US5913025A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method and apparatus for proxy authentication
Assignee: EMC Corp
•
Filing: 1996-11-14
•
Granted: 1999-06-15
•
Expires: 2016-11-14
Abstract
Abstract A method for a source to obtain the rights of a target object is disclosed. The source first obtains the rights of a source object, which rights include authorization to access a target object and to modify authentication data of the target object. Next, the source object generates new authentication data. After accessing the target object using the rights of the source object, the source modifies the authentication data of the target object to include the new authentication data. Using the new authentication data, the source obtains the rights of the target object, whereby the source becomes a proxy for the target object. As a proxy, the source uses the rights of the target object. Alternative processes for proxy authentication, as well as apparatus for proxy authentication, are also disclosed.
Inventors
- 👤 DeeAnne Barker Higley
- 👤 Bruce Warner Thorne
- 👤 Brian Lee Jarvis
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-30 22:01
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/10; H04L63/104; G; G06; G06F; G06F21/00; G06F21/30; G06F21/31; H04L63/02; H04L63/0281; Y; Y10; Y10S; Y10S707/00; Y10S707/99931; Y10S707/99939
Claims Analysis
Total Claims: 43
Claim 1
Independent Claim
153 words
A method in a computer system, comprising the steps of: (a) obtaining by a source the rights of a source object, the rights of the source object including authorization to access a target object and to modify authentication data of the target object, the target object having rights to access one or more objects; (b) generating new authentication data by the source; (c) accessing the target object by the source using the rights of the source object; (d) modifying, at least partially due to the source having obtained the rights of the source object, the authentication data of the target object to include the new authentication data; (e) using the new authentication data by the source to obtain the rights of the target object to access the one or more objects, whereby the source becomes a proxy for the target object; and (f) using by the source the rights of the target object.
Claim 2
Independent Claim
153 words
A method in a computer system, comprising the steps of: (a) obtaining by a source the rights of a source object, the rights of the source object including authorization to access a target object and to modify authentication data of the target object, the target object having rights to access one or more objects; (b) generating new authentication data by the source; (c) accessing the target object by the source using the rights of the source object; (d) modifying, at least partially due to the source having obtained the rights of the source object, the authentication data of the target object to include the new authentication data; (e) using the new authentication data by the source to obtain the rights of the target object to access the one or more objects, whereby the source becomes a proxy for the target object; and (f) using by the source the rights of the target object.
Claim 3
Dependent Claim
20 words
A method as recited in claim 1, wherein the source object represents one or more programs loaded on a computer.
Claim 4
Dependent Claim
13 words
A method as recited in claim 2, wherein the computer is a server.
Claim 5
Dependent Claim
17 words
A method as recited in claim 2, wherein the source is a program loaded on the computer.
Claim 6
Dependent Claim
30 words
A method as recited in claim 4, wherein the source can obtain the rights of the source object at least partially due to the program is running on the computer.
Claim 7
Dependent Claim
19 words
A method as recited in claim 1, wherein step (a) involves the source logging in as the source object.
Claim 8
Dependent Claim
20 words
A method as recited in claim 1, wherein step (a) involves the source obtaining authentication data of the source object.
Claim 9
Dependent Claim
15 words
A method as recited in claim 1, wherein step (b) involves generating a random password.
Claim 10
Dependent Claim
24 words
A method as recited in claim 1, wherein step (d) includes the step of cryptographically transmitting the new authentication data to the target object.
Claim 11
Dependent Claim
24 words
A method as recited in claim 1, wherein step (e) involves the source logging in as the target object using the new authentication data.
Claim 12
Dependent Claim
24 words
A method as recited in claim 1, wherein the source object, target object, and one or more objects are objects in a distributed directory.
Claim 13
Dependent Claim
25 words
A method as recited in claim 11, wherein the rights of the source object and target object are at least partially enforced by directory security.
Claim 14
Dependent Claim
20 words
A method as recited in claim 11, wherein steps (a) and (e) involve at least a portion of login security.
Claim 15
Dependent Claim
12 words
A method as recited in claim 1, wherein the source is secured.
Claim 16
Dependent Claim
156 words
A computer readable medium, comprising a program operative to perform the steps of: (a) obtaining by a source the rights of a source object, the rights of the source object including authorization to access a target object and to modify authentication data of the target object, the target object having rights to access one or more objects; (b) generating new authentication data by the source; (c) accessing the target object by the source using the rights of the source object; (d) modifying, at least partially due to the source having obtained the rights of the source object, the authentication data of the target object to include the new authentication data; (e) using the new authentication data by the source to obtain the rights of the target object to access the one or more objects, whereby the source becomes a proxy for the target object; and (f) using by the source the rights of the target object.
Claim 17
Dependent Claim
156 words
A computer readable medium, comprising a program operative to perform the steps of: (a) obtaining by a source the rights of a source object, the rights of the source object including authorization to access a target object and to modify authentication data of the target object, the target object having rights to access one or more objects; (b) generating new authentication data by the source; (c) accessing the target object by the source using the rights of the source object; (d) modifying, at least partially due to the source having obtained the rights of the source object, the authentication data of the target object to include the new authentication data; (e) using the new authentication data by the source to obtain the rights of the target object to access the one or more objects, whereby the source becomes a proxy for the target object; and (f) using by the source the rights of the target object.
Claim 18
Dependent Claim
137 words
A computer system, comprising: (a) a distributed directory having a plurality objects; (b) a plurality of computers accessing the distributed directory; (c) a target object in the distributed directory having authentication data and rights to access one or more of the plurality objects in the distributed directory; (d) a source object in the distributed directory having rights to access the target object and to modify the authentication data of the target object, said source object having authentication data capable of being obtained by a source; (e) a generation mechanism operative to generate new authentication data for replacement of the authentication data of the target object; and (f) a replacement mechanism operative to replace the authentication data of the target object with the new authentication data, which enables the source to obtain the rights of the target object.
Claim 19
Dependent Claim
137 words
A computer system, comprising: (a) a distributed directory having a plurality objects; (b) a plurality of computers accessing the distributed directory; (c) a target object in the distributed directory having authentication data and rights to access one or more of the plurality objects in the distributed directory; (d) a source object in the distributed directory having rights to access the target object and to modify the authentication data of the target object, said source object having authentication data capable of being obtained by a source; (e) a generation mechanism operative to generate new authentication data for replacement of the authentication data of the target object; and (f) a replacement mechanism operative to replace the authentication data of the target object with the new authentication data, which enables the source to obtain the rights of the target object.
Claim 20
Dependent Claim
21 words
A computer system as recited in claim 16, wherein the source object represents one or more programs loaded on a computer.
Claim 21
Dependent Claim
14 words
A computer system as recited in claim 17, wherein the computer is a server.
Claim 22
Dependent Claim
14 words
A computer system as recited in claim 17, wherein the computer is physically secured.
Claim 23
Dependent Claim
21 words
A computer system as recited in claim 16, wherein the authentication data of the target object includes a private/public key pair.
Claim 24
Dependent Claim
23 words
A computer system as recited in claim 16, wherein the replacement mechanism requires the rights of the source object to implement the replacement.
Claim 25
Dependent Claim
17 words
A computer system as recited in claim 16, wherein the plurality of computers comprises a client/server network.
Claim 26
Independent Claim
111 words
A method in a computer system, comprising the steps of: (a) obtaining by a source the rights of a source distributed directory object in a distributed directory; (b) reading an attribute of one or more distributed directory objects to determine if the source object has proxy rights to a target distributed directory object in the distributed directory, the target object having rights to access one or more objects in the distributed directory; (c) obtaining by the source object the rights of the target object, if the source object has proxy rights; and (d) using by the source object the rights of the target object to access the one or more objects.
Claim 27
Independent Claim
111 words
A method in a computer system, comprising the steps of: (a) obtaining by a source the rights of a source distributed directory object in a distributed directory; (b) reading an attribute of one or more distributed directory objects to determine if the source object has proxy rights to a target distributed directory object in the distributed directory, the target object having rights to access one or more objects in the distributed directory; (c) obtaining by the source object the rights of the target object, if the source object has proxy rights; and (d) using by the source object the rights of the target object to access the one or more objects.
Claim 28
Dependent Claim
31 words
A method as recited in claim 23, further comprising the step of storing one or more events that transpire while the source object is using the rights of the target object.
Claim 29
Dependent Claim
26 words
A method as recited in claim 23, further including the step of recording that the source object is acting as a proxy for the target object.
Claim 30
Dependent Claim
25 words
A method as recited in claim 23, wherein step (c) involves changing the state of the source object to the state of the target object.
Claim 31
Dependent Claim
23 words
A method as recited in claim 26, wherein a record is maintained that the source object is a proxy for the target object.
Claim 32
Dependent Claim
18 words
A method as recited in claim 23, wherein step (a) involves at least a portion of login security.
Claim 33
Dependent Claim
18 words
A method as recited in claim 23, wherein step (b) involves at least a portion of directory security.
Claim 34
Dependent Claim
34 words
A method as recited in claim 29, wherein the target object has authentication data and step (b) involves determining whether the source object has rights to access the authentication data of the target object.
Claim 35
Dependent Claim
34 words
A method as recited in claim 29, wherein the target object has authentication data and step (b) involves determining whether the source object has rights to modify the authentication data of the target object.
Claim 36
Dependent Claim
25 words
A method as recited in claim 29, wherein step (b) involves determining whether the source object has been assigned proxy rights to the target object.
Claim 37
Dependent Claim
13 words
A method as recited in claim 23, wherein the source is physically secured.
Claim 38
Dependent Claim
17 words
A method as recited in claim 23, wherein step (c) preserves the rights of the source object.
Claim 39
Dependent Claim
42 words
A method as recited in claim 23, wherein the computer system has a connection table with a record for the source object and step (c) involves changing the record of the source object in the connection table to reflect the target object.
Claim 40
Dependent Claim
24 words
A method as recited in claim 23, further comprising the step of storing in a database information read from the one or more objects.
Claim 41
Dependent Claim
114 words
A computer readable medium, comprising a program operative to perform the steps of: (a) obtaining by a source the rights of a source distributed directory object in a distributed directory; (b) reading an attribute of one or more distributed directory objects to determine if the source object has proxy rights to a target distributed directory object, the target object in the distributed directory having rights to access one or more objects in the distributed directory; (c) obtaining by the source object the rights of the target object, if the source object has proxy rights; and (d) using by the source object the rights of the target object to access the one or more objects.
Claim 42
Dependent Claim
114 words
A computer readable medium, comprising a program operative to perform the steps of: (a) obtaining by a source the rights of a source distributed directory object in a distributed directory; (b) reading an attribute of one or more distributed directory objects to determine if the source object has proxy rights to a target distributed directory object, the target object in the distributed directory having rights to access one or more objects in the distributed directory; (c) obtaining by the source object the rights of the target object, if the source object has proxy rights; and (d) using by the source object the rights of the target object to access the one or more objects.
Claim 43
Dependent Claim
23 words
A method as recited in claim 24, further comprising the step of auditing the source by using the one or more stored events.
References Cited (Backward Citations)
US5321841A
Cited
US5032979A
Cited
US5481721A
Cited
US5276901A
Cited
US5511197A
Cited
US5586260A
Cited
US5613148A
Cited
US5594921A
Cited
US5623601A
Cited
US5608903A
Cited
US5677851A
Cited
US5642511A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2002-06-14 | 2002-12-14 | 2003-06-15 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2006-06-14 | 2006-12-14 | 2007-06-15 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2010-06-14 | 2010-12-14 | 2011-06-15 | $7700.00 | Window Closed / Lapsed |