US5864665A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Auditing login activity in a distributed computing environment
Assignee: International Business Machines Corp
•
Filing: 1996-08-20
•
Granted: 1999-01-26
•
Expires: 2016-08-20
Abstract
Abstract A method of auditing login activity in a distributed computing environment in which users attempt to log into the environment from workstations using an authentication protocol in which a ticket request and pre-authentication data are communicated from the workstation to an authentication server. The pre-authentication data includes information establishing an identity of the user and providing a proof that the user has entered a password during the login attempt. The method is effected as a background process during the login, and is initiated after the ticket has been returned to the workstation from the authentication server to avoid RPC deadlock. To audit the login, information from the pre-authentication data is used to obtain a simple name of the user. The simple name is then converted into a global format and evaluated. If the name is recognized, it is passed along with the workstation address to an audit API. If the name is invalid, the audit is suspended. After the information is recorded or the audit suspended, as the case may be, process control is returned to the login routine. Preferably, the routine is implemented within the security service of the distributed computing environment.
Inventors
- 👤 Trung M. Tran
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-26 21:13
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/50; G06F21/55; G06F21/554; G06F21/30; G06F21/31; G06F21/33; G06F2221/00; G06F2221/21; G06F2221/2141
Claims Analysis
Total Claims: 24
Claim 1
Independent Claim
120 words
A method of auditing login activity in a distributed computing environment in which users attempt to log into the environment from workstations using an authentication protocol in which a ticket request and pre-authentication data are communicated from the workstation to an authentication server, the pre-authentication data including information establishing an identity of the user and providing a proof that the user has entered a password during the login attempt; comprising the steps of: during a login routine, determining whether a ticket has been returned from the server in response to the ticket request; and if a ticket has been returned from the server, suspending the login routine and using information derived from the pre-authentication data to initiate a login audit.
Claim 2
Independent Claim
120 words
A method of auditing login activity in a distributed computing environment in which users attempt to log into the environment from workstations using an authentication protocol in which a ticket request and pre-authentication data are communicated from the workstation to an authentication server, the pre-authentication data including information establishing an identity of the user and providing a proof that the user has entered a password during the login attempt; comprising the steps of: during a login routine, determining whether a ticket has been returned from the server in response to the ticket request; and if a ticket has been returned from the server, suspending the login routine and using information derived from the pre-authentication data to initiate a login audit.
Claim 3
Dependent Claim
55 words
The method as described in claim 1 wherein the step of initiating a login audit includes the steps of: determining whether naming information can be provided to an audit service of the distributing computing environment without causing RPC deadlock; and if the naming information can be provided without causing RPC deadlock, calling an audit API.
Claim 4
Dependent Claim
29 words
The method as described in claim 2 further including the step of completing the login audit by having the audit API pass the naming information to the audit service.
Claim 5
Dependent Claim
37 words
The method as described in claim 3 further including the steps of: obtaining an address of a workstation at which the login attempt is occurring; and having the audit API pass the address to the audit service.
Claim 6
Dependent Claim
35 words
The method as described in claim 4 further including the step of transferring process control back to the login routine after the audit API passes the naming information or the address to the audit service.
Claim 7
Dependent Claim
13 words
The method as described in claim 1 wherein the authentication protocol is Kerberos.
Claim 8
Dependent Claim
64 words
The method as described in claim 2 wherein the step of determining whether naming information can be provided to an audit service without causing RPC deadlock includes the steps of: obtaining a name of the user in a first format; converting the user's name from the first format to a second format; and evaluating whether the user's name in the second format is valid.
Claim 9
Dependent Claim
23 words
The method as described in claim 7 wherein the first format is an intracell name and the second format is an intercell name.
Claim 10
Independent Claim
134 words
A method of auditing login activity in a distributed computing environment in which users attempt to log into the environment from workstations using an authentication protocol in which a ticket request and pre-authentication data are communicated from the workstation to an authentication server, the pre-authentication data including information establishing an identity of the user and providing a proof that the user has entered a password during the login attempt; comprising the steps of: during a login routine, determining whether a ticket has been returned from the server in response to the ticket request; if a ticket has been returned from the server, suspending the login routine and using information derived from the pre-authentication data to initiate a login audit protocol; returning process control back to the login routine after processing the login audit protocol.
Claim 11
Independent Claim
134 words
A method of auditing login activity in a distributed computing environment in which users attempt to log into the environment from workstations using an authentication protocol in which a ticket request and pre-authentication data are communicated from the workstation to an authentication server, the pre-authentication data including information establishing an identity of the user and providing a proof that the user has entered a password during the login attempt; comprising the steps of: during a login routine, determining whether a ticket has been returned from the server in response to the ticket request; if a ticket has been returned from the server, suspending the login routine and using information derived from the pre-authentication data to initiate a login audit protocol; returning process control back to the login routine after processing the login audit protocol.
Claim 12
Dependent Claim
64 words
The method as described in claim 9 wherein the login audit protocol includes the steps of: determining whether naming information can be provided to an audit service of the distributing computing environment without causing RPC deadlock; if the naming information can be provided without causing RPC deadlock, calling an audit API; and having the audit API pass the naming information to the audit service.
Claim 13
Dependent Claim
50 words
The method as described in claim 9 wherein the login audit protocol includes the steps of: determining whether naming information can be provided to an audit service of the distributing computing environment without causing RPC deadlock; if the naming information cannot be provided without causing RPC deadlock, suspending the audit.
Claim 14
Dependent Claim
13 words
The method as described in claim 9 wherein the authentication protocol is Kerberos.
Claim 15
Dependent Claim
56 words
The method as described in claim 10 wherein the step of determining whether naming information can be provided to an audit service without causing RPC deadlock includes the steps of: obtaining a simple name of the user; converting the user's simple name to a global name format; and evaluating whether the user's global name is valid.
Claim 16
Dependent Claim
95 words
A computer connected in a distributed computing environment having an authentication server, the computer comprising: a processor; an operating system; program control means run by the operating system, comprising: means operative during a login routine for determining whether predetermined information has been returned from the authentication server in response to an authentication request; means responsive to the determining means for suspending the login routine and initiating a login audit protocol; and means for processing the login audit protocol; and means for returning process control back to the login routine after processing the login audit protocol.
Claim 17
Dependent Claim
95 words
A computer connected in a distributed computing environment having an authentication server, the computer comprising: a processor; an operating system; program control means run by the operating system, comprising: means operative during a login routine for determining whether predetermined information has been returned from the authentication server in response to an authentication request; means responsive to the determining means for suspending the login routine and initiating a login audit protocol; and means for processing the login audit protocol; and means for returning process control back to the login routine after processing the login audit protocol.
Claim 18
Dependent Claim
31 words
The computer as described in claim 14 wherein the means for processing the login audit protocol includes means for controlling an audit API to pass naming information to an audit service.
Claim 19
Dependent Claim
25 words
The computer as described in claim 15 wherein the means for processing the login audit protocol includes means for suspending an audit under predetermined circumstances.
Claim 20
Dependent Claim
16 words
The computer as described in claim 14 wherein the authentication server uses a Kerberos authentication protocol.
Claim 21
Dependent Claim
124 words
An article of manufacture for use in a computer, comprising: a computer-readable storage medium having a substrate; and computer program data encoded in the substrate of the computer-readable storage medium, wherein the storage medium so configured enables a user of the computer to connect the computer into a distributed computing environment having an authentication server, the computer program data comprising: means operative during a login routine for determining whether predetermined information has been returned from the server in response to an authentication request; means responsive to the determining means for suspending the login routine and initiating a login audit protocol; means for processing the login audit protocol; and means for returning process control back to the login routine after processing the login audit protocol.
Claim 22
Dependent Claim
124 words
An article of manufacture for use in a computer, comprising: a computer-readable storage medium having a substrate; and computer program data encoded in the substrate of the computer-readable storage medium, wherein the storage medium so configured enables a user of the computer to connect the computer into a distributed computing environment having an authentication server, the computer program data comprising: means operative during a login routine for determining whether predetermined information has been returned from the server in response to an authentication request; means responsive to the determining means for suspending the login routine and initiating a login audit protocol; means for processing the login audit protocol; and means for returning process control back to the login routine after processing the login audit protocol.
Claim 23
Dependent Claim
33 words
The article of manufacture as described in claim 18 wherein the means for processing the login audit protocol includes means for controlling an audit API to pass naming information to an audit service.
Claim 24
Dependent Claim
28 words
The article of manufacture as described in claim 18 wherein the means for processing the login audit protocol further includes means for suspending an audit under predetermined circumstances.
References Cited (Backward Citations)
US4757533A
Cited
US5138712A
Cited
US5339403A
Cited
US5032979A
Cited
US5497421A
Cited
US5459871A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2002-01-25 | 2002-07-27 | 2003-01-26 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2006-01-25 | 2006-07-27 | 2007-01-26 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2010-01-25 | 2010-07-27 | 2011-01-26 | $7700.00 | Window Closed / Lapsed |