing, with the one or more processors, the reformed signature with the signature included in the authentication token; and determining whether the authentication token is valid based on the comparison.

6 . The method of claim 1 , wherein determining, at the application server, whether the authentication token is valid comprises comparing a current token time with a token presenting time included in the authentication token.

7 . The method of claim 1 , comprising updating a version of the key store, and wherein randomly selecting the first key and the second key is based on the updated version of the key store.

8 . The method of claim 1 , wherein the key store is shared with a trusted group using a two-way transport layer security protocol.

9 . The method of claim 1 , comprising:
authenticating the user in the second domain at the identity provider; generating, by the identity provider, the response indicating the authenticity of the user in the second domain; and redirecting the response from the identify provider to an authentication server.

10 . The method of claim 9 , wherein authenticating the user in the second domain is based on a federated identity authentication approach.

11 . The method of claim 9 , comprising:
responsive to receiving the response, determining whether there is a user role associated with the user in the first domain; and responsive to determining that a user role associated with the user in the first domain is present, generating the authentication token.

12 . The method of claim 1 , wherein the first request is received from the user using a browser, the method further comprising:
receiving a second request to access the application from the user via the browser; generating a refresh token for the user; determining whether the refresh token is valid; and responsive to determining that the refresh token is valid, granting access to the application to the user sending the second request.

13 . A system comprising:
one or more processors; the one more processors configured to:
receive a response from an identity provider in a second domain responsive to a first request from a user to access an application provided by an application server in a first domain, the response indicating the authenticity of the user in the second domain;
randomly select a first key and a second key from a key store;
generate a secret by randomly permuting the first key and the second key;
generate a signature by signing user information associated with the user using the secret; and
generate an authentication token including the signature.

14 . The system of claim 13 , comprising an application server having a processor and memory, the application server configured to:
determine whether the authentication token is valid; and responsive to determining that the authentication token is valid, grant access to the first application to the user based on the authentication token.

15 . The system of claim 13 , wherein the application server is also configured to determine whether the authentication token is valid by:
reforming a secret based on first information included in the authentication token; reforming a signature by signing second information included in the authentication token using the reformed secret; comparing the reformed signature with the signature included in the authentication token; and determining whether the authentication token is valid based on the comparison.

16 . The system of claim 13 , wherein the application server is also configured to determine whether the authentication token is valid by comparing a current token time with a token presenting time included in the authentication token.

17 . The system of claim 13 , wherein the one or more processors are further configured to update a version of the key store, and wherein randomly selecting the first key and the second key is based on the updated version of the key store.

18 . The system of claim 13 , comprising an identity provider having a processor and memory, the identity provider configured to:
authenticate the user in the second domain; generate the response indicating the authenticity of the user in the second domain; and send the response from the identity provider to an authentication server.

19 . The system of claim 13 , wherein the application server separates patient profile information from patient medical data and patient medical data does not contain any data that can uniquely identify a patient.

20 . The system of claim 13 , wherein the first request is received from the user using a browser, the one or more processors further configured to:
receive a second request to access a second application from the user via the browser; generate a refresh token for the user; determine whether the refresh token is valid; and responsive to determining that the refresh token is valid, grant access to the second application to the user based on the refresh token.

Assignees

• Mukherjee Phalguni
• Namboodiri Vipin
• Rao Boppana Visweswra
• Ricoh Co Ltd

Inventors

• Mukherjee Phalguni
• Namboodiri Vipin
• Rao Boppana Visweswra

Classifications

• H04L63/061

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title

• H04L63/0815

  providing single-sign-on or federations · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• G06F21/45 Primary

  Structures or tools for the administration of authentication · CPC title

• G06F21/31

  User authentication · CPC title