Patent US6668322B1 successfully refreshed from Google Patents.
US6668322B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Access management system and method employing secure credentials
Assignee: Oracle America Inc
•
Filing: 1999-08-05
•
Granted: 2003-12-23
•
Expires: 2019-08-05
Abstract
Abstract A security architecture has been developed in which a single sign-on is provided. Session credentials are used to maintain continuity of a persistent session across multiple accesses to one or more information resources, and in some embodiments, across credential level changes. Session credentials are secured, e.g., as a cryptographically secured session token, such that they may be inspected by a wide variety of entities or applications to verify an authenticated trust level, yet may not be prepared or altered except by a trusted authentication service. Some embodiments of the present invention associate trust level requirements with information resources. Authentication schemes (e.g., those based on passwords, certificates, biometric techniques, smart cards, etc.) are associated with trust levels, and in some embodiments, with environmental parameters. For example, in one configuration, a login service obtains login credentials for an entity commensurate with the trust level requirement(s) of an information resource (or information resources) to be accessed and with environment parameters that affect the sufficiency of a given credential type. Once login credentials have been obtained for an entity and have been authenticated to a given trust level, session credentials are issued and access is granted to information resources for which the trust level is sufficient. Advantageously, by using the session credentials access is granted without the need for further login credentials and authentication. In some configurations, session credentials evidencing an insufficient trust level may be remedied by a session continuity preserving upgrade of login credential.
Inventors
- 👤 David L. Wood
- 👤 Derk Norton
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-05 17:16
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/30; G06F21/31; G06F21/41; H; H04; H04L; H04L63/00; H04L63/10; H04L63/102; H04L63/105; G06F2221/00; G06F2221/21; G06F2221/2113; H04L63/20; H04L63/205
Claims Analysis
Total Claims: 36
Claim 1
Independent Claim
84 words
A session credential for use in a security architecture controlling access to one or more information resources, the session credential comprising: a principal identifier uniquely identifying a principal; and an encoding of authorization accorded by the security architecture after prior authentication of a login credential corresponding to the principal, the principal identifier and authorization encoding being cryptographically secured and allowing the security architecture to evaluate sufficiency of the authorization for access to the one or more information resources without re-authentication of the login credentials.
Claim 2
Dependent Claim
84 words
A session credential for use in a security architecture controlling access to one or more information resources, the session credential comprising: a principal identifier uniquely identifying a principal; and an encoding of authorization accorded by the security architecture after prior authentication of a login credential corresponding to the principal, the principal identifier and authorization encoding being cryptographically secured and allowing the security architecture to evaluate sufficiency of the authorization for access to the one or more information resources without re-authentication of the login credentials.
Claim 3
Dependent Claim
32 words
A session credential as in claim 1 , wherein the cryptographic securing includes encryption of at least the principal identifier and authorization encoding using a private key associated with the security architecture.
Claim 4
Dependent Claim
74 words
A session credential as in claim 1 , further comprising: an encrypted portion and an unencrypted portion; the unencrypted portion allowing contents of the session credential, including the principal identifier and authorization encoding, to be read without possession of a key; the encrypted portion being encrypted with a private key associated with the security architecture and allowing authenticity of the unencrypted portion to be confirmed using a public key corresponding to the private key.
Claim 5
Dependent Claim
35 words
A session credential as in claim 3 , wherein the encrypted portion is supplied external to the security architecture as a session token that uniquely identifies a corresponding persistent session maintained by the security architecture.
Claim 6
Dependent Claim
41 words
A session credential as in claim 4 , wherein the session token is encoded as a cookie supplied to a browser; and wherein the cookie is included with access requests made by the browser targeting the one or more information resources.
Claim 7
Dependent Claim
58 words
A session credential as in claim 3 , wherein the cryptographic securing is by a private key possessed substantially only by an authentication component of the security architecture; and wherein authenticity of the cryptographically secured principal identifier and authorization encoding is verifiable by components other than the authentication component using a public key corresponding to the private key.
Claim 8
Dependent Claim
43 words
A session credential as in claim 1 , wherein the cryptographic securing includes a digital signature encompassing at least the principal identifier and authorization encoding and thereby allows authenticity of the principal identifier and authorization encoding to be confirmed using a public key.
Claim 9
Dependent Claim
13 words
A session credential as in claim 1 , further comprising: an expiration encoding.
Claim 10
Dependent Claim
13 words
A session credential as in claim 1 , further comprising: a session identifier.
Claim 11
Dependent Claim
13 words
A session credential as in claim 1 , further comprising: a group identifier.
Claim 12
Dependent Claim
36 words
A session credential as in claim 1 , further comprising: one or more additional elements selected from an expiration encoding; a session identifier; and a group identifier, the one or more additional elements also cryptographically secured.
Claim 13
Dependent Claim
91 words
A session token for transfer between a client entity operating on behalf of a principal and a security architecture controlling access to an information resource, the session token comprising: a principal identifier uniquely identifying the principal; and an indication of authorization level accorded by the security architecture after prior authentication of a login credential corresponding to the principal, the principal identifier and authorization level indication being cryptographically secured and allowing the security architecture to evaluate sufficiency of the authorization for access to the information resource without re-authentication of the login credentials.
Claim 14
Dependent Claim
91 words
A session token for transfer between a client entity operating on behalf of a principal and a security architecture controlling access to an information resource, the session token comprising: a principal identifier uniquely identifying the principal; and an indication of authorization level accorded by the security architecture after prior authentication of a login credential corresponding to the principal, the principal identifier and authorization level indication being cryptographically secured and allowing the security architecture to evaluate sufficiency of the authorization for access to the information resource without re-authentication of the login credentials.
Claim 15
Dependent Claim
16 words
A session token as in claim 12 , encoded as a cookie stored at a browser.
Claim 16
Dependent Claim
23 words
A session token as in claim 12 , placed at a browser in response to a set cookie directive by the security architecture.
Claim 17
Dependent Claim
15 words
A session token as in claim 12 , encoded for transfer to the client entity.
Claim 18
Dependent Claim
25 words
A session token as in claim 12 , encoded in a communication medium as information in transit between the client entity and the security architecture.
Claim 19
Dependent Claim
47 words
A session token as in claim 12 , wherein the client entity includes a browser; and wherein the session token is embodied as a cookie supplied to the browser by the security architecture and included with an access request made by the browser targeting the information resource.
Claim 20
Independent Claim
107 words
A method of providing authorization verification in a security architecture controlling access to one or more information resources, the method comprising: obtaining a login credential and authenticating a principal thereby; issuing a cryptographically secured session credential encoding at least an identifier for the principal and a first authorization accorded based on the authenticating; and for plural requests for accesses to the one or more of the information resources, selectively allowing access based on sufficiency of the first authorization encoded by the cryptographically secured session credential for access to the one or more of the information resources, wherein the selective allowing is performed without additional login credential authenticating.
Claim 21
Independent Claim
107 words
A method of providing authorization verification in a security architecture controlling access to one or more information resources, the method comprising: obtaining a login credential and authenticating a principal thereby; issuing a cryptographically secured session credential encoding at least an identifier for the principal and a first authorization accorded based on the authenticating; and for plural requests for accesses to the one or more of the information resources, selectively allowing access based on sufficiency of the first authorization encoded by the cryptographically secured session credential for access to the one or more of the information resources, wherein the selective allowing is performed without additional login credential authenticating.
Claim 22
Dependent Claim
38 words
A method as in claim 18 , further comprising: digitally signing the session credential prior to issuance thereof; and prior to the selective allowing, verifying authenticity of the principal identifier and first authorization encoding using a public key.
Claim 23
Dependent Claim
75 words
A method as in claim 18 , further comprising: encrypting at least the identifier for the principal and the first authorization using a private key, the issued cryptographically secured session credential including at least the identifier for the principal and the first authorization in both encrypted and free text form; and prior to the selective allowing, verifying authenticity of the principal identifier and first authorization encoding using a public key corresponding to the private key.
Claim 24
Dependent Claim
69 words
A method as in claim 20 , further comprising: supplying the encrypted form of at least the identifier for the principal and the first authorization to a client entity external to the security architecture as a session token; the client entity presenting the session token with subsequent access requests so that the security architecture may perform the selective allowing of the subsequent access requests without additional login credential authenticating.
Claim 25
Dependent Claim
24 words
A method as in claim 21 , wherein the client entity includes a browser; and wherein the session token is encoded as a cookie.
Claim 26
Dependent Claim
79 words
A method as in claim 18 , further comprising: on an access request for which the first authorization encoded by the cryptographically secured session credential is insufficient, obtaining a second login credential and authenticating the principal thereby: issuing a second cryptographically secured session credential encoding a second authorization accorded based on the authenticating by the second login credential; and selectively allowing the access request based on sufficiency of the second authorization encoded by the second cryptographically secured session credential.
Claim 27
Dependent Claim
75 words
A method as in claim 18 , wherein the cryptographically secured session credential also encodes an expiration; the method further comprising: prior to the expiration, reauthenticating the principal by the first login credential; issuing a third cryptographically secured session credential cncoding a third authorization accorded based on the authenticating by the first login credential; and selectively allowing subsequent access requests based on sufficiency of the third authorization encoded by the third cryptographically secured session credential.
Claim 28
Dependent Claim
15 words
A method as in claim 24 , wherein the first and third authorizations are equivalent.
Claim 29
Dependent Claim
40 words
A method as in claim 24 , wherein the first and third authorization are encoded as trust levels that differ in accordance with either or both of a changed session environment and changed mappings of credential types to trust levels.
Claim 30
Dependent Claim
73 words
A method as in claim 18 , wherein the login credential is selected from a set of credential types including one or more of a username password pair, digital certificate, an encrypted credentials based on asymmetric, symmetric, public, private, or secret key technology, a one-time password, a biometric credential based on retinal scan, voice print, or finger print, and a possession based credential embodied in a smart card, Enigma card or physical key.
Claim 31
Dependent Claim
99 words
A method as in claim 18 , embodied as one or more computer program products including functionally descriptive information for directing a processor to perform the login credential obtaining and principal authenticating, the cryptographically secured session credential issuing, and the selectively allowing access based on sufficiency of the first authorization by the cryptographically secured session credential, the one or more computer program products encoded by or transmitted in at least one computer readable medium selected from the set of a disk, tape or other magnetic, optical, or electronic storage medium and a network, wireline, wireless or other communications medium.
Claim 32
Dependent Claim
64 words
An information access control facility comprising: an application proxy for receiving an access request targeting one of a set of information resources, extracting a cryptographically secured session token from the access request, and selectively proxying the access request; means responsive to the application proxy for evaluating sufficiency of an authorization encoded in the cryptographically secured session token for access to the targeted information resource.
Claim 33
Dependent Claim
64 words
An information access control facility comprising: an application proxy for receiving an access request targeting one of a set of information resources, extracting a cryptographically secured session token from the access request, and selectively proxying the access request; means responsive to the application proxy for evaluating sufficiency of an authorization encoded in the cryptographically secured session token for access to the targeted information resource.
Claim 34
Dependent Claim
73 words
An access control facility as in claim 29 , further comprising: credential gathering means responsive to an insufficient zero or more login credentials associated with the session, the credential gathering means obtaining a login credential of type sufficient, if authenticated, to achieve a trust level requirement of the targeted information; and authentication means for receiving the obtained login credential, authenticating a principal thereby and issuing a session credential corresponding to the session token.
Claim 35
Dependent Claim
26 words
An access control facility as in claim 29 , further comprising: means for transferring the session token between the access control facility and the client entity.
Claim 36
Dependent Claim
51 words
An access control facility as in claim 29 , embodied as a computer program product encoded by or transmitted in at least one computer readable medium selected from the set of a disk, tape or other magnetic, optical, or electronic storage medium and a network, wireline, wireless or other communications medium.
References Cited (Backward Citations)
EP0465016A2
Cited
US5610981A
Cited
WO1996042041A2
Cited
US5774551A
Cited
WO1998025373A2
Cited
EP0849680A2
Cited
US5875296A
Cited
US6041357A
Cited
US6408336B1
Cited
US6275941B1
Cited
US5944824A
Cited
WO1998057247A1
Cited
US6308273B1
Cited
US6161139A
Cited
US6226752B1
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2006-12-22 | 2007-06-23 | 2007-12-23 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2010-12-22 | 2011-06-23 | 2011-12-23 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2014-12-22 | 2015-06-23 | 2015-12-23 | $7700.00 | Window Closed / Lapsed |