System and method for single sign-on to a plurality of network elements

Claim 2

In a network having a security server coupled to a data traffic network, a programmed method of permitting the single sign-on of a plurality of user stations to any of a plurality of available network elements, the method comprising the steps of: opening a user account that indicates access to a specific network element; enabling the single sign-on capability for said user account; setting a single sign-on capability indicator digit in said user account; generating a log-on identifier for said specific network element; generating a new password for said user account; checking said new password against an organization specific password policy to ensure its integrity; invoking a password initialization procedure to set said log-on identifier and said new password; saving said user account in a centralized security database on said security server, said user account containing an identifier field for said specific network element and said log-on identifier, present password and new password; and setting up said specific network element with said user account.

Claim 3

The method according to claim 1 wherein said password is generated by a random password generation program.

Claim 4

The method according to claim 1 wherein said password is generated by manual entry.

Claim 5

The method according to claim 1 further including the steps of: creating a user account for each specific network element wherein the corresponding user station is allowed access; fetching a user account for said specific network element; retrieving the super-user log-on identifier, present password and new password indicators from said account record; transmitting a message to said specific network element for initial user password setup; obtaining a new password from a user station having access to said specific network element; updating said user account for said specific network element by replacing the value of the present password with said new password; generating a random password; and replacing the value of the new password with said random password.

Claim 6

A secured network architecture for the single sign-on of a user to a plurality of network elements comprising: a data network; a security server communicably coupled to said data network; a plurality of security applications stored on said security server; a centralized security database defining a plurality of user access privileges, said database stored on said security server and read/write accessible by said security applications, said database including: a plurality of user account records containing at least a single sign-on user indication digit, a user log-on identifier, present password and new password for each of said plurality of network elements to which a user has access; and a plurality of network element account records containing at least a super-user log-on identifier, present password and new password for each of said plurality of network elements; a terminal server providing an asynchronous serial communications bridge between said security server and said plurality of network elements; and a plurality of user nodes communicably coupled to said data network, wherein some of said user nodes are connected locally to said data network via a local area network and some are connected remotely via a dial-up configuration for communicating with said plurality of network elements.

Claim 7

A secured network architecture for the single sign-on of a user to a plurality of network elements comprising: a data network; a security server communicably coupled to said data network; a plurality of security applications stored on said security server; a centralized security database defining a plurality of user access privileges, said database stored on said security server and read/write accessible by said security applications, said database including: a plurality of user account records containing at least a single sign-on user indication digit, a user log-on identifier, present password and new password for each of said plurality of network elements to which a user has access; and a plurality of network element account records containing at least a super-user log-on identifier, present password and new password for each of said plurality of network elements; a terminal server providing an asynchronous serial communications bridge between said security server and said plurality of network elements; and a plurality of user nodes communicably coupled to said data network, wherein some of said user nodes are connected locally to said data network via a local area network and some are connected remotely via a dial-up configuration for communicating with said plurality of network elements.

Claim 8

The secured network architecture according to claim 5 wherein said security applications include at least the following programmed modules: a user authentication program that requests user specific identifiers and compares them against information stored in said centralized security database; a user authorization program for determining which of said plurality of network elements an authenticated user has access to; a data encryption standard program for encrypting and deencrypting data traffic between said plurality of user stations and said plurality of network elements; a data integrity program for guarding the data traffic on said network; a user privilege control program that determines the level of access of specific user stations to any of said plurality of network elements; a user access audit program for logging all user access attempts and creating an audit trail; and a centralized administration program for managing said plurality of users on a network wide basis.

Claim 9

The secured network architecture according to claim 5 wherein said plurality of network elements and said plurality of user nodes communicate over said data network using the distributed computing environment standard.

Claim 10

The secured network architecture according to claim 5 wherein said user authentication program employs the distributed computing environment key distribution service based on Kerberos authentication algorithym.

Claim 11

The secured network architecture according to claim 5 wherein said user authorization program uses the distributed cell directory service and an access control list mechanism.