Parallel restricted integrated sign on system and method

A method for accessing an application on an internal network comprises configuring a first host name in a computer as associated with an internal network. A second host name in the computer is configured as associated with an external data communication network, where the second host name is an alias that resolves to an internet protocol address of an authentication server in the internal network. A first application hosted over the internal network is invoked. In response to the invocation of the first application, a request to invoke the first application including stored user authentication credentials is transmitted to the authentication server. A restricted application hosted over the internal network is invoked where the invocation command includes the second host name. In response to the invocation of the restricted application, a request that does not include user authentication credentials is transmitted to invoke the restricted application to the authentication server.

CROSS-REFERENCE TO RELATED APPLICATIONS

Not applicable.

REFERENCE TO A MICROFICHE APPENDIX

Not applicable.

BACKGROUND

Single sign on is a property of access control of multiple related, but independent software systems. With this property a user logs in once and gains access to all systems without being prompted to log in again at each of them. As different applications and resources support different authentication mechanisms, single sign on internally translates to and stores different credentials compared to what is used for initial authentication.

SUMMARY

In an embodiment, a method for securely accessing an application on an internal network is disclosed. The method comprises configuring a first host name in a computer as associated with an internal data communication network, where the internal data network comprises a communication network linking a plurality of computers whose internet protocol addresses are separated from the public internet by at least one firewall. A second host name in the computer is configured as associated with an external data communication network, where the second host name is an alias that resolves to an internet protocol address of an authentication server in the internal network. A first application hosted over the internal data communication network is invoked, where the invocation command includes a third host name that is related to the first host name and resolves to the internet protocol address of the authentication server. In response to the invocation of the first application, a request to invoke the first application including stored user authentication credentials is transmitted to the authentication server based on the third host name provided by the first application invocation command. A restricted application hosted over the internal data communication network is invoked where the invocation command includes the second host name. In response to the invocation of the restricted application, a request that does not include user authentication credentials is transmitted to invoke the restricted application to the authentication server based on the second host name provided by the restricted application invocation command.

In an embodiment, a system for securely accessing an application on a communication service provider data network from a computer outside the firewall of the communication service provider data network is disclosed. The communication service provider data network comprises a data network linking a plurality of computers whose internet protocol addresses are separated from the public Internet by at least one firewall. The system comprises a computer system having a browser application configured to provide filtered treatment to a restricted application hosted over the communication service provider data network, wherein, after an initial user sign on, the browser application, in response to invoking one of a first plurality of applications hosted over the communication service provider data network, forwards user authentication credentials to an authentication server based on a first host name provided by a first application invocation command. The authentication server is coupled to the communication service provider data network and promotes single sign-on to at least two applications hosted over via the communication service provider data network. Further, the application, in response to invoking the restricted application does not forward user authentication credentials to the authentication server based on an aliased host name provided by the restricted application invocation command, wherein the restricted application is not one of the first plurality of applications.

In an embodiment, a system for securely accessing an application on an internal network is disclosed. The system comprises an internal data communication network, an authentication server coupled to the internal data communication network, and a computer system having a browser application. The internal data communication network comprises a communication network linking a plurality of computers whose internet protocol addresses are separated from the public internet by at least one firewall. The authentication server coupled to the internal data communication network promotes single sign-on to at least two applications hosted over the internal data communication network. The browser application on the computer system is configured to provide filtered treatment to a restricted application hosted over the internal data communication network, where, after an initial user sign on, the browser application, in response to invoking one of a first plurality of applications hosted over the internal data communication network, forwards user authentication credentials to the authentication server based on a first host name provided by a first application invocation command. In response to invoking the restricted application the browser application does not forward user authentication credentials to the authentication server based on an aliased host name provided by the restricted application invocation command, where the restricted application is not one of the first plurality of applications.

In an embodiment, a method for securely accessing an application on an internal network is disclosed. The method comprises configuring a first host name in a computer as associated with an internal data communication network, where the internal data network comprises a communication network liking a plurality of computers whose internet protocol addresses are separated from the public internet by at least one firewall. The computer is configured to alias a second host name to resolve to the internet protocol address of an authentication server in the internal network, where the second host name is related to the first host name. The second host name in the computer is configured as associated with an external data communication network. A first application hosted over the internal data communication network is invoked via a browser executing on the computer, where the invocation command includes a third host name that is related to the first host name and resolves to the internet protocol address of the authentication server. In response to the invocation of the first application, a request to invoke the first application including stored user authentication credentials is automatically transmitted by the browser to the authentication server based on the third host name provided by the first application invocation command. A restricted application hosted over the internal data communication network is invoked via the browser, where the invocation command includes the second host name. In response to the invocation of the restricted application, a request to invoke the restricted application that does not include stored user authentication credentials is automatically transmitted by the browser to the authentication server based on the second host name provided by the restricted application invocation command.

DETAILED DESCRIPTION

A system and method for securely accessing an application on an internal network is described. In an embodiment, the internal network may be a communication service provider data network. A user logs into their computer account and is able to access programs located locally on that computer. However, in a network environment, applications that are accessed across the network may require the user to log in to each application separately. Single sign on allows a user to access a plurality of software systems or applications without being prompted to logon to each system individually. In a corporate environment, single sign on may allow a user to access corporate systems across an internal corporate network and provides a convenience to the user by utilizing authentication credentials obtained during the logon process to the local computer.

However, there may be some computers which are shared between more than one user, such as in a corporate retail store, where certain applications may need to be restricted from single sign on. These applications may be filtered and/or selected to require a user to sign on for each access from the shared computer. To accommodate limiting access to applications on the internal network using shared computers, the method describes configuring the shared computer to recognize applications which need to be restricted from single sign on and presenting the user with a manual login screen or window for these applications. Single sign on may be implemented through use of an authentication server. When a web browser is used to access a restricted application, the application may be accessed through an alias that resolves to the authentication server, but appears to the browser to be on an external network. Because the restricted application appears to be on an external network, the browser will not send authentication credentials to the authentication server. The method provides the convenience of single sign on to users of shared computers for less sensitive applications while providing secure access to applications which are restricted.

The authentication server is responsible for maintaining user credentials and associated application credentials for the user. When the authentication server receives a request to access an application it responds based on user credentials supplied with the request. If proper user credentials are supplied and the application credentials for the user are available, the authentication server starts the application, automatically logging in for the user. If user credentials are not received with the request, the authentication server starts the application and the user is prompted with a login screen for manually authenticating access to the application.

When an application is accessed through a web browser, the browser may utilize the uniform resource locator (URL) to identify the domain name of the host computer serving the application and determine whether the domain is on the internal network or an external network. If the domain is configured in the browser as on the internal network, the browser will pass user credentials to the authentication server to perform single sign on, allowing the application to be accessed without the need for an additional manual login. If the browser determines the application is on an external network, it will not send user credentials to the authentication server, which will result in the application requiring a manual login prior to allowing the user to access the application.

While it may be common practice for the browser to add specific hosts and domains to be treated as on the internal network, it is atypical functionality to restrict an application on the internal network to prevent single sign on for that application. To securely access the application on the internal network, the browser may be configured to treat a specific hostname or subdomain as on an external network, while the hostname or subdomain is part of a larger domain which is defined as on an internal network. The hostname or subdomain may be an alias that resolves to the internet protocol address of the authentication server in the internal network. When the browser resolves the aliased hostname or subdomain, it will determine the application is on an external network and will not send user credentials to the authentication server. This will result in the application presenting the user with a manual login screen or window.

The browser may use credentials retrieved from the computer operating system to send to the authentication server. A user goes through a logon sequence to access their account on the computer, and the user credentials may be saved by the computer operating systems. Programs executed on the computer, such as the browser, may retrieve the stored user credentials from the computer when the program determines it needs to provide the user credentials to the authentication server. The authentication server then validates the user credentials and accesses associated application credentials for the user to allow execution of the application without manual logon.

Turning now toFIG. 1, a system10for securely accessing an application on an internal network is described. The system comprises an external network12, a firewall14, an internal network16, a computer18, an authentication server22coupled to the internal network16, and an application server24coupled to the internal network16. The internal network16is separated from the external network12by the firewall14, with the firewall14used to protect the internal network16from unauthorized access while permitting legitimate data communications to pass. While a single firewall14is illustrated inFIG. 1, it is understood that the system10may comprise a plurality of firewalls14. The application server24hosts at least two applications over the internal network16. The authentication server22provides single sign on to the applications hosted on the application server24. It is understood that in an embodiment, the internal network16may be a network managed and operated by a communication service provider and may be referred to in some contexts as a communication service provider data network.

The computer18comprises a browser20. The browser20may be used for retrieving and presenting information on a data communication network. The browser20utilizes a uniform resource locator (URL) to identify the information, which may be in the form of a web page, image, video, or application. The browser20may be configured to group sites based on certain conditions, including whether a site is hosted on the external network12or the internal network16, and to apply security restrictions for each grouping. In an embodiment, the browser20is configured to provide filtered treatment and/or selective treatment to a restricted application hosted over the internal network16. In an embodiment, the filtered treatment and/or selective treatment may result in requiring that a user sign-on to access the subject application, even though the computer18has already signed on. The browser20is configured to recognize the restricted application as hosted on the internal network16. After an initial user sign on to the computer18, in response to invoking one of a first plurality of applications hosted over the internal network16, the browser20forwards user authentication credentials to the authentication server22based on a first host name provided by a first application invocation command.

The first host name is configured in the browser20as hosted over the internal network16. Because the first host name is contained in the first application invocation command, the browser20treats the first application as being hosted on the internal network16and sends user authentication credentials to the authentication server22. In response to invoking the restricted application hosted over the internal network16, the browser20does not forward the user authentication credentials to the authentication server22based on an aliased host name provided by the restricted application invocation command, where the restricted application is not one of the first plurality of applications. The aliased host name is configured in the browser20as hosted over the external network12. Because the aliased host name is contained in the restricted application invocation command, the browser20treats the restricted application as being hosted on the external network12and does not send user authentication credentials to the authentication server22.

In an embodiment, user authentication credentials are based on data obtained during an interactive logon process to the computer18and comprises a user name and password. A user having an account on a computer18would typically go through the interactive logon process to access their account when starting up the computer18or starting a computing session by providing a user name and password. The operating system, for example Microsoft Windows®, stores these credentials until the user logs off of the computer18, and these user authentication credentials may be used to support single sign on.

In an embodiment, the first host name is a subdomain of a larger domain and the larger domain is defined in the browser20as being on the internal data communication network16. The browser20is configured to recognize the larger domain as being on the internal network16. The subdomain of the larger domain is treated as being on the internal network16as well by virtue of being in the same domain. For example, the domain business.com may have a subdomain mail.business.com. When the browser20is configured to recognize business.com as being on the internal network16, the subdomain mail.business.com is also considered to be on the internal network16based on the configuration of business.com. In an embodiment, the aliased host name is a subdomain of the larger domain and the aliased host name is defined in the browser20as being on an external data communications network. Utilizing an aliased host name allows the browser20to be configured separately for the subdomain. Because the aliased host name is a subdomain of the larger domain and as such would be recognized as being on the internal network16, the aliased host name is configured separately in the browser20as being on the external network12. This allows the application accessed via the aliased host name to bypass single sign on and require authentication to the application.

In an embodiment, the first host name provided by the first application invocation command is configured in the browser20as associated with an internal network16. The first host name is contained in the uniform resource locator (URL) in the first application invocation command. The first application invocation command invokes the browser20and passes the uniform resource locator containing the first host name to the browser20. The browser20recognizes the first host name as being on the internal network16and passes user credentials to the authentication server22. In an embodiment, the aliased host name provided by the restricted application invocation command is configured in the browser20as associated with an external network12. The aliased host name is contained in the uniform resource locator in the restricted application invocation command. The restricted application invocation command invokes the browser20and passes the uniform resource locator containing the aliased host name to the browser20. The browser20recognizes the aliased host name as being on an external network12and does not pass user credentials to the authentication server22.

Turning now toFIG. 2, a method100for securely accessing an application on an internal network is described. At block102, a first host name in a computer18is configured as associated with an internal data communication network16, where the internal data communication network16comprises a communication network linking to a plurality of computers18whose internet protocol addresses are separated from the public internet by at least one firewall14. A domain name server (DNS) translates host names to internet protocol addresses. The first host name translates to an internet protocol address on the internal network16. At block104, a second host name in a computer18is configured as associated with an external data communication network12, where the second host name is an alias that resolves to an internet protocol address of an authentication server22in the internal network16. The authentication server22is configured as associated with the internal data communication network16, and use of the alias for the second host name gives the ability to configure the second host name as associated with the external network12even though data is sent to the authentication server22on the internal network16. At block106, a first application hosted over the internal data communication network16is invoked where the invocation command includes a third host name that is related to the first host name and resolves to the internet protocol address of the authentication server22. The third host name is related to the first host name and as such will be treated as associated with the internal network16. The third host name resolves to the internet protocol address of the authentication server22and will thus send the first application invocation request to that internet protocol address. At block108, in response to the invocation of the first application, a request to invoke the first application including stored user authentication credentials is transmitted to the authentication server22based on the third host name provided by the first application invocation command. Because the third host name is determined to be associated with the internal network16, the user authentication credentials are included in the first application invocation request transmitted to the authentication server22. At block110, a restricted application hosted over the internal data communication network16is invoked where the invocation command includes the second host name. The restricted application invocation request is sent to the internet protocol address of the authentication server22based on the aliased second host name. At block112, in response to the invocation of the restricted application, a request to invoke the restricted application that does not include user authentication credentials is transmitted to the authentication server22based on the second host name provided by the restricted application invocation command. Because the second host name is determined to be associated with the external network12, the user authentication credentials are not included in the restricted application invocation request transmitted to the authentication server22.

In an embodiment, the third host name is a subdomain of the first host name. A host name is a domain name assigned to a host computer, usually consisting of a combination of the host's local name with its parent domain's name. The first host name is the parent domain and the third host name is a subdomain of the parent domain. Because subdomains are part of their parent domains, configuring the parent domain as associated with the internal network16also gives the subdomains the same association. In an embodiment, the second host name is a subdomain of the first host name. Again, the first host name is the parent domain and the second host name is a subdomain of the parent domain. Therefore, to associate the second host name with the external network12, it is configured separately from the first host name; otherwise it would inherit the association with the internal network16from the parent domain.

In an embodiment, the computer18is shared by a plurality of users and where after a first logon to the computer18other users employ the computer18resources. Single sign on is used to simplify access and authentication issues for users, and is efficient on a computer18used by a single user. However, it may pose problems on computers18shared between users, where it may not be desirable for a user to access applications under another user's login and where it may be inconvenient for each user to logout when finished using an application. For example, in a retail store environment you may have a computer18which is shared by the sales associates and used for accessing corporate applications as well as completing sales transactions. The time it would take to have each sales associate login and logout after each use of the computer18may impact customer service. Additionally, some corporate applications may contain sensitive information in a user account that they would not want to be seen by other users. The ability to configure applications with sensitive information to not pass user credentials to the authentication server22, thus requiring manual login for that application by each user, enables the sales associates to share the computer without fear of exposing the sensitive information. Instead of having to completely login and logout of the computer, each associate can manually login and logout of the application, protecting the sensitive information without affecting other workflows on the computer.

In an embodiment, the method100further comprises configuring the second host name in a second computer18where the second host name is not associated with an external data communication network12and where the second host name is related to the first host name and is an alias that resolves to the internet protocol address of the authentication server22in the internal network16. By not specifically configuring the second host name in the second computer18, the second host name will be associated with the internal network16based on its relationship with the first host name. A restricted application hosted over the internal data communication network16is invoked where the invocation command includes the second host name. The restricted application invocation request is sent to the internet protocol address of the authentication server22based on the aliased second host name. In response to the invocation of the restricted application, a request to invoke the restricted application that includes stored user authentication credentials is transmitted to the authentication server22based on the second host name provided by the restricted application invocation command. Because the second host name is determined to be associated with the internal network16, the user authentication credentials are included in the restricted application invocation request transmitted to the authentication server22. The second computer18may be in a private office with no concerns about shared access of sensitive information, therefore the second host name does not need to be configured to be associated with an external network12. The restricted application is allowed to utilize single sign on in this case on the second computer18.

In an embodiment, the method100further comprises the authentication server22retrieving associated user application credentials for the first application in response to receiving stored user authentication credentials from the first application invocation. The authentication server22retrieves the stored user credentials for the first application and invokes the first application, passing the user credentials to the first application. In an embodiment, the authentication server22presents a login screen for the restricted application in response to receiving the restricted application invocation that does not include stored user authentication credentials. Because the restricted application invocation did not include user authentication credentials, the authentication server22does not retrieve stored user credentials for the restricted application and invokes the restricted application without passing user credentials, resulting in the user being presented with a login screen.

Turning now toFIG. 3, a method200for securely accessing an application on an internal network16is described. At block202, a first host name in a computer18is configured as associated with an internal data communication network16, where the internal data communication network16comprises a communication network linking a plurality of computers18whose internet protocol addresses are separated from the public internet by at least one firewall14. The first host name translates to an internet protocol address on the internal data communication network16. At block204, the computer18is configured to alias a second host name to resolve to the internet protocol address of an authentication server22in the internal network16, where the second host name is related to the first host name. The second host name is related to the first host name and will therefore be treated as associated with the internal network16. At block206, the second host name in the computer18is configured as associated with an external data communication network12. The use of the alias for the second host name gives the ability to configure the second host name as associated with an external network12even though data is sent to the authentication server22on the internal network16. At block208, a first application hosted over the internal data communication network16is invoked via a browser20executing on the computer18, where the invocation command includes a third host name that is related to the first host name and resolves to the internet protocol address of the authentication server22. The third host name is related to the first host name and the browser20will therefore treat the first application as associated with the internal network16. At block210, in response to the invocation of the first application, a request to invoke the first application including stored user authentication credentials is automatically transmitted by the browser20to the authentication server22based on the third host name provided by the first application invocation command. Because the third host name is determined to be associated with the internal network16, the user authentication credentials are included in the first application invocation request transmitted to the authentication server22. At block212, a restricted application hosted over the internal data communication network16is invoked via the browser20, where the invocation command includes the second host name. The second host name is configured to be associated with an external network12and the browser20will therefore treat the restricted application as associated with the external network12. At block214, in response to the invocation of the restricted application, a request to invoke the restricted application that does not include user authentication credentials is automatically transmitted by the browser20to the authentication server22based on the second host name provided by the restricted application invocation command. Because the second host name is determined to be associated with an external network12, the user authentication credentials are not included in the restricted application invocation request transmitted to the authentication server22.

In an embodiment, the stored user authentication credentials are based on data obtained during an interactive logon process and comprises a user name and a password. A user having an account on a computer18would typically go through the interactive logon process to access their account when starting up the computer18or starting a computing session by providing a user name and password. The operating system, for example Microsoft Windows®, stores these credentials until the user logs off of the computer18, and these user authentication credentials may be used to support single sign on. In an embodiment, the user authentication credentials are retrieved by the browser20using the NT LAN Manager (NTLM) protocol. NT LAN Manager is a MICROSOFT security protocol that provides authentication to users. The browser20uses the NT LAN Manager protocol to retrieve the stored user authentication credentials to pass to the authentication server22.

In an embodiment, the alias to the second host name is a subdomain of the first host name and the aliased host name is defined in the browser20as being on an external data communication network12. The first host name is the parent domain and the alias to the second host name is a subdomain of the parent domain. To associate the aliased host name with the external network12it is configured in the browser20so it does not inherit the association with the internal network16from the parent domain. In an embodiment, the browser20determines the associated data communication network based on the fully qualified domain name (FQDN) of the first host name, second host name, and third host name. A fully qualified domain name is a domain name that specifies its exact location in the hierarchy of the domain name system. For example, given the parent domain name parent.com, the fully qualified domain name of a local host firsthost is firsthost.parent.com.

In an embodiment, configuring the first host name in the computer18as associated with the internal network16comprises adding the first host name to a configuration file defining an internal internet zone. An application, such as a browser20, is used for retrieving and presenting information resources over a network. Because the browser20is used for accessing resources on an external network12, it may have built in security that groups sites into zones, with all sites in a zone subject to security restrictions. Defining the first host name in a configuration file as in the internal internet zone allows the applications running on the computer18to apply appropriate security when retrieving information from the first host name. In an embodiment, configuring the second host name in the computer18as associated with the external network12comprises adding the second host name to a configuration file defining an external internet zone. Defining the second host name in a configuration file as in the external internet zone allows the applications running on the computer to apply appropriate security when retrieving information from the second host name.