Secure user authentication in a dynamic network

Patent metadata

Field	Value
Publication number	US-9692744-B2
Application number	US-201615183995-A
Country	US
Kind code	B2
Filing date	Jun 16, 2016
Priority date	Mar 18, 2013
Publication date	Jun 27, 2017
Grant date	Jun 27, 2017

Abstract

A method, apparatus and/or computer program provides secure user authentication in a network having a dynamic set of services. The method comprises a client authenticating with an edge service and generating a query key. The edge service issues a request to the dynamic set of services. The request comprises (i) an encrypted identifier associated with the client, (ii) a private portion of the request being encrypted with the query key, and (iii) a public portion of the request. In response to ascertaining from the public portion of the request that it is able to respond to the request, one or more of the dynamic set of services respond to the edge service with (i) an identifier associated with the dynamic set of services, and (ii) the identifier associated with the client. The edge service then authenticates that it is able to respond to the request, including generating a session key.

First claim

What is claimed is:

1. A method for secure user authentication in a network having a dynamic set of services, the method comprising:
a hardware client computer authenticating with an edge service by authenticating with an Authentication Server (AS) that provides a first ticket allowing the hardware client computer to authenticate with a Ticket Granting Service (TGS), wherein the TGS provides a second ticket allowing the hardware client computer to authenticate with the edge service;
the hardware client computer generating a query key using a one way function of a portion of the first ticket provided by the AS to allow the hardware client computer to authenticate with the TGS;
an authentication hardware server that authenticates an edge service that issues a request to the dynamic set of services, the request comprising:
an identifier associated with the hardware client computer, the identifier being encrypted with the query key,
a private portion of the request being encrypted with the query key, wherein the private portion of the request is shared only with services that have been authenticated by the authentication hardware server, and
a public portion of the request, wherein the public portion of the request is shared with all services that can respond to the request regardless of authentication by the authentication hardware server;

a hardware network having a dynamic set of services, wherein one or more of said dynamic set of services, in response to ascertaining from said public portion of the request that the one or more of said dynamic set of services is able to respond to the request, respond to the edge service with (i) an identifier associated with the one or more of said dynamic set of services, and (ii) the identifier associated with the hardware client computer, wherein the identifier associated with the hardware client computer is encrypted with the query key; wherein the edge service authenticates with the one or more of said dynamic set of services that the edge service is able to respond to the request by authenticating with the AS, wherein the AS provides a third ticket allowing the edge service to authenticate with the TGS, wherein the TGS provides a fourth ticket allowing a single service to authenticate with one or more of said dynamic set of services, wherein the edge service generates a session key using a one way function of a portion of the third ticket provided by the AS to allow the edge service to authenticate with the TGS; and wherein the edge service sends the query key, to said one or more of said dynamic set of services, encrypted using the session key; and
accessing, by one or more processors, a specific service from said one or more of the dynamic set of services by traversing through multiple intermediary services in order to reach the specific service, wherein at least one service from said multiple intermediary services provides access to the query key.

2. The method as claimed in claim 1 , wherein the one or more of said dynamic set of services caches the query key from a request for use with a future request from the hardware client computer.

3. The method as claimed in claim 1 , wherein the query key is sent, to said one or more of said dynamic set of services, encrypted using the session key by another one or more of said dynamic set of services.

4. The method as claimed in claim 1 , further comprising:
mitigating attacks against said dynamic set of services by:
modifying, by an untrusted service, the request while in transit by removing an attack vector in the request;
spoofing, by a trusted service, a fake query from an arbitrary client computer that is different from said hardware client computer, wherein said trusted service:
generates a fake query key KQ for the arbitrary client computer and sends out a request posting as the arbitrary client computer; and
turns on a credential delegation such that a downstream service requires current credentials for the arbitrary client computer to be delegated before the arbitrary client computer can act as the arbitrary client computer;

pretending, by the untrusted service, to respond to the fake query, wherein the untrusted service is unable to respond to the fake query; and
generating, by the trusted service, a query using a cached copy of the query key that was generated by the hardware client computer.

5. A computer program product for secure user authentication in a network having a dynamic set of services, the computer program product comprising a non-transitory computer readable storage medium having program code embodied therewith, the program code readable and executable by a processor to perform a method comprising:
a client computer authenticating with an edge service by authenticating with an Authentication Server (AS) that provides a first ticket allowing the client computer to authenticate with a Ticket Granting Service (TGS), wherein the first ticket has a lifetime that is defined by a predefined start time and a predefined end time, wherein the TGS provides a second ticket allowing the client computer to authenticate with the edge service;
the client computer generating a query key using a one way function of a portion of the first ticket provided by the AS to allow the client computer to authenticate with the TGS;
the edge service issuing a request to the dynamic set of services, the request comprising:
an identifier associated with the client computer, the identifier being encrypted with the query key,
a private portion of the request being encrypted with the query key, wherein the private portion of the request is shared only with services that have been authenticated by the AS, and
a public portion of the request, wherein the public portion of the request is shared with all services that can respond to the request regardless of authentication by the AS;

one or more of said dynamic set of services, in response to ascertaining from said public portion of the request that the one or more of said dynamic set of services is able to respond to the request, responding to the edge service with (i) an identifier associated with the one or more of said dynamic set of services, wherein the one or more of said dynamic set of services caches the query key from a request for use with a future request from the client computer, and (ii) the identifier associated with the client computer, wherein the identifier associated with the client computer is encrypted with the query key;
the edge service authenticating with the one or more of said dynamic set of services, that the edge service is able to respond to the request by authenticating with the AS, wherein the AS provides a third ticket allowing the edge service to authenticate with the TGS, wherein the TGS provides a fourth ticket allowing a single service to authenticate with one or more of said dynamic set of services, wherein the edge service generates a session key using a one way function of a portion of the third ticket provided by the AS to allow the edge service to authenticate with the TGS; and
the edge service sending the query key, to said one or more of said dynamic set of services, encrypted using the session key.

6. The computer program product as claimed in claim 5 , wherein the method further comprises: accessing a specific service from said one or more of the dynamic set of services by traversing through multiple intermediary services in order to reach the specific service, wherein at least one service from said multiple intermediary services provides access to the query key.

7. The computer program product as claimed in claim 5 , wherein the query key is sent, to said one or more of said dynamic set of services, encrypted using the session key by another one or more of said dynamic set of services.

Assignees

• IBM

Inventors

• Bent Graham A
• Harries Dominic P

Classifications

• H04L63/0807 Primary

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• H04L9/0822

  using key encryption key · CPC title