WO2003073687A1 - System and method for distributed authentication service - Google Patents
System and method for distributed authentication service Download PDFInfo
- Publication number
- WO2003073687A1 WO2003073687A1 PCT/US2003/002587 US0302587W WO03073687A1 WO 2003073687 A1 WO2003073687 A1 WO 2003073687A1 US 0302587 W US0302587 W US 0302587W WO 03073687 A1 WO03073687 A1 WO 03073687A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- authentication
- user
- name
- guid
- server
- Prior art date
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L61/00—Network arrangements, protocols or services for addressing or naming
- H04L61/45—Network directories; Name-to-address mapping
- H04L61/4505—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols
- H04L61/4511—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols using domain name system [DNS]
Abstract
A system and method for distributed authentication service is disclosed, which prevents any single participant from monitoring the logon rates of other participants is disclosed. In particular, there is no single central list that is consulted to identify where the authentication should be performed. Rather, the systems keys on the domain portion of the global user ID. The client portion parses the entered ID and redirects the submission to the appropriate authentication service. Rather than consulting a global look-up table, the domain name is pre-pended to a central host domain and DND (200) is consulted to find the location of the underlying authentication servers (111). The DNS (200) look-up is distributed and cached and, as a result, the look-up cannot be centrally monitored.
Description
SYSTEM AND METHOD FOR DISTRIBUTED
AUTHENTICATION SERVICE
BACKGROUND OF THE INVENTION TECHNICAL FIELD
The invention relates generally to Internet based authentication technology. More particularly, the invention relates to a system and method for distributed authentication service.
DESCRIPTION OF THE PRIOR ART
The explosive growth of the Internet is changing the ways in which we communicate, conduct business, and pursue entertainment. A few years ago, electronic commerce (E-commerce) was just an interesting concept. By 1999, however, it had become the hottest thing around. Today, not only are consumers buying an enormous volume of goods or services over the Internet, but the business-to-business E-commerce has taken off as well.
The basic cell of E-commerce is an electronic transaction, which requires a buyer or user fills out one or more electronic forms on screen and click a button named "send", "buy" or "submit", etc. To complete such an electronic transaction, a user has to go through an authentication process. In other words, the user must provide the seller or service provider with some information such as his or her personal identification, contact information, or even financial information. The authentication process may take from several minutes to hours. Because each seller or service provider maintains its own authentication server and database, millions of seller and service providers might share thousands of millions of consumers or users. Some of
the consumers or users might be required to go through the same or similar authentication process again and again if they have transactions with many sellers or service providers. This repetitive authentication not only wastes consumers' precious time, but also burdens the sellers or service providers because they have to expand their databases to keep detailed authentication information for a growling number of users. This situation brings forth a technical need to create a universal, unified single-logon infrastructure wherein a specific user may be authenticated once for all and the authentication result is widely recognized by a large number of sellers or service providers.
In responding to that need, several approaches have been developed. For example, Microsoft Corporation has introduced a ".NET Passport" single sign-in system. With ".NET Passport", a user doesn't need to register a member name and password at each new site he visits. The user may simply use his e-mail address and password that registered as his ".NET Passport" to sign in to any participating site or service. The information the user registers with ".NET Passport" is stored online, securely, in the ".NET Passport" database as the user's ".NET Passport profile." When the user signs in to a ".NET Passport" participating site by typing his e-mail address and password in the ".NET Passport" sign-in box, ".NET Passport" confirms that (1) the e-mail address he typed is registered with ".NET Passport", and (2) the password he typed is correct. ".NET Passport" then notifies the site that the user has provided valid "sign-in credentials", and he is given access to the participating site. Once the user signs in to one ".NET Passport" participating site during an Internet session, he can sign in to others simply by clicking the ".NET Passport" sign-in button on each site.
Another example is America Online Inc.'s "Screen Name Service" system, which provides free service allowing anyone with a "Screen Name" to register easily and securely at a variety of Web sites. The "Screen Name Service" eliminates a user's need to remember multiple names and passwords for all the places he visits on the Web. With the "Screen Name Service" system, each user has a "My Profile", which stores the user's personal information used to make registering at sites across the Web simple and secure. When the user registers at a participating Web site using the service, he has the opportunity to choose which fields of information stored by AOL, if any, he would like to share with that site. No information is shared with any Web site without the user's explicit permission. When the user agrees to share certain information with a participating site, that information is conveyed to the Web site at which he is registering. Another feature is that the user is provided with a "My Site List", which is an effective way to manage personal information because it shows the user with which sites he has registered with using the service. The user can view the privacy policy of a site to see how it uses information it knows about the user. The user can also decide if he would like to be signed into the site without being prompted and if the site should be updated with information if "My Profile" changes.
The common characteristic of these approaches is that they implement a centralized solution for authentication and authentication information management. Undoubtedly, the centralized solution may overcome the repetitive authentication and repetitive storage problems that exist in the scattered, disorganized situation.
However, the centralized solution has three major disadvantages. First, in a centralized authentication system, because all the login requests go to a central authentication server, the traffic to the server could be very heavy, the requirements
for the process capability and database size could be predictably high, and the authentication process would be very slow when the number of requests is overwhelmed for the server. Second, in case that the central authentication system fails, all the authentication requests would be suspended. Third, the central authentication service provider could monitor the participating sites' logon rates and a site which hosts a user's login page could monitor the user's logon information.
What is desired is a solution to have each authentication carried out at one of participating servers and have the authentication result distributed and cached all over the network of the participating servers so that the authentication results cannot be centrally monitored.
SUMMARY OF INVENTION
The invention herein comprises a system and method for providing a distributed authentication service. According to the invention, the user names are chosen from a fairly universal name space, e.g., communication addresses, and yet the servicing of the authentication, e.g., password checking, is distributed among the participants of an authentication federation that the system supports. Typically, the participants are commercial servers that can host authentication. A key goal of this distributed system is to prevent any single participant from monitoring the logon rates of other participants. Most critically, there is no single central list that is consulted to identify where the authentication should be carried out.
In the preferred embodiment, the system keys on the domain portion of the global user identification (GUID), which is typically an email address formatted ID. The
client portion of the system, typically implemented as JavaScript function in a browser, parses the entered GUID, and redirects the submission to the appropriate authentication server. Rather than consulting a global lookup table, the domain portion of the GUID is pre-pended to a central host domain, i.e., the distributed authentication system's domain, and the domain name system (DNS) is consulted to find location of the underlying authentication servers. A critical point is that the DNS lookup is distributed and cached, and as a result, the lookups cannot be centrally monitored.
The system may further comprise an authentication server as a default server. The DNS resolver in the central location can automatically map all unrecognized domains into the default server. The end result is that substantially all possible GUID's are automatically distributed to the appropriate authentication servers.
Note that in a browser scenario, the scanning and translating are performed by simple standard JavaScript, and the submission can be automatically sent to the appropriate authentication server without the party that hosted the login page being allowed to see any of the information.
BRIEF DESCRIPTION OF THE DRAWINS
FIG. 1A is a block diagram illustrating a network 100 that facilitates distributed authentication service;
FIG. 1 B is a schematic diagram illustrating an exemplary domain name system (DNS) 200 incorporated in a global network;
FIG. 1C is a table diagram illustrating an IP address database associated with the domain name server DNS 06 in the network 100;
FIG. 2 is a flow diagram illustrating a process 220 for providing distributed authentication service according to one preferred embodiment of the invention; FIG. 3 is a flow diagram illustrating a process 230 for providing distributed authentication service according to another preferred embodiment of the invention;
FIG. 4 is a flow diagram illustrating a process 240 for providing distributed authentication service according to another preferred embodiment of the invention; and FIG. 5 is a flow diagram illustrating a process 250 for providing distributed authentication sen/ice according to another preferred embodiment of the invention.
DETALED DESCRIPTION
FIG. 1A is a block diagram illustrating an exemplary network 100, named Magic Carpet Network (MCN), which provides distributed authentication service among a global authentication federation. The MCN network includes a number of clients, e.g., client device 101 , and a number of authentication servers, e.g., servers 1 1 1 -1 13, which are communicatively connected via the Internet 105. Each authentication server represents a participant of the global authentication federation and has a database, e.g., DB 01 -DB 03, which caches its registered users' identification information and any authentication token from other participating authentication servers. Each client or authentication server can access a local
domain name server, which is one of many domain name server's coupled in a domain name system (DNS).
FIG. 1 B is a schematic diagram illustrating an exemplary domain name system 200 incorporated in a global network. A domain name system (DNS) is a general- purpose, replicated, distributed data query service for looking up host Internet Protocol (IP) addresses based on host names. It is hierarchical, consisting of domains, sub-domains, sites, and hosts. Unique names are formed from smallest to largest, and are of the form user® host.site.subdomain. domain, where host and site are often optional. On the Internet, domain names typically end with a suffix denoting the type of site. For example, ".COM" for commercial sites and ".ORG" for organizations. A name resolution client, such as the client 101 in FIG. 1A, can be configured to search for host information in the following order: first in the local/etc/hosts file, second in network information service (NIS), and third in DNS. This sequencing of naming services is sometimes called name service switching. DNS can be queried interactively using command nslookup.
The MCN network 100 illustrated in FIG. 1A is registered under a unique domain name, for example MCN.ORG, in the central location of the DNS 200. The MCN network 100 requires each participant to register its authentication server as an individual machine under the MCN domain. In other words, the hostnames of the authentication servers share a common suffix. For example, AOL, as a participant host, registers its authentication server as AOL.COM.MCN.ORG under the unique domain MCN.ORG. The domain name server DNS 06 associated with the MCN network 100 just treats each participant authentication server as a host machine. For example, it treats AOL.COM.MCN.ORG as the host name of AOL Authentication Server 101.
As illustrated in FIG.1C, the database DB 16 associated with the domain name server DNS 06 maintains a list of fully qualified domain names (FQDN) for the registered authentication servers. A FQDN consists of its local hostname and its domain name, including a top-level domain. For example, AOL.COM.MCN.ORG is a FQDN, in which AOL.COM is a host name, MCN.ORG is a domain name, and .COM is a top level domain name. Each of FQDN has a unique Internet Protocol (IP) address, which was installed in the database DB 06 when a commercial participant of the federation registered its authentication server under the domain MCN.ORG.
Client device 101 is empowered with an interface that enables a user to interact with a distributed authentication system embodied in the MCN network 100. In the preferred embodiment, the client device 101 includes a browser 103 which displays HTML file. The HTML facilitates a number of functions, including the authentication function, which is typically implemented in JavaScript. Alternatively, the client device 101 may include an application specifically for managing the authentication process.
To initiate an authentication process, a user must log in the distributed authentication system by entering his global user identification (GUID) and password and clicking a login button. A GUID is in a universal name space format, for example, an email address format. Thus any given GUID consists of two portions separated by a delimitation symbol, such as @. The first portion is the user's user name, and the second portion is a domain name indicating the domain of a server (such as AOL.COM) with which the user registered. For example, an AOL registered user with a user name, joe, should enter his GUID joe@AOL.COM and his password secret911 for authentication by AOL Authentication Server 111 , which is registered as AOL.COM.MCN.ORG under the domain MCN.ORG.
Referring to FIG. 1 B, assuming the user enters his GUID and password from a page 201 hosted by ZYX.COM. Once the user gets logged in, the client portion of the authentication system parses the user's GUID joe@AOL.COM and extracts the domain portion A0L.COM from the GUID. Then, it appends the MCN domain name as a suffix to the domain portion. As a result, a FQDN A0L.C0M.MCN.ORG is formed.
The client portion of the authentication system first looks up a local domain name server DNS 05 to find location of the authentication server with a FQDN A0L.C0M.MCN.ORG. After if fails in DNS 05, it populates the lookup request to its upper level DNS 02; after it fails in DNS 02, it populates the lookup request to the top DNS 01 , where it locates the DNS 03 for the ".ORG" network, and further locates the DNS 06 for the MCN network 100, and eventually it locates AOL.COM.MCN.ORG. In responding to the lookup request from the client device 101 , the DNS system returns the unique IP address for AOL.COM.MCN.ORG to the client 101. This unique IP address is automatically cached in the DNS along the returning route, i.e., DNS 06 →DNS 03 →DNS 01 DNS 02 →DNS 05. Note that the critical point is that the DNS lookup is distributed and ached, and as a result, the DNS lookups cannot be centrally monitored by any participant of the federation.
In an equivalently preferred embodiment of the invention, the distributed authentication system supported by the MCN network 100 includes a default server 114 with a FQDN DEFAULT.MCN.ORG. If the DNS lookup totally fails, i.e. the domain included in the lookup request sent by the client device 101 is not recognized by the DNS 200, a DNS resolver in the central location of the DNS 200 can automatically map the unrecognized domain to the default server 114. The default server 114 takes responsibility to authenticate the user by looking up its local
database. The end result is that all possible MCN ID's are automatically distributed to the appropriate servers.
Once the client 101 received the IP address of the targeted authentication server, i.e. AOL Authentication Server 111 in our example, it sends the user's user name joe with his password secret911 to AOL Authentication Server 111 for authentication. When AOL Authentication Server 111 receives the request, it looks up its local database DB 01 for the user entry, validates the user name and password, and sends an authentication token back to the user. The authentication token is cached in the client device. When the user sends request to any participant servers, the authentication token is automatically attached. The attached authentication token is recognized by any participant server of the federation and is automatically cached in the participant server's database when the participant server receives the authentication token. In this way, the user's detailed authentication information is stored only in one participant server's authentication database, but the authentication token is distributed all over the participants' authentication databases. Because an authentication server does not need to store every user's detailed authentication information, its authentication database can be relatively small in size.
In another equivalently preferred embodiment, the client portion of the authentication system has a mapping list of the fully qualified domain names (FQDN) for all registered authentication servers. When the user gets logged in, the system parses and extracts the domain portion from the user's GUID, and directly checks the mapping list to find the IP address for the target authentication server. If the local list checkup fails, the authentication request may be automatically mapped into the default authentication server 114 as described above.
In another equivalently preferred embodiment, the local list checkup and the DNS lookup may be combined. For example, the system first checks the local mapping list. If the target authentication server's IP address is not found from the mapping list, then start the DNS lookup process. If the DNS lookup fails, then automatically map the unrecognized domain to the default server 114 as described above.
In another equivalently preferred embodiment, all participants are not registered in a specific domain. Instead, each participating authentication server is registered with a standard server name in its main server's domain. For example, AOL Authentication Server 111 has a FQDN AUTH.AOL.COM, USPTO's authentication server has a FQDN AUTH.USPT0.GOV, etc. In other words, the host names of these authentication servers share a common prefix, but they reside in different domains. When the user gets logged in, the authentication system first parses and extracts the domain portion of the GUID. Then, it either checks a local mapping list or looks up the DNS 200 or performs both local list checkup and DNS lookup to locate the IP address for the target authentication server. If the IP address for the target authentication server is not found, the system may map the authentication request to the default server 114 as described above.
FIG. 2 is a flow diagram illustrating a process 220 for providing distributed authentication sen/ice according to one embodiment of the invention. The distributed authentication service is provided via a network with a unique domain name. The network includes a number of participating authentication servers and a number of clients. The network's domain name is used as a common suffix for all participating servers' FQDN. For example, for all participants of the MCN network 100, the common suffix of their FQDN is MCN.ORG and AOL Authentication Server's FGDN is AOL.COM.MCN.ORG. The process includes the steps of:
Step 221. The user logs in by entering his global user identification (GUID) and his password. The GUID includes his user name followed by a delimitation symbol and a domain portion which is the domain name of the server with which the user registered. For example, an AOL registered user joe has a GUID joe@aol.com.
Step 222. Parse the GUID and extract the domain portion. For example, extract aol.com from GUID joe@aol.com.
Step 223. Append the domain name of the network as a suffix to the extracted domain portion from the GUID to form a fully qualified domain name (FQDN).
Step 224. Consult DNS for the FQDN's IP address. For example, the DNS 200 locates A0L.C0M.MCN.ORG from the MCN database DB 16 and returns its IP address.
Step 225. Send user name and password to the target authentication server. For example, sends joe and secret911 to AOL Authentication Server 111.
Step 226. Carry out the authentication at the target authentication server.
Step 227. Cache and distribute the authentication result which is recognized by all authentication servers registered in the network.
As an option, the process 220 may further include:
Step 224B. If the DNS look up fails, automatically send the user name and password to a default server for authentication.
FIG. 3 is a flow diagram illustrating a process 230 for providing distributed authentication sen/ice according to another preferred embodiment of the invention. The distributed authentication sen/ice is provided via a network with a unique domain
name. The network includes a number of participating authentication servers and a number of clients. The network's domain name is used as a common suffix for all participating servers' FQDN. For example, for all participants of the MCN network 100, the common suffix of their FQDN is MCN.ORG and AOL Authentication Server's FGDN is AOL.COM.MCN.ORG. The process 230 includes the steps of:
Step 231. The user logs in by entering his global user identification (GUID) and his password. The GUID includes his user name followed by a delimitation symbol and a domain portion which is the domain name of the server with which the user registered. For example, an AOL registered user joe has a GUID joe@aol.com.
Step 232. Parse the GUID and extract the domain portion from the GUID. For example, extract aol.com from GUID joe@aol.com.
Step 233. Append the network's domain name as a suffix to the extracted domain portion from the GUID to form a fully qualified domain name (FQDN).
Step 234. Consult a predefined local mapping list of the FQDN's for all registered authentication servers to obtain an IP addresses for the FQDN formed in Step 233. In the mapping list, each FQDN is mapped to a unique IP address. This approach suits for scenario where the distributed authentication federation has a static and small list of participants.
Step 235. Send user name and password to the target authentication server. For example, sends joe and secret911 to AOL Authentication Server 111.
Step 236. Carry out the authentication at the target authentication server.
Step 237. Cache and distribute the authentication result.
As an option, the process 230 may further include:
Step 234A. If the IP address cannot be found from the local mapping list, automatically send the user name and passport to a default server for authentication.
FIG. 4 is a flow diagram illustrating a process 240 for providing distributed authentication service according to another preferred embodiment of the invention. The distributed authentication service is provided via a network with a unique domain name. The network includes a number of participating authentication servers and a number of clients. The network's domain name is used as a common suffix for all participating servers' FQDN. For example, for all participants of the MCN network 100, the common suffix of their FQDN is MCN.ORG and AOL Authentication Server's FGDN is AOL.COM.MCN.ORG. The process 240 includes the steps of:
Step 241. The user logs in by entering his global user identification (GUID) and his password. The GUID includes his user name followed by a delimitation symbol and a domain portion which is the domain name of the server with which the user has registered. For example, an AOL registered user joe has a GUID joe@aol.com.
Step 242. Parses the GUID and extracts the domain portion. For example, extract aol.com from GUID joe@aol.com.
Step 243. Append the network's domain name as a suffix to the extracted domain portion from the GUID to form a fully qualified domain name (FQDN).
Step 244. Consult a predefined local mapping list of the FQDN's for registered authentication servers to obtain an IP addresses for the FQDN formed in Step 243. In the mapping list, each FQDN is mapped to a unique IP address.
Step 244A. If Step 244 fails, consult DNS for the FQDN's IP address. For example, the DNS system locates AOL.COM.MCN.ORG from the MCN database DB 16 and returns its IP address. This approach balances performance efficiency and adaptation of dynamic changes of the participant list.
Step 244B. If Step 244A fails, automatically send the user name and password to a default server for specific authentication.
Step 245. Send user name and password to the target authentication server. For example, sends joe and secret911 to AOL Authentication Server 111.
Step 246. Carry out the authentication at the target authentication server.
Step 247. Cache and distribute the authentication result.
FIG. 5 is a flow diagram illustrating a process 250 for providing distributed authentication se /ice according to another preferred embodiment of the invention. The process 250 includes the steps of:
Step 251. The user logs in by entering his global user identification (GUID) and his password. The GUID includes his user name followed by a delimitation symbol and a domain portion which is the domain name of the server with which the user has registered. For example, an AOL registered user joe has a GUID joe@aol.com.
Step 252. Parses the GUID and extracts the domain portion. For example, extract aol.com from GUID joe@aol.com.
Step 253. Prepend a predefined parameter {e.g., "AUTHENTICATION" or "AUTH") representing a standard authentication server name as a prefix to the extracted domain portion from the GUID to form a fully qualified domain name
(FQDN) in its main server's domain. This FQDN is same as the registered domain name of a target authentication server. For example, AOL Authentication Server's FQDN is AUT.AOL.COM.
Step 254. Consult a predefined local mapping list of the FQDN's of all registered authentication servers to obtain an IP addresses for the FQDN formed in Step 253. In the mapping list, each FQDN is mapped to a unique IP address.
Step 254A. If Step 254 fails, consult DNS for the FQDN's IP address. For example, the DNS system locates AUTH.AOL.COM from a certain MCN database and returns its IP address. This approach balances performance efficiency and adaptation of dynamic changes of the participant list.
Step 254B. If Step 254A fails, automatically send the user name and password to a default server for specific authentication.
Step 255. Send user name and password to the target authentication server. For example, sends joe and secret911 to AOL Authentication Server 111.
Step 256. Carry out the authentication at the target authentication server.
Step 257. Cache and distribute the authentication result to the client.
Definition: In this document, "fully qualified domain name (FQDN)" means a full site- name, which consists of (1) a local host name, and (2) a domain name. The suffix of the domain name is a top-level domain (tld). For example, AUTH.AOL.COM is a FQDN, in which AUTH is its local host name; AOL.COM is its domain name; and .COM is a top-level domain. For another example, A0L.C0M.MCN.ORG is a FQDN, in which A0L.COM is its local host name; MCN.ORG is its domain name; and .ORG is a top-level domain.
Although the invention is described herein with reference to the preferred embodiment, one skilled in the art will readily appreciate that other applications may be substituted for those set forth herein without departing from the spirit and scope of the present invention.
Accordingly, the invention should only be limited by the Claims included below.
Claims
1. In a distributed network which is registered with a unique domain name, said network comprising a number of clients and a number of authentication servers, said clients and said authentication servers being communicatively coupled to each other via a global telecommunication network, each of said authentication servers having a fully qualified domain name which is a local host name with said unique domain name appended, a distributed authentication system, wherein a given user enters a global user identification (GUID) and a password for authentication to be carried out at a target authentication server, said GUID comprising a user name, a delimitation symbol, and a domain portion which is same as the local host name of said target authentication server, said distributed authentication system comprising:
means for parsing an entered GUID and extracting said domain portion therefrom;
means for appending said unique domain to said domain portion to form a fully qualified domain name (formed FQDN);
means for translating said FQDN to an Internet Protocol (IP) address representing said target authentication server;
means for sending said user name and password to said target authentication server for authentication; and
means for distributing and caching an authentication result.
2. The distributed authentication system of Claim 1 , further comprising:
means for automatically mapping any unrecognized FQDN into a default server which carries out authentication on the user's authentication request.
3. The distributed authentication system of Claim 1 , wherein said means for translating consults a domain name system (DNS) to obtain an Internet Protocol (IP) address representing said target authentication server.
4. The distributed authentication system of Claim 1 , wherein said means for translating consults a local mapping list to obtain an Internet Protocol (IP) address representing said target authentication server.
5. A method for providing distributed authentication service, wherein a given user enters a global user identification (GUID) and a password for authentication to be carried out at a target authentication server, said GUID comprising a user name, a delimitation symbol, and a domain portion which is same as the local host name of said target authentication server, said method comprising the computer- implemented steps of:
entering the user's GUID and password;
parsing said entered GUID and extracting said domain portion from said GUID;
appending a unique domain name to said domain portion to form a fully qualified domain name (FQDN);
looking up said FQDN in a domain name system (DNS) to obtain an address representing said target authentication server;
sending said user name and password to said target authentication server for authentication; and
distributing and caching an authentication result.
6. The method of Claim 5, further comprising the steps of:
5 if said step of looking up fails, automatically mapping an unrecognized FQDN into a default server which performs authentication on the user's authentication request.
7. In a distributed network which is registered with a unique domain name, said network comprising a number of clients and a number of authentication servers, said
L0 clients and said authentication servers being communicatively coupled to each other via a global telecommunications network, each of said authentication servers having a fully qualified domain name which is a local host name with said unique domain name appended, a method for providing distributed authentication service, wherein a given user enters a global user identification (GUID) and a password for
15 authentication to be carried out at a target authentication server, said GUID comprising a user name, a delimitation symbol and a domain portion which is same as the local host name of said target authentication server, said method comprising the steps of:
entering the user's GUID and password;
0 parsing entered GUID and extracting said domain portion from said GUID;
appending said unique domain name to said domain portion to form a fully qualified domain name (FQDN);
checking a local list of registered fully qualified domain names (FQDN) to obtain an Internet Protocol (IP) address for said target authentication server, wherein each FQDN in said local list is mapped to a unique IP address;
sending said user name and password to said target authentication server for authentication; and
distributing and caching an authentication result.
8. The method of Claim 7, further comprising the step of:
if said step of checking fails, automatically mapping an unrecognized FQDN into a default server which performs authentication on the user's authentication request.
9. In a distributed network which is registered with a unique domain name, said network comprising a number of clients and a number of authentication servers, said clients and said authentication servers being communicatively coupled to each other via a global telecommunications network, each of said authentication servers having a fully qualified domain name which is a local host name with said unique domain name appended, a method for providing distributed authentication service, wherein a given user enters a global user identification (GUID) and a password for authentication to be carried out at a target authentication server, said GUID comprising a user name, a delimitation symbol and a domain portion which is same as the local host name of said target authentication server, said method comprising the computer-implemented steps of:
entering the user's GUID and password;
parsing said GUID and extracting said domain portion;
appending said unique domain name to said domain portion to form a fully qualified domain name (FQDN) in said unique domain;
checking a local list of registered fully qualified domain names (RFQDN) to obtain an Internet Protocol (IP) address for said target authentication server, wherein each RFQDN in said local list is mapped to a unique IP address;
if said step of checking fails, looking up a domain name system (DNS) to obtain an Internet Protocol (IP) address representing said FQDN;
sending said user name and password to said target authentication server for authentication; and
distributing and caching an authentication result.
10. The method of Claim 9, further comprising the step of:
if said step of looking up fails, automatically mapping an unrecognized FQDN into a default server which performs authentication on the user's authentication request.
11. A method for providing distributed authentication sen ice, wherein a given user enters a global user identification (GUID) and a password for authentication to be carried out at a target authentication server, said GUID comprising a user name, a delimitation symbol and said target authentication server's domain name, said method comprising the steps of:
entering the user's GUID and password;
parsing said entered GUID and extracting said target authentication server's domain name;
pre-pending said common local host name to said target authentication server's domain name to form a fully qualified domain name (FQDN);
checking a local list of registered fully qualified domain names (RFQDN) to obtain an address for said target authentication server, wherein each RFQDN in said local is mapped to a unique address;
sending said user name and password to said target authentication server for authentication; and
distributing and caching an authentication result.
12. The method of Claim 11 , further comprising the step of:
if said step of checking fails, looking up said FQDN in a domain name system
(DNS) to obtain an address representing said target authentication server.
13. The method of Claim 12, further comprising the steps of:
if said step of looking up fails, automatically mapping an unrecognized FQDN into a default server which performs authentication on the user's authentication request.
14. In a distributed network comprising a number of clients and a number of authentication servers, said clients and said authentication servers being communicatively coupled to each other via a global telecommunications network, each of said authentication servers having a fully qualified domain name which is a local host name with its domain name appended, a method for providing distributed authentication service, wherein a given user enters a global user identification (GUID) and a password for authentication to be carried out at a target authentication
server, said GUID comprising a user name, a delimitation symbol and said target authentication server's domain name, said method comprising the steps of:
entering the user's GUID and password;
parsing said entered GUID and extracting said target authentication server's 5 domain name;
checking a local list of domain names to obtain an Internet Protocol (IP) address for said target authentication server, wherein each domain name in said list is mapped to a registered authentication server's IP address;
sending said user name and password to said target authentication server for L0 authentication;
distributing and caching an authentication result.
15. The method of Claim 14, further comprising the step of:
if said step of checking fails, automatically mapping an unrecognized domain name into a default server which performs authentication on the user's 15 authentication request.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| AU2003225534A AU2003225534A1 (en) | 2002-02-26 | 2003-01-29 | System and method for distributed authentication service |
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| US10/086,104 US7260836B2 (en) | 2002-02-26 | 2002-02-26 | System and method for distributed authentication service |
| US10/086,104 | 2002-02-26 |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| WO2003073687A1 true WO2003073687A1 (en) | 2003-09-04 |
Family
ID=27753792
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| PCT/US2003/002587 WO2003073687A1 (en) | 2002-02-26 | 2003-01-29 | System and method for distributed authentication service |
Country Status (3)
| Country | Link |
|---|---|
| US (1) | US7260836B2 (en) |
| AU (1) | AU2003225534A1 (en) |
| WO (1) | WO2003073687A1 (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2006122461A1 (en) * | 2005-05-16 | 2006-11-23 | Lenovo (Beijing) Limited | A method for implementing the unified authentication |
Families Citing this family (41)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2001063883A2 (en) | 2000-02-25 | 2001-08-30 | Telecommunication Systems, Inc. | Prepaid short messaging |
| US6839562B2 (en) | 2000-04-11 | 2005-01-04 | Telecommunication Systems, Inc. | Intelligent delivery agent for short message distribution center |
| US7519654B1 (en) | 2000-11-22 | 2009-04-14 | Telecommunication Systems, Inc. | Web gateway multi-carrier support |
| US7523310B2 (en) * | 2002-06-28 | 2009-04-21 | Microsoft Corporation | Domain-based trust models for rights management of content |
| JP4054637B2 (en) * | 2002-08-28 | 2008-02-27 | キヤノン株式会社 | Image processing system and authentication method thereof |
| US7206934B2 (en) * | 2002-09-26 | 2007-04-17 | Sun Microsystems, Inc. | Distributed indexing of identity information in a peer-to-peer network |
| JP3697437B2 (en) * | 2002-10-10 | 2005-09-21 | 株式会社東芝 | Network system and network system construction method |
| US7599938B1 (en) | 2003-07-11 | 2009-10-06 | Harrison Jr Shelton E | Social news gathering, prioritizing, tagging, searching, and syndication method |
| US20050188080A1 (en) * | 2004-02-24 | 2005-08-25 | Covelight Systems, Inc. | Methods, systems and computer program products for monitoring user access for a server application |
| US20050187934A1 (en) * | 2004-02-24 | 2005-08-25 | Covelight Systems, Inc. | Methods, systems and computer program products for geography and time monitoring of a server application user |
| US7373524B2 (en) * | 2004-02-24 | 2008-05-13 | Covelight Systems, Inc. | Methods, systems and computer program products for monitoring user behavior for a server application |
| US20050188222A1 (en) * | 2004-02-24 | 2005-08-25 | Covelight Systems, Inc. | Methods, systems and computer program products for monitoring user login activity for a server application |
| US8195205B2 (en) * | 2004-05-06 | 2012-06-05 | Telecommunication Systems, Inc. | Gateway application to support use of a single internet address domain for routing messages to multiple multimedia message service centers |
| US8312172B2 (en) * | 2005-05-26 | 2012-11-13 | Bytemobile, Inc. | Method and system for delta compression |
| US7925786B2 (en) * | 2005-09-16 | 2011-04-12 | Microsoft Corp. | Hosting of network-based services |
| US8234340B2 (en) * | 2005-09-16 | 2012-07-31 | Microsoft Corporation | Outsourcing of instant messaging hosting services |
| US7987251B2 (en) * | 2005-09-16 | 2011-07-26 | Microsoft Corporation | Validation of domain name control |
| US8244812B2 (en) * | 2005-09-16 | 2012-08-14 | Microsoft Corporation | Outsourcing of email hosting services |
| JP2009517723A (en) * | 2005-11-24 | 2009-04-30 | インターナショナル・ビジネス・マシーンズ・コーポレーション | Method for reliably accessing multiple systems of a distributed computer system by entering a password, distributed computer system and computer program for performing the method |
| US7730524B2 (en) * | 2006-02-01 | 2010-06-01 | Xerox Corporation | Dynamic collation of domain for user authentication on existing devices |
| US7992194B2 (en) * | 2006-03-14 | 2011-08-02 | International Business Machines Corporation | Methods and apparatus for identity and role management in communication networks |
| US8423479B2 (en) * | 2007-05-07 | 2013-04-16 | Yahoo! Inc. | Trusted third party clearing house for lead tracking |
| US20100036946A1 (en) * | 2007-07-13 | 2010-02-11 | Von Arx Kim | System and process for providing online services |
| US8255971B1 (en) | 2008-03-03 | 2012-08-28 | Jpmorgan Chase Bank, N.A. | Authentication system and method |
| US9246899B1 (en) | 2008-03-03 | 2016-01-26 | Jpmorgan Chase Bank, N.A. | Authentication and interaction tracking system and method |
| TW201015912A (en) * | 2008-10-01 | 2010-04-16 | Avermedia Tech Inc | Network communication method, dispatch server and server |
| US8151333B2 (en) | 2008-11-24 | 2012-04-03 | Microsoft Corporation | Distributed single sign on technologies including privacy protection and proactive updating |
| US8752152B2 (en) * | 2009-12-14 | 2014-06-10 | Microsoft Corporation | Federated authentication for mailbox replication |
| US8782748B2 (en) * | 2010-06-22 | 2014-07-15 | Microsoft Corporation | Online service access controls using scale out directory features |
| US9491164B1 (en) | 2013-08-21 | 2016-11-08 | NetSuite Inc. | System and method for importing heterogeneous hashed passwords |
| US9408047B2 (en) | 2013-10-10 | 2016-08-02 | Telecommunication Systems, Inc. | Read acknowledgement interoperability for text messaging and IP messaging |
| US9548982B1 (en) * | 2013-11-26 | 2017-01-17 | Mobile Iron, Inc. | Secure controlled access to authentication servers |
| WO2015100283A1 (en) * | 2013-12-23 | 2015-07-02 | Akamai Technologies, Inc. | Systems and methods for delivering content to clients that are suboptimally mapped |
| US9641503B2 (en) * | 2014-10-03 | 2017-05-02 | Amazon Technologies, Inc. | Using credentials stored in different directories to access a common endpoint |
| US10158632B2 (en) | 2016-01-20 | 2018-12-18 | Under Armour, Inc. | Methods and apparatus for account linking |
| CN109074327B (en) * | 2016-03-29 | 2022-02-15 | 株式会社理光 | Service providing system, service delivery system, service providing method, and program |
| WO2017170255A1 (en) * | 2016-03-29 | 2017-10-05 | 株式会社リコー | Service provision system, service exchange system, service provision method, and program |
| EP3438837A4 (en) | 2016-03-29 | 2019-03-20 | Ricoh Company Ltd. | Service provision system, service delivery system, service provision method, and program |
| EP3488590B1 (en) * | 2016-10-14 | 2022-01-12 | PerimeterX, Inc. | Securing ordered resource access |
| CN110022333B (en) * | 2018-01-09 | 2022-07-05 | 阿里巴巴集团控股有限公司 | Communication method and device of distributed system |
| US20230036680A1 (en) * | 2021-08-02 | 2023-02-02 | Zeronorth, Inc. | Application security posture identifier |
Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6298383B1 (en) * | 1999-01-04 | 2001-10-02 | Cisco Technology, Inc. | Integration of authentication authorization and accounting service and proxy service |
Family Cites Families (25)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7137006B1 (en) * | 1999-09-24 | 2006-11-14 | Citicorp Development Center, Inc. | Method and system for single sign-on user access to multiple web servers |
| US5781724A (en) * | 1996-11-01 | 1998-07-14 | Novell, Inc. | Method and system for integrating additional functionality into a login system |
| US6324267B1 (en) | 1997-01-17 | 2001-11-27 | Scientific-Atlanta, Inc. | Two-tiered authorization and authentication for a cable data delivery system |
| US6157636A (en) * | 1997-03-06 | 2000-12-05 | Bell Atlantic Network Services, Inc. | Network session management with gateway-directory services and authorization control |
| US6289010B1 (en) * | 1997-03-11 | 2001-09-11 | Bell Atlantic Network Services, Inc. | Inbound gateway authorization processing for inter-carrier internet telephony |
| US5867665A (en) * | 1997-03-24 | 1999-02-02 | Pfn, Inc | Domain communications server |
| US5870562A (en) * | 1997-03-24 | 1999-02-09 | Pfn, Inc. | Universal domain routing and publication control system |
| US6026430A (en) * | 1997-03-24 | 2000-02-15 | Butman; Ronald A. | Dynamic client registry apparatus and method |
| US6233234B1 (en) * | 1997-06-03 | 2001-05-15 | Bell Atlantic Network Services, Inc. | Secure LAN/internet telephony |
| FI972725A (en) * | 1997-06-24 | 1998-12-25 | Nokia Telecommunications Oy | re-routing |
| US6108330A (en) * | 1997-09-26 | 2000-08-22 | 3Com Corporation | Apparatus and methods for use therein for an ISDN LAN modem that selects among a plurality of DNS servers for responding to a DNS query |
| US6023724A (en) * | 1997-09-26 | 2000-02-08 | 3Com Corporation | Apparatus and methods for use therein for an ISDN LAN modem that displays fault information to local hosts through interception of host DNS request messages |
| US5974453A (en) * | 1997-10-08 | 1999-10-26 | Intel Corporation | Method and apparatus for translating a static identifier including a telephone number into a dynamically assigned network address |
| US6144657A (en) * | 1997-11-06 | 2000-11-07 | Sun Microsystems, Inc. | Remote device connection to a network |
| US6185598B1 (en) * | 1998-02-10 | 2001-02-06 | Digital Island, Inc. | Optimized network resource location |
| JP3641128B2 (en) | 1998-02-20 | 2005-04-20 | 株式会社東芝 | MOBILE COMPUTER DEVICE, MOBILE COMPUTER MANAGEMENT DEVICE, MOBILE COMPUTER MANAGEMENT METHOD, AND COMMUNICATION CONTROL METHOD |
| DE69838541T2 (en) | 1998-03-04 | 2008-07-03 | Sony Deutschland Gmbh | Connecting between remote units using Hypertext Transfer Protocol |
| US6178511B1 (en) * | 1998-04-30 | 2001-01-23 | International Business Machines Corporation | Coordinating user target logons in a single sign-on (SSO) environment |
| US6275944B1 (en) * | 1998-04-30 | 2001-08-14 | International Business Machines Corporation | Method and system for single sign on using configuration directives with respect to target types |
| US6108703A (en) * | 1998-07-14 | 2000-08-22 | Massachusetts Institute Of Technology | Global hosting system |
| US6421768B1 (en) * | 1999-05-04 | 2002-07-16 | First Data Corporation | Method and system for authentication and single sign on using cryptographically assured cookies in a distributed computer environment |
| US6247523B1 (en) * | 1999-07-30 | 2001-06-19 | Denso Corporation | Exhaust gas heat exchanger |
| EP1089516B1 (en) | 1999-09-24 | 2006-11-08 | Citicorp Development Center, Inc. | Method and system for single sign-on user access to multiple web servers |
| US6289039B1 (en) * | 2000-06-14 | 2001-09-11 | Linex Technologies, Inc. | Spread-spectrum communications utilizing variable throughput reduction |
| US6826698B1 (en) * | 2000-09-15 | 2004-11-30 | Networks Associates Technology, Inc. | System, method and computer program product for rule based network security policies |
-
2002
- 2002-02-26 US US10/086,104 patent/US7260836B2/en active Active
-
2003
- 2003-01-29 AU AU2003225534A patent/AU2003225534A1/en not_active Abandoned
- 2003-01-29 WO PCT/US2003/002587 patent/WO2003073687A1/en not_active Application Discontinuation
Patent Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6298383B1 (en) * | 1999-01-04 | 2001-10-02 | Cisco Technology, Inc. | Integration of authentication authorization and accounting service and proxy service |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2006122461A1 (en) * | 2005-05-16 | 2006-11-23 | Lenovo (Beijing) Limited | A method for implementing the unified authentication |
| US8776201B2 (en) | 2005-05-16 | 2014-07-08 | Lenovo (Beijing) Limited | Method for implementing unified authentication |
Also Published As
| Publication number | Publication date |
|---|---|
| AU2003225534A1 (en) | 2003-09-09 |
| US20030163730A1 (en) | 2003-08-28 |
| US7260836B2 (en) | 2007-08-21 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US7260836B2 (en) | System and method for distributed authentication service | |
| US10104058B2 (en) | Content restriction compliance using reverse DNS lookup | |
| US7765584B2 (en) | Simple, secure login with multiple authentication providers | |
| US8751586B2 (en) | Domain name control based social website account authentication | |
| EP1402390B1 (en) | Method and system for providing static addresses for internet connected devices even if the underlying address is dynamic | |
| US20040003287A1 (en) | Method for authenticating kerberos users from common web browsers | |
| US20110055562A1 (en) | Public key certificate based social website account authentication | |
| US20110055911A1 (en) | Business validation based social website account authentication | |
| US8244812B2 (en) | Outsourcing of email hosting services | |
| US20110055249A1 (en) | Social website account authentication via search engine based domain name control validation | |
| EP3248364B1 (en) | Network identification as a service | |
| CN108702396B (en) | Method and device for data processing | |
| US20110055248A1 (en) | Search engine based domain name control validation | |
| US20020174363A1 (en) | Method and apparatus for providing an anonymous identity for a user | |
| US10848479B2 (en) | Enabling encrypted communications between a user and a third party hosting service via a proxy server | |
| US8234340B2 (en) | Outsourcing of instant messaging hosting services | |
| US9894057B2 (en) | Method and system for managing secure custom domains | |
| US20190296984A1 (en) | Displaying a suggested domain name by hovering over a domain name already registered to a registrant | |
| US20160087937A1 (en) | Validating control of domain zone | |
| US9906503B1 (en) | Notifying a registrant if communications between a user and a third party hosting service are not secure | |
| US20190379637A1 (en) | Method for a gaining registrar to transfering a domain name from a losing registrar to the gaining registrar | |
| US10291612B2 (en) | Bi-directional authentication between a media repository and a hosting provider | |
| US10541968B2 (en) | Generating, displaying and registering a suggested domain name derived from a domain name already registered to a registrant | |
| US10581799B2 (en) | Method for a losing registrar to transfer a domain name from the losing registrar to a gaining registrar | |
| US10148729B2 (en) | Hosting provider hosting routes from a media repository |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| AK | Designated states |
Kind code of ref document: A1 Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BY BZ CA CH CN CO CR CU CZ DE DK DM DZ EC EE ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX MZ NO NZ OM PH PL PT RO RU SD SE SG SK SL TJ TM TN TR TT TZ UA UG UZ VN YU ZA ZM ZW |
|
| AL | Designated countries for regional patents |
Kind code of ref document: A1 Designated state(s): GH GM KE LS MW MZ SD SL SZ TZ UG ZM ZW AM AZ BY KG KZ MD RU TJ TM AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IT LU MC NL PT SE SI SK TR BF BJ CF CG CI CM GA GN GQ GW ML MR NE SN TD TG |
|
| 121 | Ep: the epo has been informed by wipo that ep was designated in this application | ||
| 122 | Ep: pct application non-entry in european phase | ||
| NENP | Non-entry into the national phase |
Ref country code: JP |
|
| WWW | Wipo information: withdrawn in national office |
Country of ref document: JP |