Patent US6317838B1 successfully refreshed from Google Patents.
US6317838B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method and architecture to provide a secured remote access to private resources
Assignee: EVIDAN
•
Filing: 1998-04-29
•
Granted: 2001-11-13
•
Expires: 2018-04-29
Abstract
Abstract A method and architecture allowing a remote user, especially an Internet remote user, to securely access private resources protected by a firewall. The architecture comprises a computer facility and many remote user terminals connected via the Internet. The computer facility comprises a security server that controls a security database. The firewall comprises a centralized security means, which is under the control of a security server and is arranged to authenticate remote users and to provide a security profile describing all resources a user may access with a single sign-on data during a single session. A user's terminal further includes a device to generate one-time passwords and the computer includes a device to decode the passwords. The accessed resources may be servers or logical units acceded though protocols having a notion of authentication.
Inventors
- 👤 Eric Baize
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-08 21:28
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/02; H04L63/029; H04L63/08; H04L63/0815; H04L67/00; H04L67/2866; H04L67/30; H04L67/306
Claims Analysis
Total Claims: 16
Claim 1
Independent Claim
267 words
A method for allowing a user remote from a digital data processing system protected by a firewall to gain a secured access to private resources of the digital data processing system, comprising at least the following steps: an initial implementation step comprising the stages of: a. implementing in said digital data processing system a security storing means for storing security data, said security data including at least data to authenticate said user, security profiles indicating which private resources each user may use and security data associated with said private resources; b. implementing in said firewall a centralized security means able to filter remote access requests to said private resources according to rules derived from said security data; and subsequent operational steps comprising at least the following stages: a. at the user's side of the firewall, a first stage including the opening of a session, a second stage including the entering of security data, including at least said remote user's authentication data, and a third stage of requesting an access to a first private resource; and b. at the digital data processing system's side of the firewall, a first stage, under control of said centralized security means, including a comparison between received security data from said remote user and said authentication data stored in said security means, in order to authenticate said remote user; if said authentication succeeds, a second stage providing said centralized security means with a security profile associated with said remote user; and a third stage providing said requested first private resource with security data allowing said remote user access to said first private resource.
Claim 2
Independent Claim
267 words
A method for allowing a user remote from a digital data processing system protected by a firewall to gain a secured access to private resources of the digital data processing system, comprising at least the following steps: an initial implementation step comprising the stages of: a. implementing in said digital data processing system a security storing means for storing security data, said security data including at least data to authenticate said user, security profiles indicating which private resources each user may use and security data associated with said private resources; b. implementing in said firewall a centralized security means able to filter remote access requests to said private resources according to rules derived from said security data; and subsequent operational steps comprising at least the following stages: a. at the user's side of the firewall, a first stage including the opening of a session, a second stage including the entering of security data, including at least said remote user's authentication data, and a third stage of requesting an access to a first private resource; and b. at the digital data processing system's side of the firewall, a first stage, under control of said centralized security means, including a comparison between received security data from said remote user and said authentication data stored in said security means, in order to authenticate said remote user; if said authentication succeeds, a second stage providing said centralized security means with a security profile associated with said remote user; and a third stage providing said requested first private resource with security data allowing said remote user access to said first private resource.
Claim 3
Dependent Claim
80 words
A method according to claim 1 , wherein said subsequent operational steps further comprise: at the user's side, during the duration of said opened session, requesting an access to at least a second private resource, using said entered security data; second digital data processing stage further including a conditional authorization of access to said second private resource and providing to this second private resource security data allowing said remote user access to this second resource according to said security profile.
Claim 4
Dependent Claim
22 words
A method according to claim 2 , wherein said remote user is connected to said digital data processing system through the Internet.
Claim 5
Dependent Claim
21 words
A method according to claim 3 , wherein said private resource is an Internet application protocol having a notion of authentication.
Claim 6
Dependent Claim
22 words
A method according to claim 1 , wherein said security data entered by said remote user comprise a password and a log-in.
Claim 7
Dependent Claim
102 words
A method according to claim 5 , wherein said security profiles comprise sets of security data describing all private resources that a given remote user is authorized to access, each set being associated with said security data entered by a given remote user and comprising security data to be provided in order to access a determined private resource, wherein said authentication is performed using the same user's security data during the whole duration of said opened session, and wherein security data provided to said determined private resource is derived from said security profile associated to said given remote user, upon his authentication.
Claim 8
Dependent Claim
32 words
A method according to claim 5 , wherein said password is a one-time password generated from a Hash function of a combination of a secret digital word and a time-dependent digital word.
Claim 9
Dependent Claim
172 words
A network for allowing a remote user's terminal to gain secured access to private resources of a digital data processing system protected by a firewall, wherein said remote user's terminal comprises means to enter security data comprising authentication data and a request to access predetermined private resources, said digital data processing system comprising security storing means for storing security data, said security data comprising at least data to authenticate said user, security profiles indicating which private resources each user may use and security data associated with said private resources, and wherein said firewall comprises centralized security means able to authenticate said remote user upon receiving said entered security data and to filter remote access requests to said private resources, according to rules derived from said security data, to fetch a security profile from said security storing means corresponding to said authenticated remote user and to provide said first private resource with security data in accordance to said security profile, in order to allow said remote user access to said first private resource.
Claim 10
Dependent Claim
172 words
A network for allowing a remote user's terminal to gain secured access to private resources of a digital data processing system protected by a firewall, wherein said remote user's terminal comprises means to enter security data comprising authentication data and a request to access predetermined private resources, said digital data processing system comprising security storing means for storing security data, said security data comprising at least data to authenticate said user, security profiles indicating which private resources each user may use and security data associated with said private resources, and wherein said firewall comprises centralized security means able to authenticate said remote user upon receiving said entered security data and to filter remote access requests to said private resources, according to rules derived from said security data, to fetch a security profile from said security storing means corresponding to said authenticated remote user and to provide said first private resource with security data in accordance to said security profile, in order to allow said remote user access to said first private resource.
Claim 11
Dependent Claim
34 words
A network according to claim 8 , wherein said digital data processing system further comprises a security manager for controlling said security storing means, said security manager being connected to said centralized security means.
Claim 12
Dependent Claim
37 words
A network according to claim 9 , wherein said digital data processing system is in a computer facility, wherein said security manager means is a security server and wherein said security storing means is a data base.
Claim 13
Dependent Claim
14 words
A network according to claim 10 , wherein said private resources are protected servers.
Claim 14
Dependent Claim
29 words
A network according to claim 11 , wherein said remote user is connected to said firewall through the Internet, said private resources including protocols having a notion of authentication.
Claim 15
Dependent Claim
24 words
A network according to claim 12 , wherein said firewall comprises proxy devices forming an interface between said centralized security means and said resources.
Claim 16
Dependent Claim
132 words
A network according to claim 10 , wherein said user's terminal comprises a first device for generating one-time passwords, said one-time passwords being obtained from one secret digital word and first time-depending digital words, said one-time passwords being formed from at least one part of said security data entered by said remote user, and wherein said digital data processing system comprises a second device to decode said one-time passwords using secret digital words and time depending digital words, in order to authenticate said remote user and to associate one determined security profile to said user, said second device comprising means to store said second secret digital words, each associated with a given remote user, and means to generate said second time depending words in synchronization with said first digital time depending words.
References Cited (Backward Citations)
US5491752A
Cited
US5657388A
Cited
US5721908A
Cited
US5768503A
Cited
US5818936A
Cited
US5918019A
Cited
US5944824A
Cited
US6052785A
Cited
US5935251A
Cited
US6038597A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2004-11-12 | 2005-05-14 | 2005-11-13 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2008-11-12 | 2009-05-14 | 2009-11-13 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2012-11-12 | 2013-05-14 | 2013-11-13 | $7700.00 | Window Closed / Lapsed |