Strong user authentication for accessing protected network

Patent metadata

Field	Value
Publication number	US-9608981-B2
Application number	US-201314102694-A
Country	US
Kind code	B2
Filing date	Dec 11, 2013
Priority date	Dec 11, 2013
Publication date	Mar 28, 2017
Grant date	Mar 28, 2017

Abstract

Systems and methods for strong user authentication for accessing protected networks. An example method may include: transmitting, by a processing device, an authentication request to an authentication server; receiving an access granting token from the authentication server; transmitting, to a nonce server, a nonce request using the access granting token; receiving a cryptographic nonce from the nonce server; and transmitting, to a virtual private network (VPN) server, a VPN connection request using the cryptographic nonce.

First claim

What is claimed is:

1. A method, comprising:
transmitting, by a processor, an authentication request in view of a user authentication credential to an authentication server, wherein the authentication request comprises a first authentication factor and a second authentication factor;
receiving an access granting token from the authentication server;
providing the access granting token to gain a service ticket to access a nonce server;
transmitting, by the processor, directly to the nonce server, a nonce request in view of the service ticket;
receiving a cryptographic nonce from the nonce server, wherein the cryptographic nonce is generated using a secret shared by the nonce server and the authentication server such that the authentication server can validate the cryptographic nonce when presented by a virtual private network (VPN) server, and wherein the cryptographic nonce is provided by at least one of a short-lived certificate or a one-time password; and
transmitting, to VPN server, a VPN connection request comprising the cryptographic nonce for authentication of the cryptographic nonce by the VPN server to establish a VPN connection with the VPN server.

2. The method of claim 1 , further comprising:
establishing the VPN connection with the VPN server; and
accessing, in view of the access granting token, a computing resource via the VPN connection.

3. The method of claim 1 , wherein transmitting the authentication request is performed via an HTTP proxy server.

4. The method of claim 1 , wherein transmitting the authentication request is performed over an SSL connection.

5. The method of claim 1 , wherein the authentication request conforms to a Kerberos protocol.

6. A method, comprising:
responsive to receiving an authentication request in view of a user authentication credential from a client computer system, generating an access granting token by an authentication server, wherein the authentication request comprises a first authentication factor and a second authentication factor;
transmitting, by a processor of a server computer system, the access granting token to the client computer system;
responsive to receiving an access request in view of the access granting token, providing a service ticket for direct access to a nonce server to request a cryptographic nonce by the client computer system, wherein the cryptographic nonce is generated by the nonce server using a secret shared by the nonce server and the authentication server such that the authentication server can validate the cryptographic nonce when presented by a virtual private network (VPN) server, and wherein the cryptographic nonce is provided by at least one of a short-lived certificate or a one-time password;
responsive to receiving a VPN connection request comprising the cryptographic nonce, authenticating the cryptographic nonce; and
responsive to a successful authentication of the cryptographic nonce, establishing a VPN connection with the client computer system.

7. The method of claim 6 , wherein generating an access granting token is performed according to Kerberos protocol.

8. A computer system comprising:
a memory; and
a processor, operatively coupled to the memory, to:
transmit an authentication request in view of a user authentication credential to an authentication server, wherein the authentication request comprises a first authentication factor and a second authentication factor;
receive an access granting token from the authentication server;
providing the access granting token to gain a service ticket to access a nonce server;
transmit, directly to the nonce server, a nonce request in view of the service ticket;

receive a cryptographic nonce from the nonce server, wherein the cryptographic nonce is generated using a secret shared by the nonce server and the authentication server such that the authentication server can validate the cryptographic nonce when presented by a virtual private network (VPN) server, and wherein the cryptographic nonce is provided by at least one of a short-lived certificate or a one-time password; and
transmit, to VPN server, a VPN connection request comprising the cryptographic nonce for authentication of the cryptographic nonce by the VPN server to establish a VPN connection with the VPN server.

9. The system of claim 8 , wherein the processor is further to:
establish the VPN connection with the VPN server; and
access, in view of the access granting token, a computing resource via the VPN connection.

10. The system of claim 8 , wherein to transmit the authentication request is to transmit the authentication request via an HTTP proxy server.

11. The system of claim 8 , wherein the authentication request conforms to a Kerberos protocol.

12. A computer-readable non-transitory storage medium comprising executable instructions to cause a processor to:
transmit, by the processor, an authentication request in view of a user authentication credential to an authentication server, wherein the authentication request comprises a first authentication factor and a second authentication factor;
receive an access granting token from the authentication server;
transmit, by the processor, to a nonce server, a nonce request in view of the access granting token;
receive a cryptographic nonce from the nonce server, wherein the cryptographic nonce is generated using a secret shared by the nonce server and the authentication server such that the authentication server can validate the cryptographic nonce when presented by a virtual private network (VPN) server, and wherein the cryptographic nonce is provided by at least one of a short-lived certificate or a one-time password; and
transmit, to VPN server, a VPN connection request comprising the cryptographic nonce for authentication of the cryptographic nonce by the VPN server to establish a VPN connection with the VPN server.

13. The computer-readable non-transitory storage medium of claim 12 , further comprising executable instructions to cause the processor to:
establish the VPN connection with the VPN server; and
access, in view of the access granting token, a computing resource via the VPN connection.

14. The computer-readable non-transitory storage medium of claim 12 , wherein to transmit the authentication request, the processor is to transmit the authentication request via an HTTP proxy server.

15. The computer-readable non-transitory storage medium of claim 12 , wherein the authentication request conforms to a Kerberos protocol.

Assignees

• Red Hat Inc

Inventors

• Pal Dmitri

Classifications

• H04L63/0272

  Virtual private networks · CPC title

• H04L2463/082

  applying multi-factor authentication · CPC title

• H04L63/0807 Primary

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title