Method and apparatus for accessing computers in a distributed computing environment

This application is related to subject matter disclosed in commonly assigned U.S. patent application Ser. No. 10/323,585, filed on Dec. 19, 2002. The aforementioned related patent application is herein incorporated by reference.

1. Field of the Invention

Embodiments of the present invention generally relate to securing a distributed computing environment and, more specifically, to a method and apparatus for accessing computers in the distributed computing environment.

2. Description of the Related Art

Computer security issues have become more complex with the continual evolution of contemporary computer systems. As corporations utilize increasingly distributed and open computing environments, the security requirements of an enterprise typically grow accordingly. The complexity of employee, customer and partner access to critical information assets, while assuring proper security, has proven to be a major hurdle. For example, many organizations deploy network applications that allow their external business partners, as well as their own internal employees, to access sensitive information resources within the enterprise. In the absence of adequate security measures, an enterprise may be subject to the risk of decreased security and confidentiality.

In today's complex business environment, specifying, stating, implementing and managing an enterprise access control policy may be both difficult and inefficient. When corporate data and applications revolved around a mainframe model, the problem of defining and managing access to corporate applications was relatively straightforward. Today, the complexity of distributed application architectures, may force companies to resort to manual, ineffective or highly custom approaches to access control in their attempts to implement security procedures.

A distributed computer system is usually secured by employing a combination of encryption, authentication, and authorization technologies. Encryption is a means of sending information between participants in a manner that prevents other parties from reading the information. Authentication is a process of verifying a party's identity. Authorization is a technique for determining what actions a participant is allowed to perform.

The security approach of most companies today is to focus on the authentication of users to ensure that those users are part of the organization or a member of a select group. Authentication can be accomplished with a number of different approaches, from simple password or challenge response mechanisms to smart cards and biometric devices such as a fingerprint reader. Once users are authenticated, however, there is still a significant problem in managing and enforcing their set of privileges, which may be unique and vary widely between users. The same authentication mechanism can be used for every user, but different authorization mechanisms must be developed for most applications. Therefore, reliable and efficient access control is a difficult problem facing enterprises today.

Authentication mechanisms often work together with some sort of access control facility that can protect information resources from unauthorized users. Examples of network security products include firewalls, digital certificates, virtual private networks, and single sign-on systems. Some of these products provide limited support for resource-level authorization. For example, a firewall can screen access requests to an application or a database, but does not provide object-level authorization within an application or database. Single Sign-On (SSO) products, for example, maintain a list of resources an authenticated user can access by managing the login process to many different applications.

A Single Sign-On application allows an end user to log into multiple applications with one set of credentials and simplifies password management for an enterprise. Single Sign-On applications allow a user to create a remote session and sign on and access resources located on a remote computer. However, there is a possibility the user will fail to sign out or logout of the remote computer upon terminating the remote session. Failure to sign out from the remote computer compromises security and increases the likelihood of unauthorized access to information stored on the remote computer.

Thus, there is a need in the art for a method and apparatus that ensures a user is signed out from each and every remote computer in a distributed computing environment to protect against unauthorized access to information stored on the computer.

The present invention is a method and apparatus for single sign-out from one or more application servers in a distributed computing environment. Within a single sign-on system, a user logs into a first application server, and is able to access at least one other application server (i.e., a second application server) via the first application server without performing an additional login. The user is able to sign-out from all the application servers to which the user is connected via the first application server by signing out of any one of the application servers. The single sign out procedure ensures the user does not inadvertently remain signed into other application servers without requiring the user to explicitly sign out of each logged in application server.

So that the manner in which the above recited features of the present invention can be understood in detail, a more particular description of the invention, briefly summarized above, may be had by reference to embodiments, some of which are illustrated in the appended drawings. It is to be noted, however, that the appended drawings illustrate only typical embodiments of this invention and are therefore not to be considered limiting of its scope, for the invention may admit to other equally effective embodiments.

FIG. 1 is a block diagram of a distributed computing environment which utilizes one embodiment of the present invention;

FIG. 2 is a block diagram of an application server;

FIG. 3 is a flow diagram of a first method for Single Sign-On to a remote computer;

FIG. 4 is a flow diagram of a second method for Single Sign-On to a remote computer; and

FIG. 5 is a flow diagram of a method for Single Sign-Out that utilizes an embodiment of the present invention.

While the invention is described herein by way of example using several embodiments and illustrative drawings, those skilled in the art will recognize that the invention is not limited to the embodiments of drawing or drawings described. It should be understood that the drawings and detailed description thereto are not intended to limit the invention to the particular form disclosed, but on the contrary, the invention is to cover all modification, equivalents and alternatives falling within the spirit and scope of the present invention as defined by the appended claims. The headings used herein are for organizational purposes only and are not meant to be used to limit the scope of the description or the claims. As used throughout this application, the word “may” is used in a permissive sense (i.e., meaning having the potential to), rather than the mandatory sense (i.e., meaning must). Similarly, the words “include,” “including,” and “includes” mean including, but not limited to.

The present invention is a method and apparatus for single sign-out from one or more application servers in a distributed computing environment. Single sign-out ensures the user does not inadvertently remain logged into one/many application servers without requiring the user to explicitly sign out of each logged in application server.

FIG. 1 is a block diagram of a distributed computing environment 100 that utilizes one embodiment of the present invention. The distributed computing environment 100 comprises at least one client computer 101 , application servers 102 1 to 102 n (collectively referred to as application servers 102 ), a communications network 110 , at least one backend server 104 1 , 104 2 (collectively referred to as backend servers 104 ), and a root broker 106 .

The at least one client computer 101 is coupled to the application servers 102 via the communications network 110 . For simplicity, only one client 101 is shown, however multiple clients may connect to the application servers 102 via the communications network 110 . The communications network 110 may be any conventional network, such as an Ethernet network or a fiber channel network, that provides either a direct or indirect (e.g., Internet or communication via a client) connection between the servers. The client computer 101 provides a user interface into the distributed computing environment. In one embodiment, the user interface is a graphical user interface (GUI) via a web browser.

The application servers 102 seamlessly provide applications to the user such as Internet, productivity software, collaboration software, databases, and electronic mail, etc., and function as a gateway to the backend servers 104 . The application servers 102 allow a user to access multiple applications from the client computer 101 . The backend servers 104 provide authentication services 112 to the application servers 102 and authenticate information submitted by the client computer 101 . A “username” and “password” are examples of information that are authenticated by the backend server 104 . The backend servers 104 may also provide secure network services 108 to the application servers 102 . Such network services may also be provided by a separate server.

The authentication services 112 are authenticated by a root broker 106 . The root broker 106 is the most trusted certification authority in the distributed computing environment 100 . The root broker 106 registers the authentication services 112 and issues authentication broker credentials. Exemplary authentication services 112 may be provided by Veritas Security Server, available from Veritas Corporation of Mountain View, Calif.

FIG. 2 is a block diagram of a first application server 102 1 communicating to one another, either directly or indirectly, through a network 110 .

The servers 102 1 and 102 2 comprise at least one central processing unit (CPU) 200 , support circuits 210 , and memory 220 / 280 . The CPU 200 / 260 may comprise one or more conventionally available microprocessors and/or microcontrollers. The support circuits 210 / 270 are well known circuits that are used to support the operation of the CPU 200 / 260 . These circuits comprise power supplies, cloaks, input/output interface circuitry, cache and the like.

Memory 220 / 280 may comprise random access memory, read only memory, removable disk memory, disk arrays, flash memory, optical storage and various combinations of these types of memory. The memory 220 / 280 stores various forms of software and files, such as an operating system (OS) 230 / 285 , application software 245 / 297 , login software 235 / 292 , logout software 240 / 290 and a peer list 250 / 295 .

The application software 245 / 297 includes applications used by the user such as Internet, web server, productivity software, collaboration software, databases, and electronic mail.

The login software 235 / 292 enables a user to login to multiple application servers after being authenticated once by the application server 102 1 / 102 2 . The user can seamlessly navigate between application servers 102 without having to resubmit authentication information, i.e. a username and password, each time an application server 102 is accessed.

The logout software 240 / 290 enables a user to sign-out from each application server 102 the user accessed via the login software 235 / 292 . The logout software 240 / 290 signs-out an application server 102 from each and every application server on the peer list 250 / 295 . The logout software 240 / 290 ensures a user does not remain inadvertently logged into an application server 102 after signing-out from any one of the logged in application servers 102 .

FIG. 3 is a flow diagram of a method 300 for Single Sign-On that utilizes the present invention. The method 300 starts at step 302 and proceeds to step 304 . At step 304 , a user requests access to a first application server 102 1 via a client computer 101 . Login software 235 within the first application server 102 1 sends a “Login” page back to the user. The user enters authentication information into the client computer 101 and submits the information to the first application server 102 1 . At step 306 , login software 235 facilitates authentication of the user by the first application server 102 1 . Authentication is accomplished by the first application server 102 1 passing information submitted by the user, i.e. login name and password, to an authentication service 112 1 residing at the backend server 104 1 . An exemplary method and apparatus for authenticating a user's credentials is disclosed in commonly assigned U.S. patent application titled “AUTHENTICATION BROKER”, Ser. No. 10/323,585, filed on Dec. 19, 2002, which is incorporated by reference in its entirety. The backend server 104 1 comprises authentication services 112 and secure network services 108 .

At step 308 , the authentication service 112 1 passes a web credential back to the first application server 102 1 . The “web-credential” may be a cookie or a token. The first application server 102 1 uses the web-credential to establish a secure connection with the secure network services 108 provided by the backend server 104 1 . At step 310 , at some time during the session with the first application server, the user requests access to a second application server 102 2 via the first application server 102 1 . This generally occurs when a user selects a link to a program that executes on the second application server. At step 311 , the first application server 102 1 adds the identity of the second application server 102 2 to a peer list 250 . At step 312 , to avoid requiring the user to manually sign on to the second application server, the first application server 102 1 passes its identity and the web credential to the second application server 102 2 via the link. Login software 292 within the second application server 102 2 extracts the web-credential and verifies its authenticity. Upon verification of the web-credential, the second application server 102 2 establishes a secure connection with the secure network services 108 provided by the backend server 104 2 .

At step 314 , the second application server 102 2 grants access to the client computer 101 based upon the web credential. At step 316 , the second application server 102 2 adds the identity of the first application server 102 1 to a peer list 295 . The peer list 250 includes the identities of all the application servers 102 that the client computer has logged in via the first application server 102 1 as well as the application servers 102 that the first application server 102 1 has received connections from; the peer list 295 includes the identities of all the application servers 102 that the client computer has logged in via the second application server 102 2 as well as the application servers 102 that the second application server 102 2 has received connections from. The peer lists 250 / 295 enable the first application server 102 1 and second application server 102 2 to track the application servers 102 it has made a connection to or received a connection from, and also enable the application servers 102 1 / 102 2 to sign-out from each and every of the connected application servers 102 . The method ends at step 320 .

The user has employed a single sign-in procedure to access the second application server 102 2 via the first application server 102 1 . A single sign-out procedure is needed to ensure the user is able to properly sign out of all the application servers 102 . In the absence of such a technique, the user may remain signed into the second application server 102 2 upon signing out from the first application server 102 1 and vice versa.

FIG. 4 is a flow diagram of another method 400 for single sign-In that utilizes the present invention. The method 400 starts at step 402 and proceeds to step 404 . At step 404 , a user requests access to a first application server 102 1 via a client computer 101 . At step 406 , the user is authenticated by the first application server 102 1 . Authentication is accomplished by the first application server 102 1 passing information submitted by the user, i.e. login name and password, to an authentication service 112 1 residing in the backend server 104 1 . An exemplary method and apparatus for authenticating a user's credentials is disclosed in commonly assigned U.S. patent application titled “AUTHENTICATION BROKER”, Ser. No. 10/323,585, filed on Dec. 19, 2002, which is incorporated by reference in its entirety. The backend server 104 1 comprises authentication services 112 and secure network services 108 .

At step 408 , the authentication service 112 1 passes a web credential back to the first application server 102 1 . At step 410 , the user requests access to a second application server 102 2 via the first application server 102 1 . The user requests access to the second application server 102 2 by clicking on a URL address presented by the first application server 102 1 . At step 412 , the first application server 102 1 passes its peer list 250 and the web credential to a second application server 102 2 via the URL link. At step 414 , the second application server 102 2 grants access to the client computer 101 based upon the web credential. At step 416 , the second application server 102 2 updates its peer list 295 with information obtained from the peer list 250 of the first application server 102 1 . At step 418 , the second application server 102 2 passes the updated peer list 295 back to each application server in the updated peer list. In one embodiment of the invention, application server 102 2 sends back a page to the client computer 101 which invokes a JavaScript on the client computer 101 . The JavaScript migrates the updated peer list to each application server 102 in the peer list by asynchronously invoking a URL of the login software 235 of each application server 102 and passing the peer list via that link. In another embodiment of the invention, application server 102 2 sends back a page to the client computer 101 that has one invisible inline HTML frame for each application server 102 in the updated peer list. Each inline frame migrates the updated peer list by invoking a URL of the login software 235 of the corresponding application server 102 and passing the peer list via the link. At step 420 , each first application server 102 1 updates its peer list 250 with information obtained from the peer list 295 of the second application server 102 2 . The peer list 250 / 295 enables the application servers 102 to know about all other application servers 102 that the client computer 101 is also logged into using Single Sign In. The peer list 250 / 295 enables a user to employ a single sign-out procedure from a specific application server 102 and sign out of all the application servers 102 to which the client computer 101 is connected. The method ends at step 422 .

FIG. 5 is a flow diagram of a method 500 for single sign-out from a distributed computing environment 100 that utilizes an embodiment of the present invention. The method 500 starts at step 502 and proceeds to step 504 . At step 504 , the user initiates a single sign-out by signing out from any of the application servers 102 . Sign-out is accomplished by click on a URL address to activate logout software 240 / 290 . At step 506 , the logout software 240 / 290 signs-out the client computer 101 from each application server 102 present on the peer list 250 / 295 (shown in FIG. 2 as 250 / 295 ). The logout software 240 / 290 may be constructed in HTML, JavaScript or any appropriate programming language. In one embodiment of the invention, clicking on the URL address invokes a JavaScript on the client computer 101 that signs-out the client computer 101 from all of the application servers 102 that it's presently logged into. In one embodiment, this is generally performed in two steps: first, the client computer 101 is logged out of the current server via an Asynchronous Java Script and XML (AJAX) request or standard http request. The server then performs a self logout in response to the request. Next, The JavaScript computes the union of all the peer lists 250 / 295 and then performs logout from each application server 102 by asynchronously invoking a URL of the logout software 240 / 290 of each application server 102 . In another embodiment of the invention, application server 102 sends back a page to the client computer 101 that has one invisible inline HTML frame for each application server 102 in the peer list. Each inline frame invokes a URL of the logout software 240 / 290 of the corresponding application server 102 . The method ends at step 508 .

The present invention provides the advantage of enabling a user to sign out of one or more application servers by signing out of only one application server. Single sign-out enhances security within a distributed computing environment and helps prevent unauthorized access to information on an application server from which the user has failed to sign out.

While the foregoing is directed to embodiments of the present invention, other and further embodiments of the invention may be devised without departing from the basic scope thereof, and the scope thereof is determined by the claims that follow.