Granted Patent B2

US 8,332,647 · App. 12/491,558 · Granted Dec 11, 2012

Assignee: Raytheon Company

Abstract

Claims (52)

1. A user-to-workstation authentication system, comprising:

an authentication web server operable to receive an authentication request from a workstation, the authentication request including a workstation message and a user message, the workstation message including a workstation object and a workstation signature within the workstation message, the workstation object including a workstation certificate associated with a workstation within the workstation object, the user message including a user object and a user signature within the user message, the user object including a copy of the workstation message and a user certificate associated with a user of the workstation within the user object;

a certificate validation module operable to validate each of the workstation certificate and the user certificate; and

an attribute retrieval module operable to retrieve one or more caveats defined for the workstation and one or more caveats defined for the user and determine one or more common caveats defined for both of the workstation and the user, with each of the one or more common caveats being defined for the workstation and being defined for the user;

wherein the user-to-workstation authentication system is operable to provide a success response to the authentication request based on successful authentication of the workstation and successful authentication of the user.

2. The system of claim 1 , wherein the workstation object includes one or more items selected from the group consisting of a machine name, a domain name, a time stamp, and a globally unique identifier; and

wherein the user object includes one or more items selected from the group consisting of a user name, biometric data associated with the user, an application name, the machine name, the domain name, the time stamp, and the globally unique identifier.

3. The system of claim 1 , wherein the workstation signature is signed using a private key associated with the workstation certificate and the user signature is signed using a private key associated with the user certificate.

4. The system of claim 1 , wherein the authentication web server is further operable to verify the workstation signature and the user signature.

5. The system of claim 1 , wherein the authentication web server is further operable to:

extract the workstation object and a public key of the workstation certificate from the workstation message;

verify the workstation signature using the workstation Object and the public key of the workstation certificate;

extract the user object and a public key of the user certificate from the user message; and

verify the user signature using the user object and the public key of the user certificate.

6. The system of claim 1 , wherein the certificate validation module is operable to validate the workstation certificate and user certificate by performing one or more of the acts selected from group consisting of: checking the workstation and user certificates for expiration, checking the validity of one or more issuers associated with the workstation and user certificates, and verifying that the workstation and user certificates are not present on a certificate revocation list.

7. The system of claim 1 , further comprising a database service component operable to record an authentication event associated with the authentication request, the authentication event record including a globally unique identifier, a distinguished name associated with the user, a distinguished name associated with the workstation, and the one or more common caveats defined for both of the workstation and the user.

8. A method for user-to-workstation authentication, comprising;

receiving, at an authentication web server, an authentication request from a workstation, the authentication request including a workstation message and a user message, the workstation message including a workstation object and a workstation signature within the workstation message, the workstation object including a workstation certificate associated with a workstation within the workstation object, the user message including a user object and a user signature within the user message, the user object including a copy of the workstation message and a user certificate associated with a user of the workstation within the user object;

verifying the workstation signature and user signature;

validating each of the workstation certificate and the user certificate;

retrieving one or more caveats defined for the workstation and one or more caveats defined for the user;

determining one or more common caveats defined for both of the workstation and the user, with each of the one or more common caveats being defined for the workstation and being defined for the user; and

providing a success response to the authentication request responsive to successful authentication of the workstation and successful authentication of the user.

9. The method of claim 8 , wherein the workstation object includes one or more items selected from the group consisting of a machine name, a domain name, a time stamp, and a globally unique identifier; and

wherein the user object includes one or more items selected from the group consisting of a user name, biometric data associated with the user, an application name, the machine name, the domain name, the time stamp, and the globally unique identifier.

10. The method of claim 8 , wherein the workstation signature is signed using a private key associated with the workstation certificate and the user signature is signed using a private key associated with the user certificate.

11. The method of claim 8 , wherein verifying the signatures on the first and second components of the authentication request comprises:

extracting the workstation object and a public key of the workstation certificate from the workstation message;

verifying the workstation signature using the workstation object and the public key of the workstation certificate;

extracting the user object and a public key of the user certificate from the user message; and

verifying the user signature using the user object and the public key of the user certificate.

12. The method of claim 8 , wherein validating the workstation certificate and the user certificate comprises one or more acts selected from the group consisting of: checking the workstation and user certificates for expiration, checking the validity of one or more issuers associated with the workstation and user certificates, and verifying that the workstation and user certificates are not present on a certificate revocation list.

13. The method of claim 8 , further comprising recording an authentication event record associated with the authentication request, the authentication event record including a globally unique identifier, a distinguished name associated with the user, a distinguished name associated with the workstation, and the one or more common caveats defined for both of the workstation and the user.

14. The method of claim 8 , further comprising issuing a security token to the workstation based upon the one or more common caveats defined for both of the workstation and the user.

15. Logic encoded in non-transitory computer-readable storage media and operable, when executed by one or more processors, to:

receive an authentication request from a workstation, the authentication request including a workstation message and a user message, the workstation message including a workstation object and a workstation signature within the workstation message, the workstation object including a workstation certificate associated with a workstation within the workstation object, the user message including a user object and a user signature within the user message, the user object including a copy of the workstation message and a user certificate associated with a user of the workstation within the user object;

verify the workstation signature and user signature;

validate each of the workstation certificate and the user certificate;

retrieve one or more caveats defined for the workstation and one or more caveats defined for the user;

determine one or more common caveats defined for both of the workstation and the user, with each of the one or more common caveats being defined for the workstation and being defined for the user; and

provide a success response to the authentication request responsive to successful authentication of the workstation and successful authentication of the user.

16. The logic of claim 15 , wherein the workstation object further comprises one or more items selected from the group consisting of a machine name, a domain name, a time stamp, and a globally unique identifier; and

wherein the user object includes one or more items selected from the group consisting of a user name, biometric data associated with the user, an application name, the machine name, the domain name, the time stamp, and the globally unique identifier.

17. The logic of claim 15 , wherein the workstation signature is signed using a private key associated with the workstation certificate and the user signature is signed using a private key associated with the user certificate.

18. The logic of claim 15 , wherein verifying the signatures on the first and second components of the authentication request comprises:

extracting the workstation object and a public key of the workstation certificate from the workstation message;

verifying the workstation signature using the workstation object and the public key of the workstation certificate,

extracting the user object and a public key of the user certificate from the user message; and

verifying the user signature using the user object and the public key of the user certificate.

19. The logic of claim 15 , wherein validating the workstation certificate and the user certificate comprises one or more acts selected from the group consisting of: checking the workstation and user certificates for expiration, checking the validity of one or more issuers associated with the workstation and user certificates, and verifying that the workstation and user certificates are not present on a certificate revocation list.

20. The logic of claim 15 , further operable to:

record an authentication event record associated with the authentication request, the authentication event record including a globally unique identifier, a distinguished name associated with the user, a distinguished name associated with the workstation, and the one or more common caveats defined for both of the workstation and the user.

Assignments (12)

Continuity (1)