Disconnected credential validation using pre-fetched service tickets
View Patent ↗One or more user service tickets are obtained (i.e. pre-fetched) from an authentication server and stored in a ticket cache. The user service tickets facilitate a login device communicating with one or more users or group members associated with the login device. Login credentials for the users or group members may be subsequently authenticated against the user service tickets within the ticket cache thereby eliminating the need for immediate access to the authentication server or a previous login session by the users or group members. The user service tickets within the ticket cache may be refreshed as needed. In one embodiment, the user service tickets are refreshed daily and also in response to login attempts if the authentication service is readily accessible.
1. A computerized method that processes login credentials, the method comprising:
pre-fetching from a Kerberos server a user service ticket associated with a future user of a login device prior to a request from the user of the login device to authenticate, wherein pre-fetching the user service ticket comprises:
authenticating the login device instead of the user,
obtaining from the Kerberos server the user service ticket for the login device, wherein the user service ticket identifies the login device as a principal and the user as a service provider, the user service ticket further comprising an encrypted portion with identification information about the user that is used to subsequently authenticate the user, and
storing in a ticket cache associated with the login device, the user service ticket for subsequent authentication of the user;
receiving an authentication request at the login device from the user subsequent to pre-fetching the user service ticket, the authentication request comprising one or more login credentials of the user;
in response to receiving the authentication request from the user, determining whether the Kerberos server is unavailable; and
in response to determining that the Kerberos server is unavailable, authenticating the user based on the user service ticket stored in the ticket cache, said authenticating comprising decrypting the user service ticket and comparing the identification information about the user stored in the user service ticket with the one or more login credentials of the user.
2. The method of claim 1 , wherein authenticating the user with the user service ticket comprises generating a key for the user from the one or more login credentials, decrypting a portion of the user service ticket using the key for the user, and validating authentication data.
3. The method of claim 1 , wherein authenticating the user with the user service ticket comprises using the user service ticket to construct a Kerberos AP-REQ message structure that is immediately validated using a credential generated key for the user.
4. The method of claim 1 , wherein the user service ticket stores an identifier of the login device in the encrypted part of a Kerberos service ticket.
5. The method of claim 1 , wherein the Kerberos server is a Kerberos key distribution center (KDC).
6. The method of claim 5 , wherein the method further comprises authenticating the user via encrypted portion of the KDC.
7. The method of claim 1 , wherein the method further comprises refreshing the user service ticket.
8. The method of claim 7 , wherein the user service ticket is refreshed in response to an event selected from the group consisting of expiration of a selected interval, a login request, a change in user credentials, and during a reboot cycle.
9. An apparatus to validate login credentials, the apparatus comprising:
a ticket pre-fetch module associated with a login device, the ticket pre-fetch module configured to pre-fetch a user service ticket from a Kerberos server prior to a request from a user of the login device to authenticate, wherein pre-fetching the user service ticket comprises:
authenticating the login device with the Kerberos server; and
obtaining a user service ticket for the login device from the Kerberos server, wherein the user service ticket identifies the login device as a principal and the user as a service provider, the user service ticket further comprising an encrypted portion with identification information about the user that is used to subsequently authenticate the user;
a ticket cache configured to store the user service ticket for subsequent authentication of the user;
an authentication module configured to:
receive an authentication request at the login device for the user subsequent to pre-fetching the user service ticket, the authentication request comprising one or more login credentials of the user,
determine whether the Kerberos server is available, and
in response to determining that the Kerberos server is unavailable, authenticate the user with the user service ticket by at least decrypting the user service ticket and comparing the identification information about the user stored in the user service ticket with one or more login credentials of the user; and
wherein the ticket pre-fetch module and the authentication module comprise one or more computer processors.
10. The apparatus of claim 9 , wherein the authentication module is further configured to generate a key for the user from the one or more login credentials, decrypt a portion of the user service ticket using the key for the user, and validate authentication data associated with the user service ticket.
11. The apparatus of claim 9 , wherein the authentication module is further configured to use the user service ticket to construct a Kerberos AP-REQ message structure that is validated using a key for the user.
12. The apparatus of claim 9 , wherein the ticket pre-fetch module is further configured to refresh the user service ticket.
13. The apparatus of claim 12 , wherein the ticket pre-fetch module is further configured to refresh the user service ticket in response to an event selected from the group consisting of expiration of a selected interval, a change in user credentials, a login request, and a reboot cycle.
14. The method of claim 1 , wherein the user service ticket comprises an identifier of the login device in a username field and an identifier of the user in a service name field.
15. The apparatus of claim 9 , wherein the user service ticket comprises an identifier of the login device in a username field and an identifier of the user in a service name field.
16. A method to validate login credentials, the method comprising:
by a computer system comprising computer hardware:
requesting a first service ticket for a login device from an authentication server prior to receiving a login request of a user;
receiving the first service ticket from the authentication server wherein the service ticket identifies the login device as a principal and the user as a service provider, the service ticket further comprising an encrypted portion with identification information about the user that is used to subsequently authenticate the user;
storing the first service ticket in ticket cache;
receiving a login request with the login device from the user to access a service subsequent to said storing the first service ticket, the login request from the user comprising a login credential;
attempting to obtain a second service ticket from the authentication server in response to receiving the login request from the user; and
in response to failing to receive the second service ticket, authenticating the user by comparing information in the first service ticket stored in the ticket cache with the login credential.
17. The method of claim 16 , wherein said attempting to obtain a second service ticket from the authentication server comprises testing for a timeout condition.
18. The method of claim 17 , wherein said comparing the first service ticket and the login credential to authenticate the user is performed in response to the timeout condition being satisfied.
19. The method of claim 16 , wherein said requesting the first service ticket comprises authenticating the login device used by the user.
20. The method of claim 16 , wherein the first service ticket comprises an identifier of the login device in a username field and an identifier of the user in a service name field.
21. The method of claim 16 , wherein said authentication the user by comparing the first service ticket and the login credential comprises decrypting at least a portion of the first service ticket using a key generated from the login credential.