Abstract:
A hijack avoidance technique avoids presenting an access to more than one of a chain of authentication objects, such as a chain of Lightweight Directory Access Protocol (LDAP) authenticators. A pre-filter determines whether an authentication object should be presented with the access by comparing either all or a portion of a domain suffix, an IP address, or other identification other than the user ID with predetermined values. If the filter criterion is met, the associated authentication object accepts or rejects the access. Otherwise, the access is passed to the next authentication object in the chain. The first authentication object may be associated with a hosting entity and successive authentication objects each associated with different customers of the hosting entity. By virtue of the filtering, each authentication object is presented only with a particular subset of all of the possible access identifiers, which avoids presenting all of the previously unauthenticated accesses to each authentication object in the chain.

Description:
BACKGROUND OF THE INVENTION 
       [0001]    1. Field of the Invention 
         [0002]    The present invention is related to authentication in server systems serving multiple customers, and more specifically to an authentication system that reduces the number of authentication access points by passing through authentication requests that do not meet specific criteria to the next authentication access point. 
         [0003]    2. Description of Related Art 
         [0004]    Authentication in server systems providing support for multiple customers are typically constructed using a serial authentication model. For example, in Lightweight Directory Access Protocol (LDAP) as implemented in the JAVA Authentication and Authorization Service (JAAS), each authentication access point necessarily tests for authenticity and/or authorization of each access, as a failed authentication request is rejected by the access point. (JAVA is a trademark of Sun Microsystems, Inc.) Therefore, JAAS-based authentication systems are configured sequentially and to some degree hierarchically, since in order for an access attempt to pass to the last possible authenticator, the access attempt has to be “chained” through each of the preceding authenticators. 
         [0005]    Such authentication structures are subject to tampering or hijack threats in which an either legal or illegal access to administration of one of the LDAP authenticators permits the hijacker to inserter (and therefore authorize) a user id that, for example, has privileges on a host serving all of the customers, has privileges at a global administrative level, or has privileges within another customer&#39;s application level. Further, if logging is enabled at an LDAP instance, the accesses to a downstream customer&#39;s application level may be logged by an upstream LDAP instance that belongs to another customer, exposing information about user IDs, times of access and other information, such as IP addresses, that may be considered proprietary to the other customer. 
         [0006]    Sequential authentication structures are also more susceptible to denial-of-service (DoS) attacks in general, since an attack on one LDAP instance early in the chain can block accesses to downstream LDAP instances. 
         [0007]    Therefore, it would be desirable to provide a sequential authentication model that does not expose proprietary information between customers, that avoids providing access to a particular LDAP&#39;s managed identities through administration of another LDAP, and has improved immunity to DoS attacks. 
       BRIEF SUMMARY OF THE INVENTION 
       [0008]    The invention is embodied in a computer-performed method, computer program product and computer system that authenticates clients accessing a computer network serving multiple customers. 
         [0009]    The authentication is performed with a serial chain of authenticators, with at least some of the authenticators having an associated pre-access filter that determines whether or not to present an access to the corresponding authenticator, or pass the access forward in the chain. The filter criteria may be one or more of: a portion of user ID, such as the domain suffix, an IP address range or specific IP address. The authenticators may be objects such as JAAS objects, or serially accessible authentication objects. The authenticators may be arranged and filtered such that only one authenticator is ever accessed for a particular user ID or IP address range. 
         [0010]    The foregoing and other objectives, features, and advantages of the invention will be apparent from the following, more particular, description of the preferred embodiment of the invention, as illustrated in the accompanying drawings. 
     
    
     
       BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWING 
         [0011]    The novel features believed characteristic of the invention are set forth in the appended claims. The invention itself, however, as well as a preferred mode of use, further objectives, and advantages thereof, will best be understood by reference to the following detailed description of the invention when read in conjunction with the accompanying Figures, wherein like reference numerals indicate like components, and: 
           [0012]      FIG. 1  is a block diagram illustrating a networked computer system in which techniques according to an embodiment of the present invention are practiced. 
           [0013]      FIG. 2  is a pictorial diagram showing a relationship of objects within the system of  FIG. 1 . 
           [0014]      FIG. 3  is a flow chart of a method in accordance with an embodiment of the present invention. 
       
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
       [0015]    The present invention relates to computer security software, and specifically authentication systems that handle accesses for multiple customers and optionally one or more hosting entities, such as Internet web servers, e-mail servers, media servers and electronic commerce service providers. The present invention applies particularly to authentication schemes in which multiple authenticators such as authentication objects serially process an access attempt. A filter is employed in front of each or a subset of the authentication objects, each of which may be associated with and administrated by a separate entity, such as separate customers serviced by a common service. The filter applies a criteria other than a user ID match, such as matching a portion or all of a domain name associated with the user ID and/or a network address such as an IP address, to determine whether or not a given authentication object should be provided with an access attempt. By skipping authentication objects for which the filter criterion does not match, a serial authentication scheme is provided which bars potential hijacking attempts that originate from an IP address or domain that is authorized for the host or customer, but are targeted at another customer&#39;s (or the host&#39;s) authentication list or other scheme. The technique also reduces the effectiveness of DoS attacks by reducing the number of authentication queries for a given access down to as few as one authentication query, rather than attempting to authenticate each access attempt serially at each authentication object in the system. 
         [0016]    Referring now to  FIG. 1 , a networked computer system in which an embodiment of the present invention is practiced is depicted in a block diagram. A workstation computer  10  includes a workstation processor CPU coupled to a workstation memory MEM that contains program instructions for execution by workstation processor CPU. Workstation computer  10  is also depicted as including a graphical display Display and input devices Input Devices, such as mice and keyboards, for interacting with user interfaces including login screens and other user interfaces for interacting with other computers connected to the network, for example, administration screens for administering authentication and authorization profiles used by a security gateway server  12  that is also coupled to the network. Security gateway  12  includes a server processor SCPU for executing server program instructions and a server memory SMEM for storing the server program instructions. Security gateway  12  and workstation computer system  10  are coupled to a set of application servers  14  that provide application-level services such as web and eCommerce applications for customers of a hosting entity that manages the system of  FIG. 1 . The network may include wireless local area networks (WLANs), wired local-area networks (LANs), wide-area networks (WANs) or any other suitable interconnection that provides communication between application servers  14 , security gateway  12  and workstation computer  10 . Further, the present invention concerns authentication objects and factories and authentication functionality that is not limited to a specific computer system or network configuration. Finally, the specification of a security gateway  12  and workstation  10  and the location of their specific memories MEM and SMEM does not imply a specific client-server relationship or hierarchical organization, as the techniques of the present invention may be employed in distributed systems in which no particular machine is identified as a server, but at least one of the machines provides an instance and functionality of multiple authentication objects in accordance with an embodiment of the present invention. The authentication objects may be downloaded local objects such as JAVA objects (JAVA is a trademark of Sun Microsystems, Inc.) or the authentication objects&#39; functionality may be implemented wholly within security gateway  12 , within one or more of application servers  14  or any other location within a computer network. In essence, a series of local authentication objects, or a set of interfaces to a series of authentication objects is provided at workstation computer system  10  or another location within the computer network. The authentication interfaces or objects may receive input from a user login interface, or from an automatic access interface such as an application instance that contains pre-determined access identification information. The authentication objects or interfaces then process access attempts according to methods and structures of the present invention, as described in further detail below. 
         [0017]    Referring now to  FIG. 2 , a pictorial diagram illustrating a relationship between objects and processes within the system of  FIG. 1  is shown. The depicted program structure is only one of many possible program structures for implementing the authentication methodology described herein, and is provided as an example of an embodiment of a program structure in accordance with an embodiment of the present invention. In the Figure, access attempts are received by a login module  20  that receives a user identifier comprising a user ID and domain name, for example, an Internet e-mail identifier string such as “userID@.domainname.com” as well as other information such as the Internet protocol (IP) address from which the access (or a proxy to the access) originated. The string may be provided from a typical user interface screen, or via an automatic process such as an application or system login having stored user information. The access attempt associated with the user identifier and IP address is then passed to a first one  22 A of a series of filters  22 A- 22 C that have associated authenticators  24 A- 24 C. Authenticators  24 A- 24 C, may be Lightweight Directory Access Protocol (LDAP) authenticators implemented as JAVA Authentication and Authorization Service (JAAS) objects, or any other serialized authenticators that authenticate an access or pass the access on to a next authenticator. 
         [0018]    In the depicted example, filter  22 A and authenticator  24  are associated with a host providing services to a number of customers, e.g., an eCommerce, email and web services host. Filter  22 B and authenticator  24 B are associated with a first customer Customer A and filter  22 C and authenticator  24 C are associated with a second customer Customer B. In traditional serial authentication systems, an access provided from login module  20  would be passed to each of authenticators  24 A- 24 C until one of authenticators  24 A- 24 C authenticates the user attempting access. Therefore, a user ID associated with Customer B would be “seen” and possibly logged by each of authenticators  24 A and  24 B before being finally authorized by authenticator  24 C. However, in the present invention, filters  22 A- 22 C apply filter criteria before attempting to authenticate a user by matching a portion of the domain name, e.g., by matching the “domainname.com” portion of the e-mail identifier given in the example above and/or the IP address, with a known set of domains or IP addresses associated with the host or customer corresponding to the filter. For example, if the host is xyzcorp.com, customer A is abccorp.com and customer a is npocorp.org, filter  22 A may pass only users having domain suffix @xyzcorp.com to authenticator  24 A, filter  22 B may pass only users having domain suffix @abccorp.com to authenticator  24 B and filter  22 C may pass only users having domain suffix npocorp.org to authenticator  24 C. An authorization system receives accesses from authenticated users as provided by one of authenticators  24 A- 24 C, and grants tokens and/or a security descriptor that informs application layers and the operating system(s) as to the privileges permitted to the particular user (or software) accessing the system. 
         [0019]    The filtering operation described above provides several useful behaviors. With respect to entity privacy, userIDs associated with npocorp.org will only be “seen” by authenticator  24 C and therefore, while they may be known to the hosting provider, customer A cannot log their accesses at authenticator  24 B, as those accesses never arrive at authenticator  24 B, due to filtering by filter  22 B. If Customer A&#39;s authenticator  24 B were to log accesses for Customer B, a list of Customer A&#39;s users could be built, potentially compromising sensitive business information proprietary to Customer A. Also, a DoS attack using an invalid user specification, e.g., “invaliduser@abccorp.com” will result in authentication attempts only authenticator  24 B, reducing the amount of time required to reject the access. Finally, since authenticators  24 A- 24 C may be individually administrated by separate administration services  26 A- 26 C, a user having administrative access for managing the authentication list for an authenticator, e.g. authenticator  24 C, cannot successfully add a user corresponding to another customer or the host to the authentication list, since the domain suffix and/or IP address will not meet the filter criteria at filter  22 C. Otherwise, for example, customer B&#39;s administrator could add a user “admin@xyzcorp.com” so that a user presenting that identification would be authenticated, if no filtering were employed, by authenticator  24 C. Once authenticated, if authorization system  28  recognizes “admin@xyzcorp.com” as corresponding to a user with administrative privileges over the resources of the host (and possibly all of the customers), administrative access to authenticator  24 C could permit hijacking unauthorized portions of the system. Hijacking could also potentially occur between customers. 
         [0020]    Referring now to  FIG. 3 , a method in accordance with an embodiment of the present invention is illustrated in a flowchart. In the depicted method, an access attempt including userID, domain path and IP address is received (step  40 ). The IP address and/or domain path portion is compared with a list of predetermined authorized identifiers for the host and if a match is found (decision  41 ) the access is passed to the host&#39;s authentication object, which determines if the userID, password and/or certificate are authentic (decision  42 ). If the IP address and/or domain path portion does not match the host&#39;s list, then the access is passed to the next authenticator and the IP address and/or domain path portion is compared with a list of predetermined authorized identifiers for Customer A. If a match is found (decision  43 ) the access is passed to Customer A&#39;s authentication object, which determines if the userID, password and/or certificate are authentic (decision  44 ). Next, if the IP address and/or domain path portion does not match Customer A&#39;s list, then the access is passed to the next authenticator and the IP address and/or domain path portion is compared with a list of predetermined authorized identifiers for Customer B. If a match is found (decision  45 ) the access is passed to Customer B&#39;s authentication object, which determines if the userID, password and/or certificate are authentic (decision  46 ). If the access is authenticated by any of decision  42 , decision  44  or decision  46 , then the user is authorized according to the userID, password and/or certificates (step  48 ), otherwise authentication fails (step  47 ). 
         [0021]    As demonstrated above, the present invention provides a new way of implementing and operating a serial authentication scheme that removes hijacking possibilities between multiple entities served by a single service provider, protects user ID information as between customers, and reduces the latency of response to DoS attacks. The techniques of the present invention may also be employed in serial authorization schemes, or access schemes in which authentication and authorization are both performed prior to passing an access along to the next authenticator when authentication and/or authorization fails at a given authentication object. While the techniques described herein are illustrated with respect to JAAS objects performing LDAP authentication, the present invention may be employed in any serial authentication scheme, and may be performed for the entire chain of authentication objects, or only a subset of the authentication objects. 
         [0022]    While the invention has been particularly shown and described with reference to the preferred embodiments thereof, it will be understood by those skilled in the art that the foregoing and other changes in form, and details may be made therein without departing from the spirit and scope of the invention.