US5544322A
Expired / Lapsed
US
⏱️ 0.0 years remaining
System and method for policy-based inter-realm authentication within a distributed processing system
Assignee: Cisco Technology Inc
•
Filing: 1994-05-09
•
Granted: 1996-08-06
•
Expires: 2014-05-09
Abstract
Abstract A system and method for defining a platform-independent policy framework for authentication of principals to servers in another realm, within a distributed data processing system. The present invention may be implemented on top of the Kerberos protocol, or any trusted third party network authentication protocol with inter-realm authentication mechanisms.
Inventors
- 👤 Pau-Chen Cheng
- 👤 Shyh-Wei Luan
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-30 17:11
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/08; H04L63/0807; H04L63/10; H04L63/102; H04L9/00; H04L9/32; H04L9/321; H04L9/3263
Claims Analysis
Total Claims: 12
Claim 1
Independent Claim
204 words
In a distributed computing system wherein individual computers are linked together by a communication network, a method for inter-realm authentication comprising the steps of: a) requesting, by a client, an application server policy for an application server from a policy server; b) when a policy reply from the policy server contains an authentication policy of the application server, requesting, by the client, an authentication path to the application server from an authentication routing server; c) determining, by the authentication routing server, whether the authentication path is compliant with the authentication policy and authentication routing information; d) when the authentication path is compliant with the authentication policy and the authentication routing information, providing, by the authentication routing server, verification of the authentication path to the client; e) upon receiving the verification of the authentication path, requesting, by the client, an authentication certificate from an authentication server; f) providing, by the authentication server, the authentication certificate to the client, wherein the authentication certificate is based on the authentication path; g) upon receiving the authentication certificate, sending, by the client, a request to the application server, wherein the request includes the authentication certificate; and h) verifying, by the application server, the client based on the authentication certificate.
Claim 2
Dependent Claim
204 words
In a distributed computing system wherein individual computers are linked together by a communication network, a method for inter-realm authentication comprising the steps of: a) requesting, by a client, an application server policy for an application server from a policy server; b) when a policy reply from the policy server contains an authentication policy of the application server, requesting, by the client, an authentication path to the application server from an authentication routing server; c) determining, by the authentication routing server, whether the authentication path is compliant with the authentication policy and authentication routing information; d) when the authentication path is compliant with the authentication policy and the authentication routing information, providing, by the authentication routing server, verification of the authentication path to the client; e) upon receiving the verification of the authentication path, requesting, by the client, an authentication certificate from an authentication server; f) providing, by the authentication server, the authentication certificate to the client, wherein the authentication certificate is based on the authentication path; g) upon receiving the authentication certificate, sending, by the client, a request to the application server, wherein the request includes the authentication certificate; and h) verifying, by the application server, the client based on the authentication certificate.
Claim 3
Dependent Claim
50 words
The method as recited in claim 1 wherein step (b) further comprises the steps of: determining, by the policy server, whether a policy database contains the authentication policy for the application server; and when the policy database contains the authentication policy, generating the policy reply to include the authentication policy.
Claim 4
Dependent Claim
38 words
The method as recited in claim 2 wherein step (b) further comprises the step of: generating the policy reply to include a message to address another policy server when the policy database does not include the authentication policy.
Claim 5
Dependent Claim
33 words
The method as recited in claim 2 wherein step (b) further comprises the of: generating the policy reply to include an error message when the policy database does not include the authentication policy.
Claim 6
Dependent Claim
49 words
The method as recited in claim 1 wherein step (d) further comprises the steps of: when the authentication path is not compliant with the authentication policy and the authentication routing information, providing, by the authentication routing server, an error message or a referral message to another authentication routing server.
Claim 7
Dependent Claim
51 words
The method as recited in claim 1 further comprises the steps of: providing, by the client, a client authentication policy to the authentication routing server; and determining, by the authentication routing server, whether the authentication path is compliant with the authentication policy, the client authentication policy, and the authentication routing information.
Claim 8
Dependent Claim
168 words
An inter-realm authentication apparatus for use in a distributed data processing system, the inter-realm authentication apparatus comprises: an authentication server that includes: authentication information database for storing authentication routing information of the distributed data processing system; processing means, operably coupled to the authentication information database, for providing the authentication routing information upon request and for processing certificate requests by clients affiliated with the distributed data processing system; a policy server that includes: policy database for storing authentication policies of application servers; processing means, operably coupled to the policy database, for entering an authentication policy of an application server into the policy database and for processing requests for policy information by the clients; and an authentication routing server that is operably coupled to the authentication server and the policy server, wherein the authentication routing server, upon an authentication path request from a client to a target application server, determines whether the authentication path is compliant with the authentication routing information and the authentication policy of the target application server.
Claim 9
Dependent Claim
168 words
An inter-realm authentication apparatus for use in a distributed data processing system, the inter-realm authentication apparatus comprises: an authentication server that includes: authentication information database for storing authentication routing information of the distributed data processing system; processing means, operably coupled to the authentication information database, for providing the authentication routing information upon request and for processing certificate requests by clients affiliated with the distributed data processing system; a policy server that includes: policy database for storing authentication policies of application servers; processing means, operably coupled to the policy database, for entering an authentication policy of an application server into the policy database and for processing requests for policy information by the clients; and an authentication routing server that is operably coupled to the authentication server and the policy server, wherein the authentication routing server, upon an authentication path request from a client to a target application server, determines whether the authentication path is compliant with the authentication routing information and the authentication policy of the target application server.
Claim 10
Dependent Claim
20 words
The apparatus of claim 7, wherein the policy server further comprises: client policy database for storing client determined authentication policies.
Claim 11
Dependent Claim
245 words
A computer readable storage medium for storing program instructions that, when read by at least one computer, causes the at least one computer to providing inter-realm authentication, the computer readable storage medium comprises: first storage means for storing program instructions that cause the at least one computer to receive an application server policy request for an application server from a client; second storage means for storing program instructions that cause the at least one computer to generate a policy reply, and, when the policy reply contains an authentication policy of the application server, to receive an authentication path request between the application server and the client from the client; third storage means for storing program instructions that cause the at least one computer to determine whether the authentication path is compliant with the authentication policy and authentication routing information; fourth storage means for storing program instructions that cause the at least one computer to provide verification of the authentication path to the client when the authentication path is compliant with the authentication policy and the authentication routing information; fifth storage means for storing program instructions that cause the at least one computer to receive a request from the client, in response to the verification of the authentication path, for an authentication certificate; and sixth storage means for storing program instructions that cause the at least one computer to provide the authentication certificate to the client, wherein the authentication certificate is based on the authentication path.
Claim 12
Dependent Claim
245 words
A computer readable storage medium for storing program instructions that, when read by at least one computer, causes the at least one computer to providing inter-realm authentication, the computer readable storage medium comprises: first storage means for storing program instructions that cause the at least one computer to receive an application server policy request for an application server from a client; second storage means for storing program instructions that cause the at least one computer to generate a policy reply, and, when the policy reply contains an authentication policy of the application server, to receive an authentication path request between the application server and the client from the client; third storage means for storing program instructions that cause the at least one computer to determine whether the authentication path is compliant with the authentication policy and authentication routing information; fourth storage means for storing program instructions that cause the at least one computer to provide verification of the authentication path to the client when the authentication path is compliant with the authentication policy and the authentication routing information; fifth storage means for storing program instructions that cause the at least one computer to receive a request from the client, in response to the verification of the authentication path, for an authentication certificate; and sixth storage means for storing program instructions that cause the at least one computer to provide the authentication certificate to the client, wherein the authentication certificate is based on the authentication path.
References Cited (Backward Citations)
US4309569A
Cited
US4317957A
Cited
US4326098A
Cited
US4423287A
Cited
US4500750A
Cited
EP0112944A1
Cited
US4755940A
Cited
EP0148960A1
Cited
US4672572A
Cited
US4661658A
Cited
US5020105A
Cited
US4725719A
Cited
US5109483A
Cited
EP0304033A2
Cited
FR2619941A1
Cited
EP0325777A2
Cited
US4918653A
Cited
US5001755A
Cited
US4919545A
Cited
US5175851A
Cited
EP0398492A2
Cited
US5181238A
Cited
US5191650A
Cited
US5173589A
Cited
US5115466A
Cited
US5208858A
Cited
US5263157A
Cited
US5339403A
Cited
EP0456386A2
Cited
US5224164A
Cited
US5032979A
Cited
US5204961A
Cited
WO1992004671A1
Cited
US5220604A
Cited
EP0481121A1
Cited
US5226079A
Cited
US5198806A
Cited
JPH04264864A
Cited
EP0502446A2
Cited
US5220603A
Cited
US5272754A
Cited
US5237612A
Cited
US5202921A
Cited
US5237614A
Cited
EP0520709A2
Cited
JPH0535678A
Cited
US5204902A
Cited
EP0534673A2
Cited
US5276444A
Cited
US5249230A
Cited
US5276901A
Cited
US5253295A
Cited
WO1993017529A1
Cited
EP0558326A1
Cited
US5261002A
Cited
US5276735A
Cited
US5235642A
Cited
US5349643A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 1999-08-06 | 2000-02-05 | 2000-08-06 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2003-08-06 | 2004-02-05 | 2004-08-06 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2007-08-06 | 2008-02-05 | 2008-08-06 | $7700.00 | Window Closed / Lapsed |