Patent Application
20090183255
Generally, the present invention relates to computing environments involving accessing client workstations, especially by way of various strong authentication schemes, e.g., smart card, one-time passwords, fingerprint, DNA, retina scan, etc. Particularly, it relates to accessing client workstations with strong authentication while disconnected from network appliances, e.g., servers. Features of the invention include replicating server-based functionality on the client according to a particular authentication protocol to enable local client login according to the same authentication protocol but without any communication with the server. Other features contemplate computer program products, computing network systems, specific authentication protocols, and retrofit technology, to name a few.
Many authentication systems, such as Novell, Inc.'s Modular Authentication Service (NMAS), provide varying levels of strong authentication. NMAS, for instance, can authenticate users using biometrics (e.g., fingerprint, retina scan, etc.), tokens (one-time passwords, smart cards), and passwords. Security sensitive applications or resources, such as corporate financial information, personal and personnel information, military secrets, nuclear technology, banking activity, securities trading, health/patient records, etc., use these authentication services to prevent unauthorized users from gaining access. Third parties “plug” NMAS into their computing environment and write a Login Client Method (LCM), for a client workstation, and a Login Server Method (LSM), for a server. The LCM is methodology largely responsible for collecting authentication credentials from users at their workstation, e.g., receiving one-time passwords, receiving fingerprint data from a scanner, etc., while the LSM is methodology largely responsible for verifying the credentials.
The LCM and LSM communicate using proprietary NMAS API calls. These API calls take data provided by the caller, package it into MAF API packets, and send it over a network between the client workstation and server. The format of the data is not specified by NMAS, but is left to the discretion of the LCM/LSM developer. Login secrets (e.g., how one-time passwords are calculated, scanned fingerprint data for users, etc.) are stored for the server with the assistance of a computing product, such as Novell's eDirectory or Microsoft's Active Directory, and may be accessed from the LSM using NMAS API calls for storing and retrieving secrets.
However, it presently exists that NMAS or other products do not contemplate client-server disconnected scenarios. For example, when users travel with their laptops, they do not always have access to network resources, e.g., when sitting in an airport. Corporate policy or user preference, however, may still dictate logging-in with strong authentication despite not having network access. In this context, server-based solutions fail to provide client-only or disconnected login.
In other computing products, portions of an entire tree are replicated to a local eDirectory instance, for use by a remote office to prevent each user login from having to utilize a WAN, or other network. Such products, however, only replicate a hard-coded set of attributes intended for instances of static password authentications (i.e., LDAP simple binds). It affords no utility to strong authentication protocols, such as most of those found with the fifty-plus existing NMAS methods or other strong, multi-factor authentication frameworks, such as LDAP/SASL or OpenLDAP/SLAPD.
Accordingly, a need exists in the art of strong authentication to allow users to login while disconnected from network services. The need further extends to logging-in under a wide variety of possible authentication protocols. In that many computing configurations already have strong authentication services, it is further desirable to leverage existing configurations by way of retrofit technology, thereby avoiding the costs of providing wholly new products. Taking advantage of existing frameworks, such as NMAS, is another feature that optimizes existing resources. Any improvements along such lines should further contemplate good engineering practices, such as relative inexpensiveness, stability, ease of implementation, high security, low complexity, flexibility, etc.
The foregoing and other problems become solved by applying the principles and teachings associated with the hereinafter-described server services on client for disconnected authentication. At a high level, methods and apparatus teach accessing client workstations with one or more strong authentication protocols while disconnected from network appliances, e.g., servers. Server-based functionality is replicated on the client when the two are in communication to enable later local client login according to a particular strong authentication protocol when the two are no longer in communication.
In a representative embodiment, users execute a connected login sequence between the client and the server according to one of many strong authentication protocols. During such time, information on the server necessary for a successful execution of the strong authentication protocol is determined and provided to the client where it is stored in a local instance. Users thereafter disconnect from the server and login locally on the client. Login information (e.g., one-time password, fingerprint, retina scan, etc.), locally provided, is verified against the information of the server earlier-provided to the client. In this manner, users can be authenticated with a strong protocol, beyond mere password information. They can be strongly authenticated when logging-in to a laptop computing device, for example, when in a location not able to connect to a network appliance, such as a server.
As an example, if users login at their workstation with a fingerprint that gets scanned and sent to a server for authentication, the received fingerprint is compared to a stored fingerprint for the user. If the two are the same, login is successful. If not, login is prevented. In turn, the workstation (when not connected to the server) requires an instance of the stored fingerprint for comparison to the scanned fingerprint, to which, the stored fingerprint is replicated on the workstation. Naturally, information needing to be replicated on the client workstation will vary according to the authentication method selected.
In the context of an NMAS/eDirectory computing arrangement, or other strong, multi-factor authentication frameworks, such as LDAP/SASL and PAM, the information or set of data that is replicated depends on the data accessed by the Login Server Method (LSM). It is learned on the go, at the server, as the LSM makes calls to the NMAS API, thus making foreknowledge of the actual strong authentication protocol at the client workstation irrelevant. In turn, what is learned is then forwarded to the client and stored for later disconnected login.
In a computing system embodiment, the invention may be practiced with: a client workstation; and a server all arranged as part of the pluralities of physical or virtual computing devices, including executable instructions for undertaking the foregoing methodology. Computer program products are also disclosed and are available as a download or on a computer readable medium. The computer program products are also available for installation on a network appliance, such as a server, or as retrofit technology with a strong authentication service, such as Novell, Inc.'s NMAS, with other strong, multi-factor authentication frameworks, such as LDAP/SASL with/without PAM, OpenLDAP/SLAPD, or elsewhere.
In still other embodiments, computing networks and party interaction are discussed, as are possible strong authentication schemes, e.g., smart card, one-time passwords, fingerprint, DNA, retina scan, etc.
These and other embodiments of the present invention will be set forth in the description which follows, and in part will become apparent to those of ordinary skill in the art by reference to the following description of the invention and referenced drawings or by practice of the invention. The claims, however, indicate the particularities of the invention.
The accompanying drawings incorporated in and forming a part of the specification, illustrate several aspects of the present invention, and together with the description serve to explain the principles of the invention. In the drawings:
In the following detailed description of the illustrated embodiments, reference is made to the accompanying drawings that form a part hereof, and in which is shown by way of illustration, specific embodiments in which the invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the invention and like numerals represent like details in the various figures. Also, it is to be understood that other embodiments may be utilized and that process, mechanical, electrical, arrangement, software and/or other changes may be made without departing from the scope of the present invention. In accordance with the present invention, methods and apparatus for server services on a client for disconnected login are hereinafter described.
With reference to
In either, storage devices are contemplated and may be remote or local. While the line is not well defined, local storage generally has a relatively quick access time and is used to store frequently accessed data, while remote storage has a much longer access time and is used to store data that is accessed less frequently. The capacity of remote storage is also typically an order of magnitude larger than the capacity of local storage. Regardless, storage is representatively provided for aspects of the invention contemplative of computer executable instructions, e.g., software, as part of computer program products on readable media, e.g., disk 14 for insertion in a drive of computer 17. Computer executable instructions may also be available for installation as a download or reside in hardware, firmware or combinations in any or all of the depicted devices 15 or 15′.
When described in the context of computer program products, it is denoted that items thereof, such as modules, routines, programs, objects, components, data structures, etc., perform particular tasks or implement particular abstract data types within various structures of the computing system which cause a certain function or group of functions. In form, the computer product can be a download of executable instructions resident with a downstream computing device, or readable media, received from an upstream computing device or readable media, a download of executable instructions resident on an upstream computing device, or readable media, awaiting transfer to a downstream computing device or readable media, or any available media, such as RAM, ROM, EEPROM, CD-ROM, DVD, or other optical disk storage devices, magnetic disk storage devices, floppy disks, or any other physical medium which can be used to store the items thereof and which can be assessed in the environment.
In network, the computing devices communicate with one another via wired, wireless or combined connections 12 that are either direct 12a or indirect 12b. If direct, they typify connections within physical or network proximity (e.g., intranet). If indirect, they typify connections such as those found with the internet, satellites, radio transmissions, or the like, and are given nebulously as element 13. In this regard, other contemplated items include servers, routers, peer devices, modems, T# lines, satellites, microwave relays or the like. The connections may also be local area networks (LAN) and/or wide area networks (WAN) that are presented by way of example and not limitation. The topology is also any of a variety, such as ring, star, bridged, cascaded, meshed, or other known or hereinafter invented arrangement.
With the foregoing representative computing environment as backdrop,
As a representative example, if users login at their workstation with an employee bar code that gets scanned and sent to a server for authentication, the received bar code is compared to a stored bar code value for the user. If the two are the same, login between the server and client workstation is successful. If not, login is unsuccessful, including perhaps limiting or preventing total workstation functionality. In turn, the workstation (when not connected to the server) requires an instance of the stored bar code value of the server for comparison to the scanned bar code, to which, the stored bar code value is replicated on the client workstation when the server and client are in communication. Thereafter, users disconnect from the server and login locally on the client by scanning their employee bar code. The scanned login information (e.g., bar code) is verified against the bar code value information of the server earlier replicated. If the two are the same (scanned bar code is the same as the replicated bar code value), disconnected login of the client is successful. Otherwise, login is unsuccessful and, as before, whole or partial computing functionality of the client may be prevented. As will be seen below, information needing to be replicated on the client workstation varies according to the authentication method selected.
With reference to
With NMAS, third parties “plug” the computing program product into their computing environment 10 and write/provide a Login Client Method (LCM) 50 for a client workstation 52 and a Login Server Method (LSM) 54 for a server 56, as is known. In general, the LCM is methodology largely responsible for collecting authentication credentials (user input information 60) from users at their workstation, e.g., receiving one-time passwords, receiving fingerprint data from a scanner, receiving an employee bar code, etc., while the LSM is methodology largely responsible for verifying the credentials per a user, a workgroup, or other arrangement.
Also, NMAS may be outfitted with various schemes providing varying levels of strong authentication. In one instance, the authentication schemes relate to user-fixed characteristics such as biometrics in the form of fingerprints, retina scans, DNA, etc. In another, they relate to electronic structures, such as smart cards, microchips, magnetic stripes, etc. In still another, they are user-created, such as passwords, secrets, usernames, PINS, or other credentials. Regardless of form, they are referred to generically herein as protocols, schemes, etc. and users log-in from their workstation, including navigation with apparatus such as card readers, retina or fingerprint scanners, password forms, keypads, etc., as is typical. (In certain embodiments, the workstation may be simply a computing device in the form of a card reader, retina or fingerprint scanner, password form, keypad, etc., such as 15′ in
When the client workstation and server are in communication, such as during execution of connected login (step 102,
For instance,
In actually assessing the information or data stored for disconnected login, it is determined what exact NMAS API calls were executed during the connected login. The data accessed by these API calls is then the data that is sent 80a, 80b to the client workstation. This ensures that the secrets stored for disconnected login are only those that are required to perform the requested authentication, and no more.
With reference to
1) The user initiates Client32 NCP login on the client workstation 52 using the Vasco Digipass login method.
2) The NMAS Client invokes the Vasco Digipass LCM 50, which prompts the user for the token code. The user enters the token code and the token code is sent to the LSM 54.
3) The LSM 54 receives the token code. To verify the token code, the LSM must look up the token that is assigned to the user. For the Vasco method, the token is a separate object in eDirectory 70 that is linked to the user using an attribute called vascoAssignedTokenDN. The Digipass LSM calls NMAS API 64 to read the vascoAssignedTokenDN attribute from the user, step 120. NMAS reads the attribute from the user in eDirectory 70 and returns the results to Vasco LSM 54. NMAS also stores the results of the read operation in a disconnected login cache associated with the login session, step 122.
4) The LSM 54 calls (step 120) NMAS_GetLoginSecret to read the token seed from the token object in eDirectory 70. Again, NMAS caches the results of the operation, step 122.
5) The LSM 54 validates the token code provided by the user. Login is successful. Otherwise, if the token code is invalid, login is unsuccessful and certain or all functionality of the client workstation is prevented.
6) Before closing the login session, NMAS checks to see if the disconnected login service is executing or running on the client, step 124. If it is, NMAS sends 80a the results of the read operations performed in steps 3) and 4) to the disconnected login service 71, step 128. The disconnected login service stores this data on a user object in a local instance of eDirectory 70′, step 130. On the other hand, if the disconnected login service is not executing on the client, the results, e.g., secrets, are delayed until some later time, step 126.
7) The user leaves the office with his laptop. The next time he tries to log in, he is at the airport and has no network access. The user checks the “Workstation Only” box in Client32, and attempts to log in. Because the user has installed the NMAS disconnected login service 71, the disconnected login service is invoked instead of Windows login.
8) The NMAS Client 64 invokes the Vasco LCM 50, which prompts the user for the token code.
9) The token code is sent to the disconnected login service 73, which invokes the local Vasco LSM 54′. The Vasco LSM is able to read the same data as in step 3, because it was stored in the local instance of eDirectory 70′ in step 6).
10) Authentication is complete and the disconnected login is successful, step 132. The disconnected login service reads the user's Windows password locally from Secret Store. (The password was synchronized in step 6).)
With reference to
With reference to
In any embodiment, certain advantages and benefits over the prior art should be readily apparent. For example, methods and apparatus teach an arrangement of computing devices whereby accessing client workstations with one or more strong authentication protocols is possible while disconnected from network appliances, e.g., servers. Server-based functionality is replicated on the client when the two are in communication to enable later local client login according to a particular strong authentication protocol when the two are no longer in communication. Advantages of the disconnected login include, but are not limited to: 1) avoiding communication over a network, such as a WAN; 2) avoiding strict adherence to providing only a hard-coded set of attributes; 3) allowing strong authentication in geographic locations not earlier able to provide strong authentication; and 4) leveraging existing configurations, such as NMAS, by way of retrofit technology, thereby avoiding the costs associated with providing wholly new products.
Still other advantages exist in the form of authentication schemes and party interaction as well as computer program products, computing networks and computing devices, to name a few. Also, features of the invention make it possible to use existing login methods, without modification, for disconnected login. That is, the set of data synchronized to a client workstation is dynamic. To the extent a third party's desired strong authentication protocol is that of using fingerprints (compared to stored fingerprints) to login, the login need not change, but be merely replicated as necessary information (e.g., the stored fingerprint (secret)) on the client. The invention extends further to solving a non-network-available problem in a general way that can be applied to any multi-factor authentication framework, e.g., PAM with LDAP/SASL. Naturally, skilled artisans will be able to contemplate others.
One of ordinary skill in the art will recognize that additional embodiments are also possible without departing from the teachings of the present invention. This detailed description, and particularly the specific details of the exemplary embodiments disclosed herein, is given primarily for clarity of understanding, and no unnecessary limitations are to be implied, for modifications will become evident to those skilled in the art upon reading this disclosure and may be made without departing from the spirit or scope of the invention. Relatively apparent modifications, of course, include combining the various features of one or more figures with the features of one or more of other figures.
