PKI-based client/server authentication
View Patent ↗A client/server authentication system is disclosed. The system includes a filter, a plug-in, and an extension. The filter monitors sessions between a client and a server for proper authentication. The plug-in is coupled to the client and the server. The plug-in generates public and private key pairs, and receives and stores certificates. The extension is coupled to the filter. The extension generates script commands to cause the client and the server to perform required steps indicated by the filter.
1. A method for providing a single sign-on authentication and privacy, comprising in order:
submitting a request to access a node, wherein the request is submitted by a client;
searching for a security token, wherein the searching is performed by a security filter on a server and operates to search for the security token sent from the client to the server, wherein the security token, if present, is stored on the client as a cookie;
directing the client to submit a certificate to the server, wherein the directing is performed by the security filter on the server;
verifying the submitted certificate with a trusted certificate, wherein the verifying is performed by a security extension on the server and operates to verify the submitted certificate sent from the client to the server;
performing a challenge, wherein the challenge is generated by the security extension on the server and is sent to the client;
generating a response to the challenge, wherein the response is generated by the client and is sent to the server; and
saving the response as a named cookie on the client, wherein the response is saved by the client.
2. The method of claim 1 , wherein said response is used as a security token.
3. The method of claim 2 , wherein said security token is used to propagate an initial authentication.
4. The method of claim 1 , further comprising:
creating a connection session if the certificate is valid.
5. The method of claim 1 , wherein said verifying the submitted certificate includes checking a signature on the submitted certificate with the trusted certificate.
6. The method of claim 1 , further comprising:
generating a key;
encrypting the key with a client's public key;
sending an encrypted key to a client; and
using the key to encrypt communication.
7. A method for providing a single sign-on authentication and privacy, comprising in order:
submitting a request to access a node, wherein the request is submitted by a client;
searching for a security token, wherein the searching is performed by a security filter on a server and operates to search for the security token sent from the client to the server, wherein the security token, if present, is stored on the client as a cookie;
directing the client to submit a certificate to the server, wherein the directing is performed by the security filter on the server;
verifying the submitted certificate with a trusted certificate, wherein the verifying is performed by a security extension on the server and operates to verify the submitted certificate sent from the client to the server;
performing a challenge, wherein the challenge is generated by the security extension in on the server and is sent to the client;
generating a response to the challenge, wherein the response is generated by the client and is sent to the server;
saving the response as a named cookie with an authentication token on the client, wherein the response is saved by the client; and
using standard Secure Socket Layer (SSL) library to provide communication privacy.
8. The method of claim 7 , wherein said verifying includes creating and registering a new authentication session.
9. The method of claim 8 , wherein said verifying includes validating the new authentication session with the authentication token.
10. The method of claim 7 , wherein said verifying includes indicating a failure status to a client if said verifying fails.
11. The method of claim 7 , wherein said performing said challenge includes generating a node challenge random number.
12. A method of claim 7 , wherein said directing includes receiving an address of the node; and
checking to determine if the address is protected.
13. The method of claim 7 , further comprising:
determining if the authentication token is already present.
14. The method of claim 13 , further comprising:
determining if a client is on an access control list if the authentication token is present and valid.
15. An apparatus comprising a computer-readable storage medium having executable instructions that enable the computer to, in order:
submit a request to access a node, wherein the request is submitted by a client;
search for a security token, wherein the search is performed by a security filter on a server and operates to search for the security token sent from the client to the server, wherein the security token, if present, is stored on the client as a cookie;
direct the client to submit a certificate to the server, wherein the directing is performed by the security filter on the server;
verify the submitted certificate with a trusted certificate, wherein the verifying is performed by a security extension on the server and operates to verify the submitted certificate sent from the client to the server;
perform a challenge, wherein the challenge is generated by the security extension on the server and is sent to the client;
generate a response to the challenge, wherein the response is generated by the client and is sent to the server; and
save the response as a named cookie on the client, wherein the response is saved by the client.
16. The apparatus of claim 15 , wherein said response is used as a security token.
17. An apparatus comprising a computer-readable storage medium having executable instructions that enable the computer to, in order:
submit a request to access a node, wherein the request is submitted by a client;
search for a security token, wherein the search is performed by a security filter on a server and operates to search for the security token sent from the client to the server, wherein the security token, if present, is stored on the client as a cookie;
direct the client to submit a certificate to the server, wherein the directing is performed by the security filter on the server;
verify the submitted certificate with a trusted certificate, wherein the verifying is performed by a security extension on the server and operates to verify the submitted certificate sent from the client to the server;
perform a challenge, wherein the challenge is generated by the security extension on the server and is sent to the client;
generate a response to the challenge, wherein the response is generated by the client and is sent to the server;
save the response as a named cookie with an authentication token on the client, wherein the response is saved by the client; and
use standard Secure Socket Layer (SSL) library to provide communication privacy.
18. The apparatus of claim 17 , wherein said verify the submitted certificate includes instructions to create and register new authentication session.