Disconnected credential validation using pre-fetched service tickets

One or more user service tickets are obtained (i.e. pre-fetched) from an authentication server and stored in a ticket cache. The user service tickets facilitate a login device communicating with one or more users or group members associated with the login device. Login credentials for the users or group members may be subsequently authenticated against the user service tickets within the ticket cache thereby eliminating the need for immediate access to the authentication server or a previous login session by the users or group members. The user service tickets within the ticket cache may be refreshed as needed. In one embodiment, the user service tickets are refreshed daily and also in response to login attempts if the authentication service is readily accessible.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to computer network authentication services. Specifically, the invention relates to apparatus, methods, and systems for providing disconnected validation of login credentials.

2. Description of the Related Art

In recent years, computer networks have been increasingly significant in terms of the quantity and sensitivity of the data communicated. Once used primarily for academic purposes, the Internet has become a vehicle for communicating such confidential information as credit card transactions, bank account transactions, and corporate intellectual property. The same applies to proprietary corporate networks. As the quantity and value of the data being communicated has increased, the threats to the security of this data have increased proportionately.

One of the technologies developed to address data security threats is Kerberos authentication. Kerberos provides a means for secure authentication of a user's credentials as well as means to protect sensitive data communicated across an insecure network. Kerberos authentication relies on the existence of a Kerberos server that certifies a user's identity to network services utilized by an application the user is running. Services that use Kerberos to authenticate users are said to be “Kerberized.”

While the need for security has increased, so has the need for flexibility. Users are increasingly mobile and may access network services through a variety of locations and devices. Networks are increasing in size and complexity and are often in a state of flux and change. Such size and flexibility provides challenges to network security and reliability. For example, changes in policy or accounts must be effected across larger networks and a greater number of devices. Furthermore, an authentication server such as a Kerberos server may be temporarily inaccessible to some or all of a network resulting in a need for “disconnected” authentication of a user.

While various solutions for disconnected authentication have been developed, such solutions typically require at least one previous login by the user at a particular device at a time that the authentication server is accessible. Such a requirement is impractical given the sheer number of networked devices and the frequency of changes in network configuration and login accounts.

Given the issues and challenges related to providing authentication services and the shortcomings of currently available solutions, a need exists for an apparatus, method, and system to validate login credentials of a user or group member without requiring a previous login from a particular device or immediate access to an authentication server.

SUMMARY OF THE INVENTION

The present invention has been developed in response to the present state of the art, and in particular, in response to the problems and needs in the art that have not yet been fully solved by currently available authentication systems. Accordingly, the present invention has been developed to provide an apparatus, method, and system to validate login credentials without requiring a previous login via the login device or immediate access to an authentication server.

In one aspect of the present invention, a method to validate login credentials of a selected party includes authenticating a login device with an authentication service, obtaining a service ticket from the authentication service for the login device to communicate with the selected party (referred to herein as a user service ticket), and storing the user service ticket for subsequent authentication of the selected party by the login device. Authenticating the login device may include providing valid credentials and a valid timestamp to the authentication service. Tickets to communicate with one or more selected parties such as users or group members may be pre-fetched by the login device without requiring access to the credentials of the users or group members.

In another aspect of the present invention, an apparatus to validate login credentials includes a ticket pre-fetch module configured to authenticate a login device with an authentication service and obtain (i.e. pre-fetch) user service tickets from the authentication service for the login device to communicate with one or more selected parties such as users and group members. The apparatus may also include a ticket cache configured to store the pre-fetched tickets for subsequent authentication of the selected parties by the login device.

In certain embodiments, the apparatus also includes an authentication module configured to authenticate login credentials against pre-fetched tickets stored in the ticket cache. Login credentials may be received and validated by the authentication module despite unavailability of an authentication service. In certain embodiments, authenticating login credentials against a pre-fetched user service ticket includes generating a key from the login credentials and decrypting a portion of the pre-fetched user service ticket using the generated key. Furthermore, authentication data within the pre-fetched user service ticket may be compared with known data to confirm the validity of the pre-fetched user service ticket. In one embodiment, authenticating a party against a pre-fetched user service ticket may occur by using a pre-fetched user service ticket corresponding to the selected party to construct a Kerberos AP-REQ message structure and invoking a validation function that processes the Kerberos AP-REQ message structure.

In one embodiment, a list of users and/or groups is retrieved from a known source such as a configuration file and user service tickets to communicate with each user and group member are pre-fetched and stored in the ticket cache associated with the login device. The pre-fetched user service tickets may also be refreshed within the ticket cache as need by obtaining new user service tickets from the authentication service. Refreshing the user service tickets may keep the ticket cache better synchronized with changes in user credentials registered with the authentication server. In one embodiment, pre-fetched user service tickets may be refreshed in response to selected events such as expiration of a selected interval, a login request, a change in user credentials, and a reboot cycle.

In another aspect of the present invention, a system to validate login credentials includes an authentication server configured to provide an authentication service, and a login device comprising the ticket pre-fetch module, the authentication module, and the ticket cache previously described. The authentication server may be a domain controller. In one embodiment, the authentication server is a Kerberos key distribution center (KDC) and the pre-fetched user service tickets may be Kerberos service tickets.

DETAILED DESCRIPTION OF THE INVENTION

Modules may also be implemented in software for execution by various types of processors. An identified module of executable code may, for instance, comprise one or more physical or logical blocks of computer instructions which may, for instance, be organized as an object, procedure, or function. Nevertheless, the executables of an identified module need not be physically located together, but may comprise disparate instructions stored in different locations which, when joined logically together, comprise the module and achieve the stated purpose for the module. Executables of identified modules may be stored on any form of computer-readable storage media, such as magnetic disc or tape, optical disk, flash memory, or the like.

The features, structures, or characteristics of the invention described throughout this specification may be combined in any suitable manner in one or more embodiments. For example, reference throughout this specification to “one embodiment,” “an embodiment,” or similar language means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the present invention. Thus, appearances of the phrases “in one embodiment,” “in an embodiment,” or similar language throughout this specification do not necessarily all refer to the same embodiment and the described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

The present invention sets forth an apparatus, system and method to validate credentials provided to a login device without requiring immediate connectivity to an authentication server or a previous login on the login device.

FIG. 1is a block diagram illustrating a typical prior art authentication system100. As depicted, the authentication system100includes a user105, a client110, an application server120, an authentication server130, and a service provider140. The authentication system100facilitates providing applications and services to the user105in a secure manner.

The application server120may include a login service150with an authentication module160. In the depicted embodiment, the application server120is configured to facilitate authentication of users and group members. In one embodiment, the authentication module160is a pluggable authentication module. The authentication module may receive one or more credentials such as a username and password from the user105via the client110. Alternately, the user105may be stationed at the application server120and directly provide the credentials112to the login service150and the authentication module160.

In response to the received credentials112, the authentication module160may provide an authentication request162to the authentication server130. In one embodiment, the authentication server130is a Kerberos server that may function as a domain controller such as a Windows™ domain controller. In the depicted embodiment, the authentication server130includes an authentication service170, and a ticket granting service180.

The authentication service170may receive the authentication request162, for example a Kerberos AS_REQ message, and provide an authentication reply172such as a Kerberos AS_REP message. In response, the authentication module160may use the authentication reply172to determine the authenticity of the user provided credentials112. In one embodiment, the authentication module160derives a key (not shown) from the credentials112which is used to decrypt a portion of the AS_REP message. If the decryption is successful, the credentials112provided by the user105are known to be valid.

In response to successful validation, the application server120may generate a service ticket request164and receive a ticket reply182from the ticket granting service180running on the authentication server130. In certain embodiments, the ticket reply182includes a service ticket192to be presented to a particular service provider140. Specifically, the service ticket192may enable a user or group member to request services of the service provider140. In response, to proper presentation of the service ticket192, the service provider140and the application server120may securely exchange service data194.

FIG. 2is a block diagram illustrating a typical prior art service ticket200. The prior art service ticket200is one example of the service ticket192used in the prior art authentication system100. The service ticket200ensures that user indicated by the ‘principal name’ field220and the service indicated by the ‘service name’ field230are authentic and may safely exchange service data. In the depicted embodiment, the service ticket200is a Kerberos service ticket, the ‘principal name’ field220references a user name225(i.e. “User1” in the depicted example) and the ‘service name’ field230references a service provider name235(“NetworkService1” in the depicted example).

FIG. 3is a block diagram illustrating a credential validation system300of the present invention. In addition to many of the elements of the prior art authentication system100, the credential validation system300may include a login service310. The depicted elements or similar elements function cooperatively to enable disconnected authentication of a user105without requiring a previous login by the user105.

The depicted login service310includes a ticket pre-fetch module320, an authentication module330, a ticket cache340, and a configuration file350. Rather than obtaining service tickets for a user to communicate with a service provider as commonly done in the prior art, the ticket pre-fetch module320may pre-fetch one or more user service tickets (not shown) for a login device110or120to communicate with particular users or group members. In one embodiment, the ticket pre-fetch module320retrieves a pre-fetch list (not shown) from a known source such as the configuration file350and obtains user service tickets for the login device120to communicate with the users and group members referenced in the pre-fetch list.

It should be noted that the phrase “user service ticket” as used herein and subsequently shown inFIG. 5, refers to a service ticket for a login device to conduct communication with, or receive services from, a particular user. This contrasts with the prior art practice of obtaining service tickets for a user to communicate with a service provider or server.

The ticket pre-fetch module320may store the pre-fetched user service tickets (not shown) within the ticket cache340. The pre-fetched user service tickets may also be refreshed within the ticket cache as need by obtaining a new user service tickets from the authentication service. In one embodiment, pre-fetched tickets are refreshed in response to selected events such as expiration of a selected interval, a login request, and a reboot cycle.

In response to a login request, the authentication module330may access the ticket cache340and authenticate a user or group member against a pre-fetched user service ticket—particularly if the authentication server130is unavailable or inaccessible.FIGS. 4thru6provide more detailed information regarding pre-fetching user service tickets issued to the login device to communicate with the user and the process of authenticating users against pre-fetched service tickets.

FIG. 4is a flow chart diagram illustrating one embodiment of a ticket fetching method400of the present invention. As depicted, the ticket fetching method400include authenticating410a login device, retrieving420a pre-fetch list or the like, obtaining430one or more pre-fetched user service tickets, and storing440the pre-fetched user service tickets for subsequent validation of login credentials. The ticket fetching method400may be conducted in response to an event such as expiration of polling interval, execution of a reboot cycle, a login request, or similar event.

Authenticating410a login device may include sending an authentication request162(seeFIG. 3) to request authentication of the login device110or120rather than the user105. Subsequently, an authentication reply172may be used to authenticate the login credentials of the login device110or120. Retrieving420a pre-fetch list or the like may include obtaining and/or referencing a list of users or group members for whom user service tickets should be pre-fetched. One of skill in the art will appreciate that the methods depicted herein need not be conducted in the depicted order. For example, retrieving420a pre-fetch list may occur previous to authenticating410a login device.

Obtaining430one or more pre-fetched user service tickets may include sending one or more ticket requests164for the login device110or120to communicate with each user or group member and receiving a ticket reply182for each user or group member with a user service ticket encapsulated therein. Storing440the pre-fetched user service tickets for subsequent validation login credentials may include storing the pre-fetched user service tickets in the ticket cache340.

FIG. 5is a block diagram illustrating a user service ticket500of the present invention. Although the user service ticket500may be identical in format to the service ticket200depicted inFIG. 2, the fields may be used differently to facilitate disconnected authentication. Specifically, the ‘principal name’ field520may reference a login device name525rather than a user name, and the ‘service name’ field530may reference a user or group member name535rather than the name of a service provider. For example, the depicted user service ticket500enables the login device “MyLoginDevice” to request services of and communicate with the user “User1”. The depicted user service ticket500may be pre-fetched before a need for authentication has arisen and stored in the ticket cache340to facilitate authentication of the login credentials for “User1”.

Using the user service ticket in the described manner defers the need (for the login service310or the like) to know the login credentials of “User1” at the time the user service ticket500is issued. However, an encrypted part510of the user service ticket500may only be decrypted with a key derived from valid login credentials for “User1” thus facilitating authentication of the login credentials (by the login service310or the like) at a subsequent time such as in response to a login request.

FIG. 6is a flow chart diagram illustrating a credential validation method600of the present invention. As depicted, the credential validation method600includes receiving610one or more login credentials, testing615if an authentication service is available, authenticating620the user if the authentication service is available, or generating630a key from the login credentials and decrypting640(a portion of) a pre-fetched user service ticket corresponding to the user if the authentication service is unavailable. The depicted method also includes testing645if the login credentials were valid and approving650or denying660the login attempt.

Receiving610one or more login credentials may include receiving a username and password from a user attempting to login on a device such as a computer or a mobile device. Testing615if an authentication service is available may include attempting to locate a particular authentication server associated with the login device or testing for a timeout condition on an authentication request. In one embodiment, the authentication server is a Kerberos authentication server and a Kerberos ticket granting server such as the server130shown inFIG. 1.

Authenticating620the user if the authentication service is available may include communicating with the authentication server in a manner previously described in the description ofFIG. 1. For example, an authentication request162may be sent to the authentication server130and a key generated from the user name and password may be used to decrypt a portion of the authentication reply172and ascertain if the login credentials are valid.

If the authentication service is unavailable, the depicted method600may generate630a key from the user's login credentials and decrypt640(a portion of) a stored user service ticket using a key generated from the user's login credentials. Furthermore, authentication data within the pre-fetched user service ticket may be compared with known data to confirm the validity of the pre-fetched ticket. Consequently, a user or group member may be authenticated regardless of the immediate availability of an authentication server.

Subsequent to executing steps620or640, the depicted method continues by testing645if the login credentials were valid and approving650or denying660the login attempt. Subsequently, the method ends670.

The present invention facilitates disconnected authentication of users without requiring a previous login. The present invention may be embodied in other specific forms without departing from its spirit or essential characteristics. The described embodiments are to be considered in all respects only as illustrative and not restrictive. The scope of the invention is, therefore, indicated by the appended claims rather than by the foregoing description. All changes which come within the meaning and range of equivalency of the claims are to be embraced within their scope.