Apparatus and method for shared credential authentication

An authentication system for providing shared credential authentication includes a client information handling (IHS) system having a resource service application, and a mobile IHS having a shared authentication application. The shared authentication token indicates that an authenticated state between the client IHS and the mobile IHS exists. The resource service application receives a request to access the resource, and sends an authentication request to an authentication server to authorize access to the resource. The shared authentication application receives a query from the authentication server to verify a status of a shared authentication token, and, when the shared authentication token is valid, responds to the query that the shared authentication token is valid. The resource service application further receives a response to the authentication request, and grants access to the resource when the authentication token indicates that the shared authentication token is valid.

FIELD OF THE DISCLOSURE

This disclosure generally relates to information handling systems, and more particularly relates to sharing credential authentication in an information handling system.

BACKGROUND

SUMMARY

An authentication system for providing shared credential authentication may include a client information handling (IHS) system having a resource service application, and a mobile IHS having a shared authentication application. The shared authentication token may indicate that an authenticated state between the client IHS and the mobile IHS exists. The resource service application may receive a request to access the resource, and send an authentication request to an authentication server to authorize access to the resource. The shared authentication application may receive a query from the authentication server to verify a status of a shared authentication token, and when the shared authentication token is valid, respond to the query that the shared authentication token is valid. The resource service application may further receive a response to the authentication request, and grant access to the resource when the authentication token indicates that the shared authentication token is valid.

DETAILED DESCRIPTION OF DRAWINGS

FIG. 1illustrates an embodiment of an information handling system100including processors102and104, a chipset110, a memory120, a graphics adapter130connected to a video display134, a non-volatile RAM (NV-RAM)140that includes a basic input and output system/extensible firmware interface (BIOS/EFI) module142, a disk controller150, a hard disk drive (HDD)154, an optical disk drive156, a disk emulator160connected to a solid state drive (SSD)164, an input/output (I/O) interface170connected to an add-on resource174and a trusted platform module (TPM176, a network interface180, and a baseboard management controller (BMC)190. Processor102is connected to chipset110via processor interface106, and processor104is connected to the chipset via processor interface108. In a particular embodiment, processors102and104are connected together via a high-capacity coherent fabric, such as a HyperTransport link, a QuickPath Interconnect, or the like.

Chipset110represents an integrated circuit or group of integrated circuits that manages the data flows between processors102and104and the other elements of information handling system100. In a particular embodiment, chipset110represents a pair of integrated circuits, such as a northbridge component and a southbridge component. In another embodiment, some or all of the functions and features of chipset110are integrated with one or more of processors102and104. Memory120is connected to chipset110via a memory interface122. An example of memory interface122includes a Double Data Rate (DDR) memory channel and memory120represents one or more DDR Dual In-Line Memory Modules (DIMMs). In a particular embodiment, memory interface122represents two or more DDR channels. In another embodiment, one or more of processors102and104include a memory interface that provides a dedicated memory for the processors. A DDR channel and the connected DDR DIMMs can be in accordance with a particular DDR standard, such as a DDR3 standard, a DDR4 standard, a DDR5 standard, or the like. Memory120may further represent various combinations of memory types, such as Dynamic Random Access Memory (DRAM) DIMMs, Static Random Access Memory (SRAM) DIMMs, non-volatile DIMMs (NV-DIMMs), storage class memory devices, Read-Only Memory (ROM) devices, or the like.

Graphics adapter130is connected to chipset110via a graphics interface132, and provides a video display output136to a video display134. An example of a graphics interface132includes a Peripheral Component Interconnect-Express (PCIe) interface and graphics adapter130can include a four lane (×4) PCIe adapter, an eight lane (×8) PCIe adapter, a 16-lane (×16) PCIe adapter, or another configuration, as needed or desired. In a particular embodiment, graphics adapter130is provided down on a system printed circuit board (PCB). Video display output136can include a Digital Video Interface (DVI), a High-Definition Multimedia Interface (HDMI), a DisplayPort interface, or the like, and video display134can include a monitor, a smart television, an embedded display such as a laptop computer display, or the like.

NV-RAM140, disk controller150, and I/O interface170are connected to chipset110via an I/O channel112. An example of I/O channel112includes one or more point-to-point PCIe links between chipset110and each of NV-RAM140, disk controller150, and I/O interface170. Chipset110can also include one or more other I/O interfaces, including an Industry Standard Architecture (ISA) interface, a Small Computer Serial Interface (SCSI) interface, an Inter-Integrated Circuit (I2C) interface, a System Packet Interface (SPI), a Universal Serial Bus (USB), another interface, or a combination thereof. NV-RAM140includes BIOS/EFI module142that stores machine-executable code (BIOS/EFI code) that operates to detect the resources of information handling system100, to provide drivers for the resources, to initialize the resources, and to provide common access mechanisms for the resources. The functions and features of BIOS/EFI module142will be further described below.

Network interface180represents a network communication device disposed within information handling system100, on a main circuit board of the information handling system, integrated onto another component such as chipset110, in another suitable location, or a combination thereof. Network interface device180includes a network channel182that provides an interface to devices that are external to information handling system100. In a particular embodiment, network channel182is of a different type than peripheral channel172and network interface180translates information from a format suitable to the peripheral channel to a format suitable to external devices. In a particular embodiment, network interface180includes a network interface card (NIC) or host bus adapter (HBA), and an example of network channel182includes an InfiniBand channel, a Fibre Channel, a Gigabit Ethernet channel, a proprietary channel architecture, or a combination thereof. In another embodiment, network interface180includes a wireless communication interface, and network channel182includes a WiFi channel, a near-field communication (NFC) channel, a Bluetooth or Bluetooth-Low-Energy (BLE) channel, a cellular based interface such as a Global System for Mobile (GSM) interface, a Code-Division Multiple Access (CDMA) interface, a Universal Mobile Telecommunications System (UMTS) interface, a Long-Term Evolution (LTE) interface, or another cellular based interface, or a combination thereof. Network channel182can be connected to an external network resource (not illustrated). The network resource can include another information handling system, a data storage system, another network, a grid management system, another suitable resource, or a combination thereof.

BMC190is connected to multiple elements of information handling system100via one or more management interface192to provide out of band monitoring, maintenance, and control of the elements of the information handling system. As such, BMC190represents a processing device different from processor102and processor104, which provides various management functions for information handling system100. For example, BMC190may be responsible for power management, cooling management, and the like. The term baseboard management controller (BMC) is often used in the context of server systems, while in a consumer-level device a BMC may be referred to as an embedded controller (EC). A BMC included at a data storage system can be referred to as a storage enclosure processor. A BMC included at a chassis of a blade server can be referred to as a chassis management controller and embedded controllers included at the blades of the blade server can be referred to as blade management controllers. Capabilities and functions provided by BMC180can vary considerably based on the type of information handling system. BMC190can operate in accordance with an Intelligent Platform Management Interface (IPMI). Examples of BMC190include an Integrated Dell Remote Access Controller (iDRAC). Management interface192represents one or more out-of-band communication interfaces between BMC190and the elements of information handling system100, and can include an Inter-Integrated Circuit (I2C) bus, a System Management Bus (SMBUS), a Power Management Bus (PMBUS), a Low Pin Count (LPC) interface, a serial bus such as a Universal Serial Bus (USB) or a Serial Peripheral Interface (SPI), a network interface such as an Ethernet interface, a high-speed serial data link such as a Peripheral Component Interconnect-Express (PCIe) interface, a Network Controller Sideband Interface (NC-SI), or the like. As used herein, out-of-band access refers to operations performed apart from a BIOS/operating system execution environment on information handling system100, that is apart from the execution of code by processors102and104and procedures that are implemented on the information handling system in response to the executed code.

BMC190operates to monitor and maintain system firmware, such as code stored in BIOS/EFI module142, option ROMs for graphics interface130, disk controller150, add-on resource174, network interface180, or other elements of information handling system100, as needed or desired. In particular, BMC190includes a network interface194that can be connected to a remote management system to receive firmware updates, as needed or desired. Here, BMC190receives the firmware updates, stores the updates to a data storage device associated with the BMC, transfers the firmware updates to NV-RAM of the device or system that is the subject of the firmware update, thereby replacing the currently operating firmware associated with the device or system, and reboots information handling system, whereupon the device or system utilizes the updated firmware image. BMC190utilizes various protocols and application programming interfaces (APIs) to direct and control the processes for monitoring and maintaining the system firmware. An example of a protocol or API for monitoring and maintaining the system firmware includes a graphical user interface (GUI) GUI associated with BMC190, an interface defined by the Distributed Management Taskforce (DMTF) (e.g., a Web Services Management (WS-MAN) interface, a Management Component Transport Protocol (MCTP) or, a Redfish interface), various vendor defined interfaces (e.g., a Dell EMC Remote Access Controller Administrator (RACADM) utility, a Dell EMC OpenManage Server Administrator (OMSS) utility, a Dell EMC OpenManage Storage Services (OMSS) utility, or a Dell EMC OpenManage Deployment Toolkit (DTK) suite), a BIOS setup utility such as invoked by a “F2” boot option, or another protocol or API, as needed or desired.

In a particular embodiment, BMC190is included on a main circuit board (e.g., a baseboard, a motherboard, or any combination thereof) of information handling system100, or is integrated onto another element of the information handling system such as chipset110, or another suitable element, as needed or desired. As such, BMC190can be part of an integrated circuit or a chip set within information handling system100. An example of BMC190includes an integrated Dell remote access controller (iDRAC), or the like. BMC190may operate on a separate power plane from other resources in information handling system100. Thus BMC190can communicate with the management system via network interface194while the resources of information handling system100are powered off. Here, information can be sent from the management system to BMC190and the information can be stored in a RAM or NV-RAM associated with the BMC. Information stored in the RAM may be lost after power-down of the power plane for BMC190, while information stored in the NV-RAM may be saved through a power-down/power-up cycle of the power plane for the BMC.

In a typical usage case, information handling system100provides secure access to various resources of the information handling system or of other network-based resources that are connected to the information handling system via one or more interface of network interface180. For example, information handling system100may employ a hierarchical authentication and access scheme that permits a user of the information handling system to have different levels of access to the secure resources based upon various authentication credentials that are provided by the user. Further, the individual secure resources, and particularly web-based resources, may each employ their own authentication and access schemes based upon authentication credentials that are provided by the user for access to the various secure resources. As such a user may be required to provide login credentials to access the OS of information handling system100, and to provide different login credentials to access each of a virtual private network (VPN), an authenticated web-based service such as Facebook or Google, a payment or banking network, or the like. Thus, in the course of a session using information handling system100, the user may be required to provide a myriad of login credentials at various times in the session, based upon the usage to which the user puts the information handling system.

FIG. 2illustrates an authentication system200including a client computer210, a connected device220, a primary authentication server230, and a secondary authentication server240. Client computer210represents an information handling system similar to information handling system100and includes an authentication application212, a connected device interface214, a secondary service216, and a secondary resource218. Authentication application212represents a standardized framework for authenticating a user of client computer210to operate and to have access to the resources of the client computer. In a particular embodiment, authentication application212operates to query primary authentication server230with various authentication tokens and receives authentication credentials from the primary authentication server when the user of client computer210is authorized to operate and have access to the resources of the client computer. An example of an authentication application can include one or more applications or suite of applications that implement a Companion Device Framework/Client-to-Authenticator Protocol (CDF/CTAP). An example of primary authentication server230can include an Active Directory server. The functions and features of an authentication application similar to authentication application212in authenticating a user of a client computer via a primary authentication server are known in the art and will not be further discussed herein, except as may be necessary to further illustrate the present disclosure. The functions and features of connected device interface214, secondary service216, and secondary resource218will be described further below.

Connected device220represents an information handling system similar to information handling system100and includes an authentication application222, a connected device interface224, and a shared credential authentication application226. Authentication application222represents a standardized framework that is compatible with authentication application212for authenticating connected device222to client computer210to operate and to share access to the resources of the client computer and the connected device. Here, connected device interfaces214and224represent communication interfaces that are configured to permit data and information communication between client computer210and connected device220. In particular, connected device interfaces214and224provide for wireless communication between client computer210and connected device220, where the connectivity is provided based upon the proximity of the client computer and the connected device to each other. As such, client computer210is wirelessly connected to connected device220via a wireless link established between connected device interfaces212and214. Examples of connected device interfaces212and214can include various wireless wide-area network (WWAN) interface devices including various wireless cellular interface devices, WiMAX (IEEE 802.16) interface devices, or the like, wireless local area network (WLAN) interface devices including WiFi (IEEE 802.11) interface devices, wireless personal area network (WPAN) interface devices including Bluetooth interface devices, Bluetooth-Low-Energy (BLE) interface devices, or the like, Near Field Communication (NFC) interface devices, or a combination thereof.

When client computer210and connected device220are brought within proximity of each other, a handshaking process for forming the wireless link between connected device interfaces214and224is performed. Here, proximity is defined by the physical characteristics of connected device interfaces214and224and the particular wireless communication standard under which they operate. Once the wireless link is established between connected device interfaces214and224, authentication applications212and222initiate a process for authenticating the access of the resources of client computer210and of connected device220.

In a particular embodiment, authentication applications212and222operate to provide a CDF/CTAP environment. Here, when the wireless link is established between connected device interfaces214and224, authentication application222requests authentication from authentication application212, and a user of client computer210provides authentication credentials, such as a username/password log in, a biometric authentication credential, or the like to authenticate that the user is authorized to utilize the resources of connected device220. From the authentication credentials, authentication application222derives an authentication key250that represents that the user of client computer210is authorized to utilize the resources of connected device220, and creates an authentication token252that is shared with authentication application212. Authentication token252represents the authenticated status between client computer210and connected device220. As such, authentication application212maintains the validity of authentication token252on client computer210only as long as the wireless link between connected device interfaces214and224remains intact. As soon as the wireless link is lost, authentication application212invalidates authentication token252, and any subsequent reassertion of the wireless link between connected device interfaces214and224must be accompanied by a reauthentication process between client computer210and connected device220. In this way, the maintenance of the wireless link serves to ensure a secure and recognized authentication state between client computer210and connected device220. Similarly, authentication application222maintains the validity of authentication token252on connected device220only as long as the wireless link between connected device interfaces214and224remains intact, and as soon as the wireless link is lost, authentication application222invalidates authentication token252. In this way, the maintenance of the wireless link operates to ensure that the authenticated user of client computer210is maintained as the authenticated user and to maintain secure access to the resources of connected device220.

Secondary service216represents an application running on client computer210that operates to permit the user of the client computer to access secondary resource218. As illustrated, secondary resource218represents various secure resources of client system210, but this is not necessarily so, and the secondary resource may also be outside of the client system. For example, secondary resource218may represent a virtual private network (VPN) access established on a network device of client system210, a network or Internet-based service, a payment or banking transaction service, or the like. As such, secondary resource218is characterized by the fact that the user of client computer210does not have native access granted to the secondary resource by virtue of the client's login status on an operating system of the client computer, or the existence of an authenticated state between the client computer and connected device220. Instead, the user of client system210is required to be authenticated to the use of secondary resource218through secondary service216, before being granted access to the secondary resource. In a particular embodiment, secondary service216operates to provide a login or authentication session for the user to provide authentication credentials to permit access to secondary resource218.

In another embodiment, when the user of client computer210uses secondary service216to access secondary resource218, the secondary service initiates an authentication process that is based upon the status of authentication token252between client computer210and connected device220. First, secondary service216sends an authentication request to secondary authentication server240. The authentication request includes identifying information for client computer210, such as a machine id, and for identifying information for the user of the client computer, such as a user name. Here, secondary authentication server240is associated with secondary resource218such that the secondary authentication server authenticates the user of client computer210prior to granting the user access to the secondary resource. For example, where secondary resource218represents a VPN, secondary authentication server240may represent a server associated with the VPN that operates to authenticate access requests to the VPN. In another example, where secondary resource218represents an Internet-based service, such as Facebook, Google, or the like, secondary authentication server240may represent an authentication server associated with the Internet-based service that operates to authenticate access requests to the Internet-based service. In yet another example, where secondary resource218represents a payment or banking transaction service, secondary authentication server240may represent an authentication server associated with the payment or banking transaction service that operates to authenticate access requests to the payment or banking transaction service.

Here, rather than providing a login or authentication session for the user to provide authentication credentials to permit access to secondary resource218, secondary authentication server240operates to send a query to shared credential authentication application226in connected device220to determine the connection status between client computer210and the connected device. In particular, secondary authentication server240is preconfigured with information that relates client computer210and the user of the client computer with connected device220. As such, when the secondary authentication server receives the identifying information for client computer210and for the user of the client computer from the authentication request from secondary service216, the secondary authentication resource determines send the query to connected device210based upon the preconfigured association information. When shared credential authentication application226receives the query from secondary authentication server240, the shared credential authentication application request authentication application222to provide the connection status between client computer210and connected device220.

If client computer210and connected device220are not connected and do not retain shared authentication token252, then shared credential authentication application226receives an indication that the client computer and the connected device do not share the authentication token. Then shared credential authentication application226informs secondary authentication server240that the connection between client computer210and connected device220is not authenticated, and the secondary authentication server provides an indication to secondary service216to deny the user access to secondary resource218. In this case, secondary service216can operate to provide a login or authentication session for the user to provide authentication credentials to permit access to secondary resource218.

If client computer210and connected device220are connected and retain shared authentication token252, then shared credential authentication application226receives confirmation that the client computer and the connected device share the authentication token. Then shared credential authentication application226informs secondary authentication server240that the connection between client computer210and connected device220is authenticated, and the secondary authentication server provides an indication to secondary service216to grant the user access to secondary resource218. In a particular case of the present embodiment, when secondary service218sends the authentication request to secondary authentication server240, the authentication request includes authentication token252, or a hash thereof, along with the authentication request. Then further, when shared credential authentication application226informs secondary authentication server240that the connection between client computer210and connected device220is authenticated, the shared credential authentication application further includes authentication token252, or a hash thereof. Then, secondary authentication server240compares the received versions of authentication token252to further verify that the connection status between client computer210and connected device220is authenticated.

If, at some later point in time, the authenticated connection between client computer210and connected device220is lost, authentication applications212and222each invalidate authentication token252, as described above. Here, authentication application222further indicates that client computer210and connected device220no longer share the authentication token. Then shared credential authentication application226informs secondary authentication server240that the connection between client computer210and connected device220has been lost, and the secondary authentication server provides an indication to secondary service216to deny the user access to secondary resource218. In this case, secondary service216may again operate to provide a login or authentication session for the user to provide authentication credentials to permit access to secondary resource218.

In a particular non-limiting, exemplary embodiment, the computer-readable medium can include a solid-state memory such as a memory card or other package that houses one or more non-volatile read-only memories.

Further, the computer-readable medium can be a random access memory or other volatile re-writable memory. Additionally, the computer-readable medium can include a magneto-optical or optical medium, such as a disk or tapes or other storage device to store information received via carrier wave signals such as a signal communicated over a transmission medium. A digital file attachment to an e-mail or other self-contained information archive or set of archives may be considered a distribution medium that is equivalent to a tangible storage medium. Accordingly, the disclosure is considered to include any one or more of a computer-readable medium or a distribution medium and other equivalents and successor media, in which data or instructions may be stored.