EP0456920A2
Expired / Lapsed
EP
⏱️ 0.0 years remaining
Remote authentication and authorisation in a distributed data processing system
Assignee: International Business Machines Corp
•
Filing: 1990-04-10
•
Granted: —
•
Expires: 2010-04-10
Abstract
Abstract The disclosed system and method authorises a process running at a client data processing system to have access to a service at a server data processing system. The data processing systems are connected by a communication link in a distributed processing environment. A set of credentials for the process are created at the server in response to a message from the client requesting a service. The server returns a credentials id identifying the created set of credentials to the client process. The client uses this returned id in subsequent requests and is authorised access as controlled by the set of credentials identified by the returned id in the subsequent request. The server can deny access to the service by the process if the id returned in a subsequent request is determined by the server not to identify the set of credentials. The server denies the access if the server requires an authentication of the process.
Inventors
- 👤 Donavon William Johnson
- 👤 Todd Allen Smith
Bibliographic Details
Application Number
—
Jurisdiction
EP
Data Source
google_patents
Last Synchronized
2026-10-24 22:17
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/60; G06F21/62; G06F21/6218
Claims Analysis
Total Claims: 17
Claim 1
Independent Claim
93 words
A method for authorising a process running at a first data processing system to have access to a service at a second data processing system, the method comprising: creating at the second data processing system, a set of credentials for the process in response to a first received request; returning a value to the first data processing system; receiving at the second data processing system a second received request comprising a value; and using the value to determine the set of credentials during access to the service at the second data processing system.
Claim 2
Dependent Claim
78 words
A method as claimed in Claim 1, wherein the use of the value comprises: determining, at the second data processing system, if the second received value identifies the created set of credentials; and allowing the access to the service as controlled by the set of credentials if the second received value identifies the created set of credentials, or denying access to the service if the second received value is determined not to identify the created set of credentials.
Claim 3
Dependent Claim
41 words
A method as claimed in Claim 2, wherein the determining step checks that the second received value does/does not identify the created set of credentials when the second data processing system discards at least one element of the set of credentials.
Claim 4
Independent Claim
18 words
A method as claimed in any preceding claim, wherein the second received request is received from the process.
Claim 5
Independent Claim
25 words
A method as claimed in any of claims 1 to 3, wherein the second received request is received from a child process of the process.
Claim 6
Independent Claim
41 words
A method as claimed in any preceding claim, wherein the creating step includes sending, to the second data processing system, a first request comprising information required by the second data processing system to construct a set of credentials for the process.
Claim 7
Independent Claim
21 words
A method as claimed in any preceding claim, wherein the returned value is maintained in a data area of the process.
Claim 8
Dependent Claim
33 words
A method as claimed in Claim 7, further comprising obtaining the value from the data area by a child process and sending the second request from the child process with the obtained value.
Claim 9
Dependent Claim
25 words
A method as claimed in either claim for Claim 8, further comprising discarding the value in the data area if the required information is changed.
Claim 10
Independent Claim
184 words
A method, in a data processing system, for authenticating a user on a local client machine and for authorising access to at least one resource of a remote server machine, wherein the local machine and the remote machine are connected by a communications link; the method comprising: sending a message having authentication information, from the client machine to the server machine, requesting service from the server machine; creating, by the server machine, a credentials structure having security information of the user based on said authentication information from said sent message for authorising a use of the resources authorised by the server machine; returning, to the client machine from the server machine, a credential identifier identifying the user with the created credentials structure; using the credential identifier by the user in each subsequent request for service message from the user to the server machine; and reconstituting the security information stored in the created credentials structure identified by the credential identifier in the subsequent request for service message for automatically establishing authentication of the user and authorisation to use the authorised resources of the server machine.
Claim 11
Dependent Claim
21 words
A method as claimed in Claim 10, further comprising storing the created credentials structure for a time determined by server machine.
Claim 12
Dependent Claim
31 words
A method as claimed in Claim 11, further comprising determining the time to store the created credentials structure based on a length of time since a last activity from the user.
Claim 13
Independent Claim
28 words
A method as claimed in any of claims 10 to 12, further comprising determining by the server if the credential identifier in the subsequent sent message is valid.
Claim 14
Independent Claim
210 words
A method, in a data processing system, for authenticating a user on a local client machine and for authorising access to at least one resource of a remote server machine, wherein the local machine and the remote machine are connected by a communications link; the method comprising: receiving a request for service message having authentication information from user on the client machine; creating a credentials structure having authorisation information for resources at the server for the user based on the authentication information of the received request; returning to the user a credentials identifier corresponding to the created credentials structure; storing the created credentials structure by the server for a time determined by the server; discarding the created credentials structure after the determined time; determining, by the server machine, the validity of the credentials identifier received from the user on a subsequent request for service dependent upon whether the request for service was received within the determined time and the credentials structure is stored at the server; honouring the subsequent request for service if the credentials identifier is determined to be valid; and requiring a new request for service and a new credentials structure if the credentials identifier is determined to be invalid, thereby enforcing a periodic authentication on the user.
Claim 15
Independent Claim
176 words
A method, in a data processing system, for authenticating a user on a local client machine and for authorising access to at least one resource of a remote server machine, wherein the local machine and the remote machine are connected by a communications link; the method comprising: creating, by the server machine, a credentials structure having authorisation information in response to authentication information provided by a user requesting a resource of the server machine; storing the credentials structure for a period of time determined by the server machine; discarding, by the server machine, the credentials structure after the determined period of time; honouring, by the server machine, a subsequent request for service, having a credentials identifier corresponding to the credentials structure, in immediate response to the credentials identifier if the subsequent request is received within the predetermined time; and rejecting, by the server machine, a subsequent request for service in immediate response to credentials identifier in the subsequent request if the subsequent request is received after the predetermined time and the credentials structure has been discarded.
Claim 16
Dependent Claim
192 words
A local data processing system having means for authenticating a user on a remote client data processing system and for authorising access to at least one resource of the data processing system by the remote user, wherein the local data processing system and the remote data processing system are connected by a communications link; the the local data processing system comprising: means for storing a credentials structure having authorisation information for the resources of the local data processing system based upon authentication information received from the remote user during a request for service; means for discarding the credentials structure after a period of time determined by the local data processing system; means for immediately honouring a subsequent request for service in response to an identifier, corresponding to the credentials structure, received with the subsequent request if the request is received within the determined time and the credentials structure is stored in the local data processing system; and means for immediately rejecting a subsequent request for service in response to the identifier received with the subsequent request if the subsequent request is received after the determined time and the credentials structure is discarded.
Claim 17
Dependent Claim
39 words
A system as claimed in Claim 16, further comprising means for requiring a new request for service having authentication information if the subsequent request is rejected after the determined time, thereby enforcing a periodic authentication of the remote user.
References Cited (Backward Citations)
No citation records indexed.
USPTO Annuity & Maintenance Windows
Maintenance schedule is calculated for granted US utility patents.