Radius security origin check

A computer implemented method, apparatus, and computer program product for authenticating a user to a network. In response to receiving a request from a user to access a protected resource, the process sends a unique bit sequence into a network connection utilized by the user. Next, the process authenticates the user to access the protected resource in response to receiving a verification that the unique bit sequence was received by an access point that authenticated the user when the user logged on to the network.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present application is related generally to a data processing system and in particular to a method and apparatus for network security. More particularly, the present application is directed to a computer implemented method, apparatus, and computer usable program code for an origin security check to authenticate a user to a network.

2. Description of the Related Art

Currently, computer network security is of increasing importance due to the often sensitive nature of information stored on commercial and governmental network computers and databases. For example, a bank's Ethernet network computers and databases may contain customer names, account balances, bank account numbers, addresses, phone numbers, social security numbers, and other confidential and personal information. An unauthorized user may be able to access one or more of the bank's computers and/or databases locally from a computer connected to the Ethernet. The bank's computers may also be connected to a remote network, such as the Internet. In such a case, an unauthorized user may be able to obtain access to the bank's computer system remotely through the Internet network connection.

Current network security options designed to prevent an unauthorized user from obtaining unauthorized access to a LAN network include a firewall. A firewall is an information technology security device that acts as an intermediary between a network with a low trust zone, such as the Internet, and an internal network, such as an Ethernet network, with a high trust zone. A high trust zone is a zone within a network or data processing system that imposes security measures to secure data. For example, a high trust zone may require users to be authenticated with a security password. Thus, users that gain access to a high trust zone are trusted. A low trust zone typically requires minimal or no security clearance to access the zone. Therefore, users in a low trust zone are less trusted because they have not been authenticated as trusted or authorized users.

The network firewall typically prevents users in the low trust zone network from obtaining access to an internal network without a valid user authentication. A user authentication protocol typically requires a client requesting access to the network to enter a user name and password. The user name and password are verified to ensure the user is authorized to access the internal network before allowing the client to connect. Thus, the firewall is intended to prevent unauthorized access to a network.

However, if a hacker is able to breach the network firewall, the hacker may be able to sniff passwords and user names from the internal network. The hacker may then be able to log on to the internal network by using an authorized user's name and password that the hacker has commandeered. Once the hacker has gained access to the system, the hacker may be able to access sensitive information stored on the internal network.

Telnet is a terminal emulation program that is used by a client computer to connect to a server on a network. A client starts a telnet session by logging in to a server using a valid user name and password. However, telnet sessions are unencrypted. Telnet does not encrypt any data, including user names and passwords, sent over the telnet connection. Therefore, if a hacker is able to access a router, switch or gateway located on the network between the client and server using telnet, the hacker may be able to view unencrypted user names and passwords. The hacker may then use the snooped user name and password to access other protected resources.

Thus, current solutions do not provide an effective means to prevent a hacker from gaining unauthorized access to protected network resources using a valid user name and password that the hacker obtained by hacking into a network.

SUMMARY OF THE INVENTION

The illustrative embodiments provide a computer implemented method, apparatus, and computer usable program code for authenticating a user to a network. In one embodiment, the process sends a unique bit sequence into a network connection utilized by the user in response to receiving a request from a user to access a protected resource. Next, the process authenticates the user to access the protected resource in response to receiving verification that the unique bit sequence was received by an access point that authenticated the user when the user logged on to the network.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT

In the depicted example, server104and RADIUS server106connect to network102along with storage unit108. RADIUS server106uses RADIUS standards. RADIUS is a standard that is described in Internet engineering task force (IETF) request for comments (RFC) documents, including 2865, 2284, 2869, 2882, and 4137. RADIUS is integral to wireless and wire-full authentication in which a user will log-on to a network.

RADIUS server106is a remote authentication dial-in user service server to authenticate a user login requesting access to a network. A user login typically includes a user name and password. A user login may also include, but is not limited to, a fingerprint scan, a voice recognition, a security policy, or any other known or available means for authenticating an authorized user.

RADIUS server106implements an authentication, authorization, and accounting system protocol to verify the validity of a user login. For example, RADIUS server106receives the requesting user's password and user name from a network access point, such as access point (AP)109. RADIUS server106then verifies if the user name and password are valid. If the user name and password is valid, RADIUS server106authorizes access to the network or ISP system.

AP109is a device that connects two or more computing devices, display devices, printers, telephones, and any other wired or wireless devices to a network, such as network102. For example, AP109may be, but is not limited to, a wireless access point router.

A user generally requests access to network102from a client computing device, such as clients110,112, and114. In this example, clients110,112, and114are connected to network102through AP109. Clients110,112, and114may be, for example, personal computers or network computers. In the depicted example, server104provides data, such as boot files, operating system images, and applications to clients110,112, and114. Clients110,112, and114are clients to server104in this example. Network data processing system100may include additional servers, clients, and other devices not shown.

In the depicted example, data processing system200employs a hub architecture including a north bridge and memory controller hub (MCH)202and a south bridge and input/output (I/O) controller hub (ICH)204. Processing unit206, main memory208, and graphics processor210are coupled to north bridge and memory controller hub202. Processing unit206may contain one or more processors and even may be implemented using one or more heterogeneous processor systems. Graphics processor210may be coupled to the MCH through an accelerated graphics port (AGP), for example.

An operating system runs on processing unit206and coordinates and provides control of various components within data processing system200inFIG. 2. The operating system may be a commercially available operating system such as Microsoft® Windows® XP (Microsoft and Windows are trademarks of Microsoft Corporation in the United States, other countries, or both). An object oriented programming system, such as the Java™ programming system, may run in conjunction with the operating system and provides calls to the operating system from Java programs or applications executing on data processing system200. Java and all Java-based trademarks are trademarks of Sun Microsystems, Inc. in the United States, other countries, or both.

Instructions for the operating system, the object-oriented programming system, and applications or programs are located on storage devices, such as hard disk drive226, and may be loaded into main memory208for execution by processing unit206. The processes of the illustrative embodiments may be performed by processing unit206using computer implemented instructions, which may be located in a memory such as, for example, main memory208, read only memory224, or in one or more peripheral devices.

A communications unit may include one or more devices used to transmit and receive data, such as a modem or a network adapter. A memory may be, for example, main memory208or a cache such as found in north bridge and memory controller hub202. A processing unit may include one or more processors or CPUs. The depicted examples inFIGS. 1-2and above-described examples are not meant to imply architectural limitations. For example, data processing system200also may be a tablet computer, laptop computer, or telephone device in addition to taking the form of a PDA.

A computer network can include, but is not limited to, any combination of computers, display devices, printers, data storage devices, and any other computer related hardware and software connected by telecommunications equipment or cable. A local area network (LAN) is a network of computers located in relatively close proximity to one other. For example, the computers and computer equipment in a LAN may be located within a single building. An example of a LAN is an Ethernet network. A wide area network (WAN) is a network that may span a relatively large geographic area. For example, the individual computers in a WAN may be located hundreds or thousands of miles apart. An example of a WAN, is the Internet.

A user accesses a network by means of an access point, such as AP109inFIG. 1. In a wireless network, a user at a client computer requests access from a wireless access point (WAP). The AP may require the user to enter a user login, such as a user name and password, before allowing the client to connect. However, every access point (AP) cannot be loaded with the valid login of every authorized user and employee. Therefore, the AP contacts a remote authentication dial-in user service (RADIUS) server to authenticate the user login.

For example, when an IBM® employee's laptop contacts a WAP to access an IBM® internal network, the laptop transmits the employee's IBM® intranet password and user ID to the WAP. The WAP contacts the RADIUS server, which determines if the user name and password are valid. If the user name and password are valid, the RADIUS server authenticates the user. If the user name and password are not valid, the RADIUS server does not authenticate the user. The RADIUS server informs the AP of the success or failure of the authentication. If the authentication is successful, the AP grants the user's laptop access to the network and assigns an IP address to the laptop.

Likewise, a network access server (NAS) is a point of access to a remote resource, such as a computer, printer, or data storage device. A client at a computer requests access to connect to the network. The client is typically required to enter a login, such as a user name and password or other authorizing information. The NAS itself does not contain information regarding valid user login information. Therefore, the NAS sends the requesting client's login information to a RADIUS server for verification. If the RADIUS server verifies the user's login, the NAS permits the client to connect and access the protected resource. However, if a hacker breaches the firewall or otherwise obtains a valid login, such as a user name and password assigned to an authorized user, by hacking into the network, the hacker can obtain access to the network even though the hacker is not an authorized user.

Therefore, the illustrative embodiments provide a computer implemented method, apparatus, and computer program product for authenticating a user to a network. In one embodiment, the process sends a unique bit sequence into a network connection utilized by the user in response to receiving a request from a user to access a protected resource. Next, the process authenticates the user and allows the user to access the protected resource in response to receiving a verification that the origin security check package was received by an access point that authenticated the user when the user logged on to the network.

In another embodiment, a protected resource sends an Internet protocol address used by a user requesting access to the protected resource to an authentication server. In response to receiving the Internet protocol address the authentication server retrieves a user name and password pair used by the Internet protocol address. The authentication server sends login information used by the user assigned to the Internet protocol address. In response to receiving the login information, the protected resource authenticates the user using the login information. In this example, the login information is a user name and password pair. However, in accordance with the illustrative embodiments, login information may include any information for authenticating a user. For example, login information can include a user identifier, a security protocol, a fingerprint scan, a voice print, or any other information to authenticate a user.

FIG. 3is a block diagram illustrating a dataflow when a security origin check is performed in accordance with an illustrative embodiment. Network data processing system300is a network of two or more computing devices connected to form a network, such as network data processing system100inFIG. 1.

User301is a user at a computing device requesting access to a network from access point302. Access point302is any device for allowing a user to connect to a network, such as access point109inFIG. 1. Access point302may include, but is not limited to, a router, a wireless access point, a network access point, and/or a wire-full access point.

Network303is any type of network, including but not limited to, a wide area network, a local area network, the Internet, an Intranet, an Ethernet, or any combination of network types. For example, network303may include a network such as network102inFIG. 1. In this example, network303is a corporate Intranet. An Intranet is an internal, private, commercial network. Only authorized users and authorized employees of the corporation may be allowed to access the Intranet.

In this example, access point302does not provide open access to network303. Therefore, access point302prompts user301to provide login ID304for authentication before user301is allowed to connect to network303. Login ID304is any user name, password, digital signature, and/or any other means for authenticating a user as a user or employee authorized to access a private network. In this example, login ID304is a user name and password.

Access point302may not store every user name and password for every user authorized to connect to network303, therefore, user301directly authenticates to authentication server306. In other words, user301sends login ID304directly to authentication server306by means of a network connection to authentication server306provided by access point302. This authentication of user301by authentication server306to enable user301to initially connect to network303can be referred to as primary RADIUS authentication.

Authentication server306is a server for authenticating a user login ID. Authentication server306is any server implementing an authentication protocol for authenticating users. In this example, authentication server306is a RADIUS server, such as RADIUS server106inFIG. 1.

IP address308assigned to user301by authentication server306uniquely identifies a computing device utilized by user301in network303for as long as the computing device is connected to network303. In other words, if user301is using a laptop computer to access network303at access point302, IP address308uniquely identifies the laptop computer and associates the laptop computer with login ID304for as long as the laptop computer is connected to network303through an access port at access point302. Each time a user logs off network303and then re-connects to network303, a different IP address may be assigned to that user. However, the same IP address is not assigned to more than one device on the network at any given time. Thus, IP address308is unique to network303. IP address308is used to identify a computing device used by user301on network303. In this example, network303is an internal Intranet network. However, in a different example, IP address308may be used to uniquely identify a computing device in any type of network, including but not limited to, the Internet, an Intranet, an Ethernet, or any other type of network.

Authentication server306saves login ID304and IP address308for every user that authentication server306authenticates. In this example, authentication server306stores the user name, user password, and IP address308for user301. The saved login ID304and IP address308may be used by authentication server306during subsequent secondary authentications of user301.

Boundary Service Offering (BSO) router312is a device for forwarding data packages between networks. BSO router312is located at a gateway between network303and remote resource314located on a different network. Remote resource314is a resource in a local network associated with BSO router312. In this example, BSO router312is a Cisco® product.

BSO router312protects resources attached to BSO router312's local network by requiring login authentication of a user before granting the user access to the local network.

Remote resource314is any resource on a network. For example, remote resource314could include a computer, a database, an application, a printer, or any other device or resource accessible through BSO router312. Remote resource314contains protected, private, and/or confidential data. BSO router312protects remote resource314from access by unauthorized users by requiring a user to provide an authentication, such as Intranet password316, to access the local network in which remote resource314is located.

For example, BSO router312could be a router that protects access to a lab containing two or more machines that contain unreleased software. In this example, BSO router312is protecting the group of machines located in the lab. The group of machines includes remote resource314. A user must log on to BSO router312and provide a valid Intranet password, such as Intranet password316, to obtain access to one or more machines in the lab, including remote resource314.

User301connects to BSO router312by telnet. Telnet is a protocol for establishing a connection between two hosts. However, telnet sessions are unsecured. In other words, user names and passwords that are transmitted over telnet are unencrypted.

When user301requests access to remote resource314, BSO router312prompts user to enter a valid user login, such as a user name and/or Intranet password316to authenticate user301. Intranet password316could be the same password as used in login ID304. However, Intranet password316may also be a different password than a password used in login ID304.

Even when user301authenticates through BSO router312, the telnet target machine, such as remote resource314, will also ask for a valid login, such as a user name and password. The telnet target machine may also request a RADIUS secondary authentication of user301.

However, because telnet sessions are unencrypted, Intranet password316is transmitted across the network connection in the clear. Hacker318may be able to obtain Intranet password316by hacking into the telnet connection. Hacker318may then use Intranet password316to obtain access to protected resources. In this example, hacker318is any user attempting to gain unauthorized access to a network, such as network303.

If hacker318uses snooped Intranet password316to access a protected resource, such as protected resource320or remote resource314, the protected resources accessed through a telnet session cannot tell if a hacker or other malicious network snoop is originating from an authorized computing device and network port assigned to user301for this particular login session.

This vulnerability exists for authentication with BSO router312, but also when user301telnets to a machine. In both these cases, a password and login entered by user301is sent over the corporate network in clear, unencrypted text. The password and login are also transmitted in the clear when user301uses telnet to connect to one machine and then authenticates to DCE (Distributed Computing Environment), advanced file system (FSA), global storage architecture (GSA) or any other distributed method of obtaining data. Therefore, protected resource320sends an origin security check package through the network connection utilized by user301to authenticate the origin of the user's connection, and verify the user is located at an authenticated computing device and a correct access point port for the authorized user. In this example, the origin security check package is a unique bit sequence. The unique bit sequence is a random sequence of bits. The sequence of bits may be the length of the connection stream maximum transmission unit (MTU). For example, if the MTU size is 512 bytes, the unique bit sequence may be a random bit sequence of 512 bytes. The unique bit sequence may be a bit sequence of any length selected by a user. The length of the bit sequence may be of a sufficient length to enable a unique bit sequence to be generated. In other words, if the bit sequence is long enough, it is statically unlikely that the bit sequence will be duplicated in any other data packet being transmitted over the network connection during a predetermined time interval. The unique bit sequence may be generated using any known or available means for generating a unique bit sequence.

Thus, in this illustrative example, user301attempts to connect to a network at access point302. Access point302prompts user301to enter login ID304. Access point302sends login ID304to authentication server306for direct authentication by authentication server306.

In response to receiving a user name and password from access point302, authentication server306determines whether the user name and password are valid. If an authentication is not received from authentication server306within a predetermined period of time, access point302will deny user301access to the network. In other words, user301will not be allowed to connect to the network at access point302.

If the user name and password are valid, authentication server306sends an authentication of the user name and password to access point302. The authentication includes IP address308assigned to user301to uniquely identify a computing device utilized by user301to connect to the network. Thus, user301is authenticated directly by authentication server306when user301initially logs on to network303. This may be referred to as the primary RADIUS authentication of user301. In this example, primary RADIUS authentication of user301is performed using any known or available means for authenticating a user by a RADIUS server.

Authentication server306saves login ID304and IP address308assigned to user301. Therefore, authentication server306knows the network access point and IP address from which user301is currently accessing the network. The login ID304and IP address308may be used by authentication server306to identify a network access point origin for user301.

In this case, authentication server306knows that user301connected to the network at a network port on access point302. Authentication server306also knows login ID304for user301, and IP address308assigned to user301. This information can be used to ensure that user301can only be authenticated to other network services through, or from this singular RADIUS authentication port.

In response to receiving the authentication, access point302allows user301to connect to the network. While user301is connected to network303, user301requests resource protection point322to establish a telnet session to enable user301to access remote resource314. Resource protection point322is any resource protection point to access a protected database, a login authentication to a protected resource, or any authentication point. Resource protection point322may also include the telnet point itself. Resource protection point322may also be a BSO router, such as BSO router312. However, resource protection point322is not required to include a BSO router. Upon authenticating Intranet password316, resource protection point322establishes a telnet session for user301to access remote resource314.

In one embodiment, resource protection point322authenticates user301by authentication server306. Authentication server306authenticates that the source IP address of user301is associated with the user ID entered by user301at resource protection point322and/or protected resource320. In other words, before being granted access to protected resource320, user301is prompted to enter a user name and password at resource protection point322and/or protected resource320. Authentication server306authenticates that the user name and password correspond to an IP address assigned to the user name and password.

In another embodiment, the protected resource, such as remote resource314, validates the user ID and password via the protected resource's own authentication mechanism. In this example, the protected resource may apply the user ID and password pair returned to the protected resource by authentication server306to the protected resource's own authentication mechanism. Therefore, the user would not be required to retype the user ID and password pair. This authentication mechanism of the protected resource may include any known or available mechanism or process for authenticating a user.

Thus, in this example, hacker318obtains Intranet password316and uses Intranet password316belonging to user301to request access to protected resource320. Protected resource320queries authentication server306. The query asks authentication server306if the network connection utilized by hacker318is coming from IP address308. The query also asks authentication server306whether hacker318is assigned to IP address308. However, because hacker318has used a stolen user name and password and used telnet to connect with protected resource320, authentication server306may not be able to determine whether the network connection is coming from IP address308, and if hacker318is assigned to IP address308.

If authentication server306is unable to verify the network connection utilized by hacker318came from IP address308, protected resource320sends a notice417to authentication server306. Notice417states that protected resource320is about to inject a unique network bit sequence into the network connection utilized by hacker318. Protected resource320then injects the origin security check package into the connection.

Authentication server306sends a notice to access point302, informing access point302that protected resource320is injecting an origin security check package into the network connection. Access point302will then monitor the network connection for the origin security check package for a predetermined period of time.

If access point302identifies or detects the origin security check package headed towards the computing device utilized by user301, access point302removes or drops the origin security check package, and informs authentication server306that the origin security check package sent by protected resource320was indeed headed toward the correct user authenticated computing device. Authentication server306then sends an authorization to protected resource320informing protected resource320that the user requesting access is authenticated. Protected resource320then allows the user to connect and access the protected resource.

However, in this example, hacker318is requesting access to protected resource320. Therefore, when protected resource320sends an origin security check package into the network connection utilized by hacker318, the origin security check package will not head towards the user authenticated computing device used by user301. Instead, the origin security check package will head for an unauthenticated computing device used by hacker318. Therefore, access point302will not see or detect the origin security check package heading towards the authenticated computing device used by user301within a predetermined period of time. Therefore, access point302will not send an authorization to authentication server306, and authentication server306will not send verification to protected resource320.

When protected resource320fails to receive an authorization from authentication server306indicating that the origin security check package was headed for the correct authenticated computing device associated with IP address308and user301, protected resource320will deny hacker318access to protected resource320. In other words, protected resource320will recognize hacker318is using a password and IP address assigned to user301and prevent hacker318from accessing resources on protected resource320.

In this example, the user authenticated computing device is a laptop computer. However, a user authenticated computing device can be any type of known or available computing device, including, but not limited to, a desktop computer, a PDA, a cellular telephone, a tablet PC, or any other type of computing device.

In another embodiment, when user301requests access to protected resource320from resource protection point322, resource protection point322and/or protected resource320does not prompt user301to enter a user login for authentication. Instead, resource protection point322sends an IP address for user301to authentication server306. In other words, each time a user connects to protected resource320for access, resource protection point322for the protected resource contacts authentication server306and sends a query. The query from resource protection point322states that a user at an IP address, such as IP address308, is requesting access to the protected resource. IP address308may be an IP address such as 9.4.4.4. Authentication server306looks up login ID304used by IP address308for user301. In this example, login ID304is a user ID and password pair. Authentication server306sends login ID304to resource protection point322for protected resource320. Authentication server306saved the user name and password pair used by IP address308during the primary RADIUS authentication procedure. Authentication server306returns the user name and password pair used by IP address308to resource protection point322. The user name and password pair is transmitted in an encrypted format.

When resource protection point322receives the user name and password pair from authentication server306, resource protection point322allows user301to connect to protected resource320without user301entering the user name and password pair. In this manner, each time a user connects to remote resource314through BSO router312, or connects to protected resource320through resource protection point322, the user name and password is not transmitted in the clear over a telnet connection.

Resource protection point322and/or protected resource320applies the user name and password pair received from authentication server306to the resource protection point and/or protected resource's own authentication mechanisms. Resource protection point322and/or protected resource320do not require user301to enter the user name and password pair. Thus, user301can connect to protected resource320without reentering the same user name and password each time the user connects to a different protected resource. This process may be referred to as a single sign-on feature.

FIG. 4is a block diagram illustrating a data flow when an origin security check package is injected into a network connection in accordance with an illustrative embodiment. Network data processing system400is a network of two or more computing devices connected to form a network, such as network data processing system100inFIG. 1. The network may include a wide area network, a local area network, the Internet, an Intranet, or any combination of network types.

User402is a user at a computing device requesting access to a network from access point404. Access point404is any device for allowing a user to connect to a network, such as access point109inFIG. 1or access point302inFIG. 3. Protected resource406and410are protected resources, such as protected resource320inFIG. 3.

Authentication server414is a server for authenticating a user login ID. Authentication server414is any server implementing an authentication protocol for authenticating users. In this example, authentication server414is a RADIUS server, such as RADIUS server106inFIG. 1and authentication server306inFIG. 3.

Thus, in this example, user402connects to a network at a port on access point404. Access point prompts user402to enter a user name and/or password before allowing user402to access the network. Access point404transmits the user name and password entered by user402to authentication server414for authentication.

After user402is authenticated and connected to the network, user402uses telnet407to connect to protected resource406from access point404. User402then uses telnet408to establish a connection between protected resource406and protected resource410, and requests access to protected resource410.

Protected resource410sends a query to authentication server414asking whether the network connection used by user402is coming from an authenticated computing device. However, because user402has engaged in two telnet sessions to reach protected resource410, authentication server414may not be able to determine if the network connection originated from an authenticated computing device connected to a port at access point404.

Therefore, protected resource410sends notice412to authentication server414. Notice412informs authentication server414that protected resource410is going to inject an origin security check package into the network connection utilized by user402. Protected resource410then injects origin check416into the connection. Origin check416is an origin security check package.

In this example, origin check416is a unique network bit sequence. The unique network bit sequence may be a random sequence of bits the length of the connection streams maximum transmission unit (MTU). The MTU may be any MTU value. Generally, the MTU value is 512 bytes. The MTU is part of the TCP/IP protocol.

Authentication server414sends notice417to access point404. Notice417informs access point404that protected resource410is injecting an origin security check package into the network connection. Access point404then begins monitoring network connection for the origin security check package.

Access point404detects origin check416within a predetermined period of time. The predetermined period of time is any user definable amount of time. The predetermined period of time may also be a default or predefined amount of time.

Access point404sends verify origin418message to authentication server414. Verify origin418message verifies that the origin security check package was detected heading for an authenticated computing device for user402at a port on access point404. Authentication server414then sends authorize connection420message to protected resource410. Authorize connection420informs protected resource410that the origin security package was headed for an authenticated computing device at a correct port on access point404. Therefore, the origin of the network connection utilized by user402is authenticated. Protected resource410then allows user402access to access protected resource410.

In accordance with this embodiment, if access point404did not detect origin check416within the predetermined period of time, access point404would not have sent notice412to authentication server414. Likewise, authentication server414would not have received verify origin418within a predetermined period of time. Therefore, authentication server414would not have sent authorize connection420message. In this example, when protected resource410did not receive authorize connection420message within a predetermined period of time, protected resource410would not allow user402to access protected resource410.

Thus, a RADIUS server can check the name and password of a user. In addition, the RADIUS server can also check that an IP address used by the user is a correct IP address assigned to an authenticated computing device connected to a port on an access point. Therefore, even if a hacker is able to obtain a correct user name and password to log on to a protected resource, the RADIUS server will not authenticate the user if the user is not using the correct IP address. In other words, if the user's connection is not coming from an authenticated computing device identified by the IP address used by a user, the RADIUS server will not authenticate the user and the user will not be granted access to the protected resource.

In this embodiment, authentication server404checks a user login name, password, and IP address. In another embodiment, the authentication server can also check a security policy for accessing a resource. A security policy defines when and how a user can access a protected resource. If a security policy requires a user to access a network from a particular building or office in a building, the authentication server will not grant the user access to a protected resource if the IP address is assigned to a computing device that is not located in the correct building and/or office. In other words, if the user is accessing the network through a remote firewall, such as over the Internet, the authentication server will not grant the user access if the security policy requires the user to access the internal private LAN network from a local computer connected directly into the LAN network.

FIG. 5is a flowchart illustrating a process for performing a security origin check by a protected resource in accordance with an illustrative embodiment. In this illustrative example shown inFIG. 5, the process is performed by a software component for performing an origin security check, such as protected resource320ofFIG. 3and/or protected resource406or410inFIG. 4.

The process begins by receiving a request to access a protected resource from a user (step502). The process identifies an Internet protocol (IP) address N and a user “X” requesting access (step504). The process sends a query to an authentication server requesting a reply as to whether the connection for the user is coming from the identified IP address “N” assigned to user “X” within a predetermined period of time (step506).

The process makes a determination as to whether a confirmation is received within a predetermined period of time that the connection is coming from the identified IP address and the IP address is assigned to user “X” (step508). If the process determines that the connection is coming from the identified IP address “N” assigned to user “X,” the process allows the user access to the resource (step509) with the process terminating thereafter.

Returning to step508, responsive to a determination that a confirmation is not received within a predetermined period of time, the process sends a notice to the authentication server that an origin security check package is being sent into the network connection (step510). The origin security check package may be a unique bit sequence.

Next, the process injects the origin security check package into the connection (step512). The process makes a determination as to whether a verification or authorization is received within a predetermined period of time that authenticates the user (step514). As used herein, a predetermined period of time may include a user defined period of time. The predetermined period of time may also include a preset or default period of time.

If a verification or authorization is not received within the predetermined period of time, the process terminates thereafter. If a verification or authorization is received within the predetermined period of time, the process allows the user to access the protected resource (step509) with the process terminating thereafter.

FIG. 6is a flowchart illustrating a process for verifying a security origin check by an authentication server in accordance with an illustrative embodiment. In this illustrative example shown inFIG. 6, the process is performed by a software component for providing access to a network, such as access point302ofFIG. 3and/or access point404inFIG. 4.

The process begins by receiving a query from a protected resource regarding whether a network connection utilized by a user “X” requesting access to the protected resource, is coming from an IP address “N” assigned to the user “X” (step602). The process sends a reply (step604). In other words, if the process determines that the IP address “N” is assigned to user “X” and the connection utilized by user “X” is coming from the IP address “N”, the process sends a reply confirming that the connection is coming from IP address “N” assigned to user “X”. If the process cannot confirm that the connection is coming from IP address “N” assigned to user “X”, the process sends a reply to the protected resource stating the same.

Next, the process makes a determination as to whether a notice is received stating that a protected resource is injecting an origin security check package into a network connection being utilized by a user (step606). For example, the origin security check package may be a unique bit sequence. If a notice is not received, the process terminates thereafter.

If a notice is received, the process sends a notice to an access point for the network stating that a protected resource is injecting an origin security check package into a network connection being utilized by a user (step608). The process makes a determination as to whether verification is received from the access point verifying that the origin security check package was received within a predetermined period of time (step610). If the verification is not received, the process terminates thereafter.

Returning to step610, if a verification is received, the process sends a verification or authorization to the protected resource to authenticate the user (step612), with the process terminating thereafter. When the user is authenticated, the protected resource will allow the user to access the protected resource.

FIG. 7is a flowchart illustrating a process for responding to a security origin check by an access point in accordance with an illustrative embodiment. In this illustrative example shown inFIG. 7, the process is performed by a software component for authenticating a user, such as authentication server306inFIG. 3and/or authentication server414inFIG. 4.

The process begins by receiving a notice from an authentication server that a protected resource is injecting an origin security check package into the network connection used by a user requesting access to the protected resource (step702). The origin security check package may be any unique bit sequence.

Next, the process makes a determination as to whether the origin security check package is received within a predetermined period of time (step704). In other words, the process monitors the network connection for the origin security check package for the predetermined period of time. If the origin security check package is not received within the predetermined period of time, the process terminates thereafter. If the origin security check package is received within the predetermined period of time, the process sends verification that the origin security check package was received to the authentication server (step706), with the process terminating thereafter.

Turning now toFIG. 8, a flowchart illustrating a process for a single sign-on authentication by an authentication server in accordance with an illustrative embodiment. In this illustrative example shown inFIG. 8, the process is performed by a software component for authenticating a user, such as authentication server306inFIG. 3and/or authentication server414inFIG. 4.

The process begins by receiving an IP address for a user requesting access to a protected resource (step802). The IP address may be sent to the authentication server in a query from the protected resource or from a resource protection point.

Next, the process retrieves a user name and password pair used by the IP address (step804). The authentication server saves the user name and password pair used by the IP address when the user is originally authenticated during a primary RADIUS authentication.

The process sends the user name and password pair to the protected resource (step806), with the process terminating thereafter. In another embodiment, the process sends the user name and password pair to the resource protection point. The resource protection point and/or protected resource use the user name and password pair in the resource protection point and/or protected resource's own authentication mechanisms.

FIG. 9is a flowchart illustrating a process for a single sign-on authentication request in accordance with an illustrative embodiment. In this illustrative example shown inFIG. 9, the process is performed by a software component for protecting access to a resource, such as protected resource320or resource protection point322inFIG. 3, or protected resource410inFIG. 4.

The process begins by receiving a request to access a protected resource (step902). The process sends an IP address for the client requesting access to the protected resource to an authentication server (step904).

Next, the process receives a user name and password pair from the authentication server (step906). The process performs a login of the user using the user name and password pair received from the authentication server (step908). In other words, the process does not prompt a user to enter a user name and password. Instead, the process uses the user name and password received from the authentication server to authenticate the user.

The process makes a determination as to whether to perform an additional authentication (step910). If the process does not perform an additional authentication, the process terminates thereafter.

Returning to step910, if the process does make an additional authentication, the process performs an additional authentication using an authentication mechanism of the protected resource (step912) with the process terminating thereafter. The process may use the user name and password received from the authentication server for the authentication mechanism. In another embodiment, the process may prompt the user to enter a user name and password for use in the authentication mechanism to authenticate the user.

Thus, the illustrative embodiments provide computer implemented method, apparatus, and computer program product for authenticating a user to a network. In one embodiment, the protected resource sends an origin security check package into a network connection utilized by the user in response to receiving a request from a user to access a protected resource. Next, the protected resource authenticates the user and allows the user to access the protected resource in response to receiving a verification that the origin security check package was received by an access point that authenticated the user when the user logged on to the network.

In this manner, the illustrative embodiments provide a RADIUS security origin check (RSOC) that permits any protected resource to query a RADIUS server for authentication of a user. The protected resource can inform the RADIUS server that a user is about to login to the protected resource and request authentication of the user.

The illustrative embodiments permit a protected resource to authenticate the user based on an origin of the user's network connection. Thus, in the illustrative embodiments, a RADIUS server can not only authenticate a user to a network, but the RADIUS server can also ensure that any access of a protected resource by the user is originating from a correct network access port, even when a user telnets to multiple different protected resources.