System and method for authentication and authorization using a centralized authority

The invention features a system and method for authenticating and authorizing a user to log onto a network element in a telecommunications optical network. The administration of security for the network is handled by a centralized authority. The centralized authority maintains the accounts for individuals authorized to log onto the network elements and their associated privileges. In one embodiment, to log onto a network element a user provides a user identifier and user authentication information to the centralized authority. The centralized authority then processes the user identifier and user authentication information to authenticate the user. If authenticated, the centralized authority determines a privilege level for the user and generates an affirmative response that includes the user identifier and the privilege level. Provided with the affirmative response, the network element logs the user onto the network element with the associated privilege level.

FIELD OF THE INVENTION

The invention relates generally to security systems and methods in telecommunications networks. More particularly, the invention relates to authenticating and authorizing a user to log onto a network element in a telecommunications network.

BACKGROUND

Optical networks can have thousands of network elements. Administrating (or managing) who has authority to access any particular network element can be a daunting task in large networks. For example, if an individual has a change in his employment status, that individual needs to be given authority to access certain network elements, e.g., in the case of a new hire, or to have his authority revoked, e.g., in the case of terminated employment. In some prior art systems, to accommodate each status change of an individual, a network administrator needs to access each affected network element to update that individual's account on that device (i.e., to add or revoke). The large number of network elements renders this process effectively prohibitive, and so it is typically not done. For situations involving individuals who are terminating employment, failing to revoke authorization leaves a security gap in the network.

To avoid having to update each network element for each change in status, one technique is to create a set of default accounts on each network element. Passwords to access these accounts are only distributed to individuals who require authorization. The passwords are then regularly changed and new passwords distributed only to those who remain authorized. Thus, authority is effectively revoked from individuals who do not receive a new password. This technique, too, has security failings. For one, their distribution makes such passwords known to many individuals, and further, such passwords are often readily guessable. An additional disadvantage is that because various individuals share the password, uncertainty exists as to who actually logged onto a particular network element and performed certain activities while logged on. Thus, there is a need for a secure and non-repudiable system and method for managing access to and granting privileges on particular network elements.

SUMMARY

In one aspect, the invention features a method for authenticating and authorizing a user to log onto to a network element in a telecommunications network. The method includes providing a user identifier and user authentication information to a centralized authority. The centralized authority is responsible for authenticating users attempting to log onto the network element. The method also includes the centralized authority authenticating the user based on the user identifier and the user authentication information. Additionally the method includes generating a response that includes the user identifier and a privilege level for the user.

In another aspect, the invention features a system in a telecommunications network environment that authenticates and authorizes a user. The system includes a network element connected to the telecommunications network. The system also includes a centralized authority that receives from the user a user identifier and user authorization information. The system further includes a response generated by the centralized authority and provided to the network element to log the user onto the network element. The response contains the user identifier and a user privilege level.

In yet another aspect, the invention features a computer program product for use with a computer system. The computer program product comprises a computer useable medium having embodied therein program code comprising program code for providing a user identifier and user authentication information to a centralized authority responsible for authenticating users attempting to log onto the network element, program code for authenticating the user based on the user identifier and the user authentication information, and program code for generating a response authorizing the user to log onto the network element that includes the user identifier and a privilege level for the user.

DETAILED DESCRIPTION

The invention features a system and method for authenticating and authorizing a user to log onto a network element in a telecommunications network. In brief overview, the administration of security for the network is handled by a centralized authority. The centralized authority maintains the accounts for individuals authorized to log onto the network elements and their associated privileges. In one embodiment, to log onto a network element, a user provides a user identifier and user authentication information to the centralized authority. The centralized authority then processes the user identifier and user authentication information to authenticate the user. If authenticated, the centralized authority determines a privilege level for the user and generates an affirmative response that includes the user identifier and the privilege level. Provided with the affirmative response, the user logs onto the network element with the associated privilege level. The user identifier in the affirmative response ensures the non-repudiation of the identity of the individual accessing the network element.

The centralization of management of user accounts of the present invention has security and administrative benefits. User account information does not propagate from the centralized authority to the potentially thousands of network elements in the network. Because the centralized authority maintains a list of the individuals authorized to access the network elements and their associated privileges, each network element does not need to keep a record of the individuals authorized to log onto and use the particular network element. Also, the centralization of account information simplifies the task of adding or removing user accounts and of upgrading or degrading user privileges.

FIG. 1shows an embodiment of a telecommunications system10in accordance with the principles of the invention. The system10includes a plurality of network elements14, a network operations center (NOC)18and a central server22connected to a network26. The network26can be an optical network such as a SONET network, a wide area network, a local area network, a metropolitan area network, the internet, etc. The network elements14can be edge devices that interface between the core of an optical network and a plurality of signal types, such as DS1, E1, DS3, E3, EC-1, STM-1e, 10BT, 100BT, and 1000BT. In alternative embodiments, the NOC18and the central server22can be located at a common site. In one embodiment, the central server22executes Remote Authentication Dial In User Service (RADIUS) access control protocols (RFC 2865).

Typically each network element14is in communication with a plurality of user devices30. The communication can be, for example, over the network26. For simplicity of presentation, only one user device30is shown inFIG. 1. Here, for example, the user device30is a personal computer that a user can employ to log onto one of the network elements14. Also as shown inFIG. 1, the NOC18is connected by a communications channel34to a communications device38located in close proximity to the user device30.

The communications device38and the communications channel34enable a user and the NOC18to exchange messages that do not pass through the network element14. In the embodiment shown inFIG. 1, the communications device38is a telephone and the communications channel34is a telephone network. In an alternative embodiment, the communications device38is a network interface device that can be embedded into the user device30and the communications channel34is a wide area network such as the Internet. In this embodiment, the communications channel34can pass through the network26.

FIG. 2shows an embodiment of a process60for authenticating and authorizing a user to log onto a network element in accordance with the principles of the invention. As shown, the process60includes a user transaction site64and a centralized authority68having an authorization database84. In one embodiment, the user transaction site64includes the user device30, one of the network elements14, and the communications device38shown inFIG. 1. The elements of the user transaction site64can be located at the same or at different physical locations. The centralized authority68can include the NOC18and the central server22.

At step200, a user initiates communication with one of the network elements14. At step204, a user identifier76and user authentication information80are provided to the centralized authority68. In one embodiment, the user identifier76is a unique user name and the user authentication information80is a user password. The identities of the network element14and of the sub-network to which the network element14belongs can also be provided to the centralized authority68.

In one embodiment, the user identifier76, the user authentication information80, and any additional information are provided to the centralized authority68in a request for authentication and authorization. Typically the request is generated by the network element14in response to the user's log on attempt. After generation, the response is provided to the central server22over a network connection. In addition to the contents of the request being encrypted, a secure communications channel, such as SSL, can be established between the network element14and the central server22to ensure that causal eavesdroppers cannot decipher the contents of the request. Transport between the network element14and the central server22can be conducted according to RADIUS protocols.

When processing the user identifier76and the user authentication information80, the centralized authority68authenticates (step212) the user by comparing the provided user identifier76and user authorization information80with values stored in the authorization database84. If the user is authorized, then the centralized authority68determines (step216) a privilege level for the user. Based on the security policy of an administrator, the privilege level specifies numerous aspects of the nature and degree of access that the user is granted on the network element14. For example, the privilege level can specify whether the access is read-only, write, etc. In addition, the privilege level can specify the content that the user is allowed to access. The privilege level can also be dependent on the identity of the network element14to which the user is attempting to log on. That is, a user can be granted a different level of access for different network elements.

In one embodiment, the privilege level places a limitation on the domain that the user can access. This technique for basing the privilege level upon user domain is referred to as domain segmentation. For example, the privilege level can limit the user to a single network element, to network elements within a range of Internet Protocol (IP) addresses, or to network elements in a particular geographical zone (e.g., the East Coast, the Midwest, country-wide). Thus, the user can receive a different privilege level depending on the geographic location or IP address of the network element that the user is attempting to log onto.

At step220, the centralized authority68generates a response88. The response88includes the user identifier76and authorization response information92. If the response88is an affirmative response, then the authorization response information92includes the privilege level previously determined. In a negative response, the authorization response information92includes data that indicates that authorization has been denied for the user to log onto the network element. In other embodiments, the response88can include additional information such as the time and date of the last successful log on, the duration of the last log on session, and the time, date, and number of previous unsuccessful attempts to log on.

The response88is provided (step224) to the user transaction site64and processed (step228) by the network element14. Based on its processing of the response88, the network element14either grants (step232) the user access with the corresponding privilege level or denies (step232) the user's log on attempt. The presence of the user identifier76in the response88ensures that the user cannot repudiate having logged onto the network element14. Further, the user can not repudiate any actions taken during a session because the session is associated with the particular user identifier76.

FIG. 3shows an embodiment of a process110for authenticating and authorizing a user to log onto a network element when communication between the network element14and the central server22is not available. As shown, the process110involves the network element14, the central server22, and the NOC18ofFIG. 1. The process110also involves a user site32that, in one embodiment, includes the user device30and the communications device38ofFIG. 1. The operation and interconnections of the components of system110that are present inFIG. 1are as described above.

The process110for authenticating and authorizing a user includes the user attempting to log onto (step300) the network element14from the user device30. This attempt includes transmitting (step304) a user identifier76and user authentication information80to the network element14. With this information, the network element14generates (step308) a request114for authenticating and authorizing the user. The network element14then attempts to communicate (step312) the request114to the central server22. In the embodiment of the invention shown inFIG. 3, the network element14determines (step314) that the communication attempt has failed. The communication can fail for many reasons including the central server22not being operational or the communications connection between the central server22and the network element14experiencing network problems.

With communication with the central server22unavailable, the network element14generates (step316) a challenge118that is transmitted (step318) to the user site32. In one embodiment, the challenge118is a randomly generated eight-byte character string. The challenge118is generated by an algorithm that uniquely associates every challenge118with a challenge response122. Different network elements14in the network26employ the same algorithm, and the result produced by the algorithm is independent of the particular network element14executing the algorithm. That is, the correct challenge response122for a given challenge118is the same regardless of the network element14generating the challenge118. As discussed below, the challenge response122is generated by the NOC18. According to the invention, therefore, the NOC18does not need to synchronize with the network elements14during the challenge-challenge response process. This independent operation eliminates significant management and operational overhead.

Although the correct challenge response122for a given challenge118is independent of a particular network element14, the challenge118can include information that identifies the particular network element14that generated the challenge118. As described below, such information can be used to generate a privilege level.

Although the process110shown inFIG. 3includes the attempt (step312) by the network element14to communicate with the central server22before generating (step316) the challenge118, the challenge118can be generated immediately in response to a user attempting to log onto the network element14. This situation could occur if the network element14already has information indicating that the central server22is unavailable. Such information can be obtained, for example, by a previous failed communication attempt (step312).

The process of authenticating and authorizing the user when communication with the central server22is unavailable also includes the user site32establishing (step320) a communications connection with the NOC18. From the user site32, a user identifier76and user authentication information80are provided (step324) to the NOC18. With the user identifier76and the user authentication information80, the NOC18authenticates (step328) the identity of the user who is attempting to log onto the network element14. The user identifier76and the user authentication information80need not be the same as that used in the request114. For example, a user telephoning the NOC18can verbally provide his or her name and certain information known by the user and unlikely to be known by imposters. Such information can include, for example, a mother's maiden name, a high school attended, etc. Security policy for an administrator of the NOC18can determine the manner of performing the third-party verification.

After the user has been authenticated (step328), the NOC18is provided (step332) from the user site32with the challenge118. Next, the NOC18determines (step336) a privilege level for the user. As discussed above, if there are geographical restrictions on privilege levels, the NOC18can use network element identifying information contained in the challenge118in determining the privilege level. With the privilege level information, the NOC18generates (step340) the corresponding challenge response122for the received challenge118.

Embedded in the challenge response122are the user identifier76and the privilege level. The challenge response122is resistive to reverse engineering as it is cryptographically protected, having been generated by a strong message-digest or encryption algorithm (e.g., MD5). Security for the generation of the challenge responses122is maintained by restricting access to the possession of a secret, such as a password, a token, a biometric, a smart card, etc., that is necessary for operating a challenge response calculator. The challenge response calculator contains the algorithm that computes valid challenge responses122from submitted challenges118.

At step344, the NOC18provides the challenge response122to the user site32. The user identifier76and privilege level are not plainly discernable from the challenge response122. The user is thus unable to alter the information to change either his or her identity or access rights. In the embodiment shown inFIG. 3, the user manually enters the challenge response (step348) into the user device30, which then transmits (step352) the challenge response122to the network element14. In an alternative embodiment, the challenge response122can be automatically transferred to the network element14either directly from the communications device38or from an embedded communications device located in the user device30.

The network element14evaluates (step356) the challenge response122to determine whether it is correct given the issued challenge118. For a correct challenge response122, the network element14extracts (step358) the user identifier76and the privilege level and logs (step360) the user on in accordance with the privilege level. The presence of the user identifier76ensures that the user cannot repudiate having gained access to the network element14. Typically the challenge response122is valid for logging onto the network element14only once. If the user terminates the session or the session times out, the user must repeat the process to log onto the network element14again (provided communication with the central server22is still unavailable). In this case the user receives a new challenge118and a new corresponding challenge response122.

Aspects of the present invention, for example, algorithms for generating challenges and challenge-responses, may be implemented as one or more computer-readable software programs embodied on or in one or more articles of manufacture. The article of manufacture can be, for example, any one or combination of a floppy disk, a hard disk, hard-disk drive, a CD-ROM, a DVD-ROM, a flash memory card, an EEPROM, an EPROM, a PROM, a RAM, a ROM, or a magnetic tape. In general, any standard or proprietary, programming or interpretive language can be used to produce the computer-readable software programs. Examples of such languages include C, C++, Pascal, JAVA, BASIC, Visual Basic, and Visual C++. The software programs may be stored on or in one or more articles of manufacture as source code, object code, interpretive code, or executable code.