# US 5,706,349 A · Authenticating remote users in a distributed environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 5,706,349 A - Document ID: US5706349A - Status: Granted - Kind: A - Application number: 08/398,832 - Filed: 1995-03-06 - Granted: 1998-01-06 - Earliest claimed: 1995-03-06 - Assignees: International Business Machines Corporation - Inventors: Radhakrishna Aditham; Philip Chang; Paul H. Kramer - Web page: https://patentgrep.com/patent/US5706349A ## CPC - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - G06F 21/33: using certificates - G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules - G06F 21/6236: {between heterogeneous systems} - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract In a distributed computing environment, a token is issued to a remote user if a security mechanism initially can determine that the remote user is who he claims to be. Thereafter, a connection between a remote user and an application server requires the application server to first verify that a token associated with a connection request was issued by the security mechanism. If no token is associated with a connection request, or if any token associated with the request was not issued by the security mechanism, the connection is refused. ## Claims ### Claim 1 A method for managing communications between remote users and an application server in a distributed computing environment, the application server supported in a local processing system having a local authentication facility, comprising the steps of: (a) issuing a token to each remote user whose identity is authenticated in the local processing system using the local authentication facility; (b) in response to a call from a remote user, determining whether a token associated with the call was issued to the remote user authenticated by the local authentication facility of the local processing system; and (c) connecting the remote user to the application server if the token was issued to the remote user authenticated by the local authentication facility of the local processing system. ### Claim 2 (depends on 1) The method as described in claim 1 wherein the identity of the remote user is authenticated by determining whether a user name and password are present in a user registry of the local processing system. ### Claim 3 (depends on 2) The method as described in claim 2 wherein the user name and password are provided to the local processing system in a data string forming a part of a binding handle request message. ### Claim 4 (depends on 3) The method as described in claim 3 wherein the data string also includes a universal unique identifier (UUID). ### Claim 5 (depends on 4) The method as described in claim 4 wherein the token and the UUID are stored in the local processing system to enable determination of whether the token associated with the call was issued to the remote user by the local processing system. ### Claim 6 (depends on 1) The method as described in claim 1 wherein the remote user is refused connection to the application server if the token was not issued to the remote user by the local processing system. ### Claim 7 (depends on 1) The method as described in claim 1 wherein the token is a random string associated with a particular computing session. ### Claim 8 A method, using a security mechanism, for managing communications between remote users and an application server in a distributed computing environment, wherein the security mechanism and the application server are supported in a local processing system having a local authentication facility, comprising the steps of: (a) issuing one or more tokens to a remote user if the remote user's identity is authenticated by the security mechanism using the local authentication facility; (b) in response to a call from a remote user, determining whether a token associated with the call was issued to the remote user by the security mechanism; (c) connecting the remote user to the application server if the token was issued to the remote user by the security mechanism; and (d) refusing connection to the application server if the token was not issued to the remote user by the security mechanism. ### Claim 9 (depends on 8) The method as described in claim 8 wherein the remote user's identity is authenticated by determining whether a user name and password are present in a user registry associated with the local authentication facility. ### Claim 10 (depends on 9) The method as described in claim 9 wherein the user name and password are provided to the security mechanism in a data string forming a part of a binding handle request message. ### Claim 11 (depends on 10) The method as described in claim 10 wherein the data string also includes a universal unique identifier (UUID). ### Claim 12 (depends on 11) The method as described in claim 11 wherein the token and the UUID are maintained in a storage associated with the security mechanism. ### Claim 13 (depends on 8) The method as described in claim 8 wherein each token issued to the remote user is a random string. ### Claim 14 (depends on 8) The method as described in claim 8 wherein the step of determining whether a token associated with the call was issued to the remote user by the security mechanism comprises the steps of: transmitting the token from the remote user to the application server; having the application server send the token to the security mechanism; and searching a database associated with the security mechanism to determine if the token was originated by the security mechanism. ### Claim 15 A method to enable an application server in a distributed network environment to verify the identity of remote users, the application server supported in a local processing system having a local authentication facility, comprising the steps of: (a) having a remote user transmit a data string to a security mechanism supported in the local processing system, the data string including at least some information uniquely identifying the remote user; (b) having the security mechanism issue a token to a remote user if the remote user's identity is authenticated by the security mechanism using the local authentication facility; and (c) using the token to control further connection of the remote user to the application server. ### Claim 16 (depends on 15) The method as described in claim 15 wherein the data string includes a user name, a user password and a random bit string. ### Claim 17 (depends on 16) The method as described in claim 16 wherein the data string is an object. ### Claim 18 In a network providing a distributed computing environment in which users access distributed resources and process applications, the network including a local processing system supporting an application server and having a local authentication facility, comprising: means for issuing a token to each remote user whose identity is authenticated using the local authentication facility; and means responsive to receipt of the token by the application server for controlling subsequent connection of the remote user to the application server. ### Claim 19 A computer network providing a distributed computing environment in which users access distributed resources and process applications, comprising: a local computer system having an application server and supporting an authentication facility; a client process; a security protocol means to enable the application server to authenticate the client process, comprising: means supported on the local computer system for issuing a token to the client process if the identity of the client process is authenticated using the authentication facility; and means responsive to receipt of the token by the application server for controlling connection of the client process to the application server. ### Claim 20 A program storage device readable by a processor and tangibly embodying a program of instructions executable by the processor to perform a method for managing communications in a distributed computing environment including an application server and one or more client processes, the application server supported in a local processing system having an authentication facility, the method for managing communications comprising the steps of: (a) issuing a token to a client process if the identity of the client process is authenticated using the authentication facility; (b) in response to a call request from a client process, determining where a token associated with the call request originated; and (c) enabling connection of the client process to the application server if the token originated from authentication by the authentication facility.