Abstract:
The present disclosure describes a method and apparatus for user identity verification as a user migrates amongst systems, servers, computing environments and/or segments within a cloud computing environment. A user currently accessing a first system seeks to migrate from the first system to a target system. The target system validates whether the user may access the target system based on a first private key and a first public key. A verification system maintains a second public key that is based on an identity of the user and inaccessible to the user. The verification system receives a second private key from an initial system of the user. Based on the second private/public keys, the verification system sends a validation of user identity to the target system.

Description:
BACKGROUND 
       [0001]    Public-key cryptography refers to a cryptographic algorithm which requires the use of a private key and a public key. Although different, the two keys in the key pair are mathematically linked. It is computationally easy for a user to generate his or her public and private key pair and to use them for encryption and decryption. It is computationally infeasible for a properly generated private key to be determined from its corresponding public key. Thus, the public key may be published without compromising security, whereas the private key must not be revealed. 
         [0002]    Secure shell authentication (SSH) uses public-key cryptography to authenticate a remote user attempting to access a computer (or server). One conventional approach in SSH is to allow users (or programs) to log into a desired computer without having to specify a password. In this approach, anyone can produce a matching pair of different keys consisting of a public key and a private key. The public key is placed on all computers that must allow access to the owner of the matching private key, where the owner of the private key keeps the private key secret. 
       SUMMARY 
       [0003]    The present disclosure describes a method and apparatus for user identity verification as a user migrates amongst systems, servers, computing environments and/or segments within a cloud computing environment. Specifically, the present disclosure relates to the use of multiple private and public key pairs that are processed as a user migrates amongst the systems, servers, computing environments and/or segments within a cloud computing environment. 
         [0004]    As described herein, a user currently accessing a first system seeks to migrate from the first system to a target system. The target system receives a first private key from the first system. The target system already has access to a first public key that corresponds with the first private key. The target system validates whether the user may access the target system based on the first private key and the first public key. 
         [0005]    While the target system can validate whether the user can access the target system by utilizing the first private key and the first public key, the target system requests further verification of the user&#39;s actual identity by interacting with a second system (hereinafter referred to as “verification system”). 
         [0006]    The verification system maintains a second public key that is based on an identity of the user. The second public key is inaccessible to the user. The verification system receives a second private key from an initial system associated with the user. Based on the second private key and the second public key, the verification system sends a validation of user identity to the target system. 
         [0007]    Prior to the user migrating amongst various systems, the user logs into the verification system from the initial system associated with the user. The verification system generates the second private key and the second public key based on the identity of the user. The verification system transmits the second private key to the initial system and stores the second public key such that the second public key is inaccessible to the user. As the user seeks to access various systems, any system that has determined whether the user has access can request verification of the user&#39;s actual identity. Upon receipt of such a request, the verification system receives the second private key from the initial system and validates the user&#39;s identity by utilizing the second private key and the second public key that is inaccessible to the user. 
         [0008]    By utilizing a plurality of key pairs, where a first key pair corresponds with the user&#39;s access rights to the target system and a second key pair corresponds to the user&#39;s actual identity, the present disclosure describes a method and apparatus that provides added security by determining whether a user who provides the proper credentials (i.e. the first private/public keys) for accessing a target system is actually a user who should be accessing the target system. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0009]      FIG. 1  shows a diagram illustrating a verification system for providing a validation of a user&#39;s identity to various systems as the user migrates amongst the various systems in accordance with embodiments described herein. 
           [0010]      FIG. 2  is a flowchart showing steps performed by a target system receiving a validation of a user&#39;s identity in accordance with embodiments described herein. 
           [0011]      FIG. 3  is a flowchart showing steps performed by a verification system generating a private key and public key based on an identity of a user in accordance with embodiments described herein. 
           [0012]      FIG. 4  is a flowchart showing steps performed by a verification system transmitting a validation of user identity in accordance with embodiments described herein. 
           [0013]      FIG. 5  is a high-level block diagram of an exemplary computer that may be used for implementing one or more embodiments of user identity verification as described herein. 
       
    
    
     DETAILED DESCRIPTION 
       [0014]      FIG. 1  shows a diagram illustrating a verification system for providing a validation of a user&#39;s identity to various systems as the user migrates amongst the various systems in accordance with embodiments described herein. 
         [0015]      FIG. 1  shows an initial system  110  associated with the user  105 . The initial system  110  may be a system from which the user  105  logs into a verification systems  125  for a session during which a public/private key pair associated with the user is generated. The verification system  125  generates a user private key  130  and a user public key  135  based on an identity of the user  105 . 
         [0016]    The verification system  125  stores the user public key  135  such that it is inaccessible to the user  105 . For example, the verification system  125  stores the user public key  135  in a secure file system that the user  105  is not allowed to access. The verification system  125  returns the user private key  130  to the initial system  110 . 
         [0017]    The user  105  migrates from the initial system  110  to a first system  115 . For example, the user  105  attempts to log into the first system  115  from the initial system,  110 . The first system  115  determines whether the user  105  has access to an application in the first system  115 . The first system  115  has access to an application public key  140 - 1  and the first system receives an application private key  145  from the user  105  (or the initial system  110 ). The first system  115  processes the application keys  140 - 1 ,  145  in order to determine if the user  105  has access to the application. The first system  115  also sends a user identification request  150 - 1  to the verification system  125  to verify the actual identity of the user  105 . 
         [0018]    In response to the user identification request  150 - 1 , the verification system  125  requests and receives the user private key  130  from the initial system  110 . The verification system  125  processes the user keys  130 ,  135  in order to validate the user&#39;s  105  identity. If the presented user private key  130  cryptographically matches with, binds to, decrypts, or validates the corresponding public key  130  (or vice versa), the verification system  125  transmits a validation of user identity  160 - 1  to the first system  115 . 
         [0019]    The user  105  then migrates from the first system  115  to the target system  120 . The target system  120  determines whether the user  105  has access to an application in the target system  120 . The target system  120  has access to an application public key  140 - 2  and the target system  120  receives an application private key  145  from the user  105 . The target system  120  processes the application keys  140 - 2 ,  145  in order to determine if the user  105  has access to the application in the target system  120 . The target system  120  also sends a user identification request  150 - 2  to the verification system  125  to verify the actual identity of the user  105 . 
         [0020]    In response to the user identification request  150 - 2 , the verification system  125  requests and receives the user private key  130  from the initial system  110 . The verification system  125  processes the user keys  130 ,  135  in order to validate the user&#39;s  105  identity. If the user keys  130 ,  135  match, the verification system  125  transmits a validation of user identity  160 - 2  to the target system  120 . It is understood that, in addition to the validations of user identity  160 - 1 ,  160 - 2 , the verification system  125  can also send additional information about the user  105  regarding user attributes, roles, and privileges, such additional information can accompany the validations of user identity  160 - 1 ,  160 - 2 . 
         [0021]    It is understood that the application key pairs  140 - 1  &amp;  145  and  140 - 2  &amp;  145  need not relate to a same type of application and that there can be additional key pairs that are exchanged as well. It is also noted that the application key pairs  140 - 1  &amp;  145  and  140 - 2  &amp;  145  can determine access, rights and/or privileges to any software module(s) and/or user accounts in a system. 
         [0022]      FIG. 2  is a flowchart  200  showing steps performed by a target system receiving a validation of a user&#39;s identity in accordance with embodiments described herein. 
         [0023]    At step  205 , a target system  120  receives a first private key  145  from either a user  105  seeking access to the target the system  120  or from an initial system  110  associated with the user  105 . At step  210 , the target system  120  validates the user&#39;s access to the target system  210  based on the first private key  145  and a first public key  140 - 2  accessible by the target system  120 . 
         [0024]    At step  215 , the target system  120  transmits a request  150 - 2  for a validation of user identity to a verification system  125  which stores a second public key  135  that is inaccessible to the user. 
         [0025]    In response to the request  150 - 2 , the verification system  125  requests a second private key  130  from the initial system  110 . The verification system  125  receives the second private key  130  from the initial system  110  and validates the user&#39;s  105  identity based on the second private key  130  and the second public key  135 . The verification system  125  transmits the validation of user identity  160 - 2  to the target system  120 . 
         [0026]    At step  220 , the target system  120  receives the validation of user identity  160 - 2  from the verification system  125 . 
         [0027]      FIG. 3  is a flowchart  300  showing steps performed by a verification system generating a private key and public key based on an identity of a user in accordance with embodiments described herein. 
         [0028]    At step  305 , the user  105  logs into the verification system  125  from the initial system  110 . At step  310 , the verification system  125  generates a second private key  130  and a second public key  135  based on an identity of the user  105 . At step  315 , the verification system  125  associates the second private key  130  and the second public key  135  with the user  105 . 
         [0029]    At step  320 , the verification system  125  transmits the second private key  130  to the initial system  110  of the user. At step  325 , the verification system  125  stores the second public key  135  such that it is inaccessible to the user  105 . 
         [0030]      FIG. 4  is a flowchart  400  showing steps performed by a verification system transmitting a validation of user identity in accordance with embodiments described herein. 
         [0031]    At step  405 , the verification system  125  receives a request  150 - 1  for a validation of user identity  160 - 1  from the first system  115 . At step  410 , the verification system  125 , transmits a request for the second private key  130  to the initial system  110 . 
         [0032]    At step  415 , the verification system  125  receives the second private key  130  from the initial system  110 . At step  420 , the verification system  125  transmits the validation of user identity  160 - 1  to the first system  115  based on the second private key  130  and the second public key  135 . 
         [0033]    For purposes of the present disclosure, it is understood that the terms “system,” “server,” “computing environment,” and “segment within a cloud computing environment” can be used interchangeably. 
         [0034]      FIG. 5  is a high-level block diagram of an exemplary computer that may be used for implementing one or more aspects of user identity verification as described herein. Computer  500  comprises a processor  501  operatively coupled to a data storage device  502  and a memory  503 . Processor  501  controls the overall operation of computer  500  by executing computer program instructions that define such operations. The computer program instructions may be stored in data storage device  502 , or other computer readable medium, and loaded into memory  503  when execution of the computer program instructions is desired. Thus, the steps of  FIGS. 2 ,  3 , and/or  4  can be defined by the computer program instructions stored in memory  503  and/or data storage device  502  and controlled by processor  501  executing the computer program instructions. 
         [0035]    The computer program instructions can be implemented as computer executable code programmed by one skilled in the art to perform an algorithm defined by the method steps of  FIGS. 2 ,  3  and/or  4 . Accordingly, by executing the computer program instructions, the processor  501  executes an algorithm defined by the method steps of  FIGS. 2 ,  3  and/or  4 . Computer  500  also includes one or more network interfaces  505  for communicating with other devices via a network. Computer  500  also includes one or more input/output devices  504  that enable user interaction with computer  500  (e.g., display, keyboard, mouse, speakers, buttons, etc.). 
         [0036]    Processor  501  may include both general and special purpose microprocessors, and may be the sole processor or one of multiple processors of computer  500 . Processor  501  may comprise one or more central processing units (CPUs), for example. Processor  501 , data storage device  502 , and/or memory  503  may include, be supplemented by, or incorporated in, one or more application-specific integrated circuits (ASICs) and/or one or more field programmable gate arrays (FPGAs). 
         [0037]    Data storage device  502  and memory  503  each comprise a tangible non-transitory computer readable storage medium. Data storage device  502 , and memory  503 , may each include high-speed random access memory, such as dynamic random access memory (DRAM), static random access memory (SRAM), double data rate synchronous dynamic random access memory (DDR RAM), or other random access solid state memory devices, and may include non-volatile memory, such as one or more magnetic disk storage devices such as internal hard disks and removable disks, magneto-optical disk storage devices, optical disk storage devices, flash memory devices, semiconductor memory devices, such as erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM), digital versatile disc read-only memory (DVD-ROM) disks, or other non-volatile solid state storage devices. 
         [0038]    Input/output devices  505  may include peripherals, such as a printer, scanner, display screen, etc. For example, input/output devices  504  may include a display device such as a cathode ray tube (CRT), plasma or liquid crystal display (LCD) monitor for displaying information to the user, a keyboard, and a pointing device such as a mouse or a trackball by which the user can provide input to computer  500 . 
         [0039]    One skilled in the art will recognize that an implementation of an actual computer or computer system may have other structures and may contain other components as well, and that  FIG. 5  is a high level representation of some of the components of such a computer for illustrative purposes. 
         [0040]    The foregoing Detailed Description is to be understood as being in every respect illustrative and exemplary, but not restrictive, and the scope of the invention disclosed herein is not to be determined from the Detailed Description, but rather from the claims as interpreted according to the full breadth permitted by the patent laws. It is to be understood that the embodiments shown and described herein are only illustrative of the principles of the present invention and that various modifications may be implemented by those skilled in the art without departing from the scope and spirit of the invention. Those skilled in the art could implement various other feature combinations without departing from the scope and spirit of the invention.