Patent Application
20080320574
The invention relates generally to computer systems, and more specifically to authentication and access control.
Before allowing a person to access a sensitive computer system or application (and the data it manages), it is well known and common for the computer system or application to authenticate the person and if the person is authentic, check whether the person is authorized to access the computer system or application. Typically, authentication is based on a valid combination of User ID and password provided by the person. Typically, authorization is based on an Access Control List maintained by the computer system or application. The Access Control List lists the User IDs which are authorized to access the computer system or application (and the data it manages).
Different applications and files within a computer system may require different “levels” of access. The highest level of access to the most sensitive applications and files is typically called “root” access (or administrator access). Typically, root access is reserved for administrators, and allows the administrators to execute the most sensitive applications and change the most sensitive files. Examples of applications that typically require root access are mount, passwd. Examples of files that typically require root access are /etc/passwd, /etc/group, /etc/shadow. Users typically have the lowest level of access, called “user” access, and this allows the user to use less sensitive applications and access less sensitive files. In some cases, root access is required to change a file, such as a /etc/fs or /etc/passwd configuration file, but user access is sufficient to read the same file.
Some Ds and passwords are created and used by respective individuals. Other Ds and passwords are assigned to and used by a group of people. Most security policies require that passwords be changed periodically, such as every six months. This limits unauthorized exposure of the sensitive application or file if a hacker learns a valid combination of User ID and password of an authorized person or group. In the case of individual User IDs and individual passwords associated with respective individuals, the user changes his or her password periodically as required by the security policy. In the case of a “group” User ID and password, it is common for one person in the group to periodically change the password, according to the security policy.
It was known to allow a person to obtain a new password for a system or application before expiration of the current password by the person entering the person's current password.
It was known to allow a person to obtain a new password for a system or application after expiration of the current password by the person entering the person's expired password.
It was known to allow a person to obtain a new password after expiration of the current password by the person entering a User ID and the authentication system sending the new, system generated password to an e-mail address previously registered for the User ID. Next, the person can enter the system-generated password along with a new person-generated password to substitute the person-generated password for the system-generated password.
Often, the person forgets the person's current or expired password. In such a case, it was known to allow such a person to reset the person's current or expired password by a challenge/response process. In this process, an authentication program poses a series of challenges or questions to the person, such as requests for the person's mother's maiden name, the name of the street where the person grew up, etc., in addition to the person's User ID. (The person provided the answers to the challenges or questions upon original registration.) If the person answers the questions properly, then the system allows the person to obtain a new password for the current User ID. A typical challenge/response process to obtain a new password is not as secure as requiring the current or expired password to obtain a new password. This is because the typical challenges/responses, while not widely known, are not secret and are not protected as secrets.
As explained above, in the case of a group User ID and group password, typically one person in the group (a “super administrator”) changes the group password periodically (by furnishing the current or expired password for authentication) as required by the security policy. For a large computer system with a large number of computers, applications and files, there may be a large number of administrators (up to one hundred), each requiring root access. In such a case, each time the group password is changed, the person who changed the group password sends the group password electronically (such as by e-mail) to each administrator, and each administrator typically makes a record of the new password. There have been difficulties in ensuring that each administrator (a) receives the new group password, and (b) if received, retains a copy of the password in a secure manner.
An object of the present invention is to better control distribution of group passwords to authorized users.
The present invention resides in a system, method and program for managing a production server. An authentication server sends to the production server via a network a group password for a GroupID to access a file in the production server. A user at a workstation sends via a network to the authentication server an individual UserID and corresponding individual password for the user and a request for the group password for the GroupID to access a file in the production server protected by the group password. In response, the authentication server authenticates the individual UserID with the corresponding individual password and returns to the workstation the group password for the GroupID. After receiving the group password from the authentication server, the user at the workstation sends via a network to the production server the group password and GroupID and a request to access the file in the production server protected by the group password. In response, the production server authenticates the GroupID with the group password and grants the user access to the file.
The present invention will now be described in detail with reference to the figures.
Distributed computer system 10 also includes a multiplicity of similar production servers (or other computers) 40a,b,c,d. Production servers 40a,b,c,d include respective CPUs, operating systems, RAM, ROM on common buses and storage such as CPU 41a, operating system 42a, RAM 43a, and ROM 44a on common buses 45a and storage 46a in production servers 40a,b,c,d. Each of the production servers includes one or more sensitive application or data files such as file 48a. Each of the production servers 40a,b,c,d includes a respective, known authentication and authorization program such as program 141a in production server 40a, a table such as table 39a in production server 40a of valid combinations of Group IDs and corresponding group passwords, and an access control list such as access control list 49a in production server 40a of identities of files and authorizations by GroupID to access the corresponding file. In addition, authentication and authorization program 141a (and the corresponding authentication and authorization programs in production servers 40b,c,d) periodically requests from authentication server 20 the current GroupID for each protected file such as file 48a. Alternately, authentication server 20 initiates sending of updates to the GroupID for each file, whenever the GroupID is changed at the authentication server 20.
Authentication server 20 also includes password management program 30, according to the present invention, to periodically generate a new, valid group password for a corresponding Group ID and provide the group password to production servers (or other computers) 40a,b,c,d for group access to respective sensitive files in the production servers such as file 48a in production server 40a. Password management program 30 can periodically generate the new password automatically or periodically prompt an authorized user (such as an administrator or network security compliance officer) to enter a new group password. Server 20 includes a table 33 which includes a record of one or more challenges and corresponding correct responses for each User ID. Typically, the challenge and correct response for each individual User ID is a request for the individual password and the corresponding individual password. After successfully providing the correct individual password for the UserID from a user workstation 50a,b,c,d, password management program 30 can provide to the individual user at the user workstation 50a,b,c,d, the new valid group password, assuming the UserID is authorized. With this new, valid group password (and knowledge of the Group ID), the individual user from workstation 50a,b,c,d can log-on, i.e. be authenticated to, the production servers 40a,b,c,d to access the respective sensitive files in production servers 40a,b,c,d.
Distributed computer system 10 also includes a multiplicity of the user workstations 50a,b,c,d through which respective users such as user 59a of workstation 50a (such as administrators for the production servers 50a,b,c,d) initially request access to authentication server 20 (to obtain the current group password for the production servers 50a,b,c,d). User workstations 50a,b,c,d include respective CPUs, operating systems, RAM, ROM on common buses and storage such as CPU 51a, operating system 52a, RAM 53a, and ROM 54a on common buses 55a and storage 56a in workstation 50a. User workstations 50a,b,c,d also include respective password request program such as password request program 58a in workstation 50a according to the present invention by which the respective administrator requests a new root access or other group password based on the user's current (individual) User ID and corresponding individual password.
Authentication server 20, production servers 40a,b,c,d and user workstations 50a,b,c,d are all interconnected by a network 60 such as the Internet, wide area network, local area network, etc.
However, if the group password is not valid for the GroupID (decision 150, no branch) or the GroupID is not authorized to access the sensitive file 48a (decision 154, no branch), then program 141a does not grant the user access to the requested file (step 162).
Referring again to decision 120, no branch where the user is not authorized to receive the group password, then password management program 30 does not return the group password to the user (step 121).
With the foregoing system and process, each administrator/user can acquire the current group password when needed, and need not to keep a tangible copy of the group password.
Program 30 can be loaded into authentication server from a computer readable media 232 such as magnetic tape or disk, optical media, DVD, memory stick, etc. or downloaded from the network 60 via TCP/IP adapter card 230.
Program 141a can be loaded into production server 40a from a computer readable media 432a such as magnetic tape or disk, optical media, DVD, memory stick, etc. or downloaded from the network 60 via TCP/IP adapter card 430a.
Program 58a can be loaded into respective user workstation 50a from a computer readable media 532a such as magnetic tape or disk, optical media, DVD, memory stick, etc. or downloaded from the network 60 via TCP/IP adapter card 530a.
Based on the foregoing, a system, method and program product for authentication and access control have been disclosed. However, numerous modifications and substitutions can be made without deviating from the scope of the present invention. Therefore, the present invention has been disclosed by way of illustration and not limitation, and reference should be made to the following claims to determine the scope of the present invention.
