Certificate-based authentication system for heterogeneous environments

A storage medium having encoded thereon instructions to facilitate an operator of a console to manage a device with only one authentication of the operator to a core, said instructions capable of directing a processor to:

• obtain a short-lived operating system independent session certificate from a core to authenticate operator identity and operator group membership;
• provide the operating system independent session certificate along with a management request to a device;
• and
• determine whether the authenticated operator has necessary access privilege to perform the management request based at least in part on comparing said operator group membership to an access control list of the device.

In a heterogeneous operating system environment, a method for a device running a first operating system to validate a management request from an operator of a console running a different operating system, comprising:

• receiving, by the device, of an X.509 based session certificate including:
• a first field encoding an identity of the operator;
• a second field encoding group membership for the operator;
• a third field indicating an issuer of said certificate;
• and
• a fourth field for storing a signature by said issuer for said certificate;
• receiving a request to manage the device;
• confirming the issuer of said certificate is a trusted certificate authority;
• verifying the trusted certificate authority signed said certificate, and if verifying fails, then ignoring the request to manage;
• verifying authorization of the console operator to perform the request to manage;
• and
• verifying the management request complies with a local policy.

In a heterogeneous networked operating system environment, a method for an operator of a console to manage a device, comprising:

• creating a temporary encryption and a decryption key pairing;
• identifying a core for said device to be managed;
• requesting, by the operator of the console, a signed short-lived session certificate from the core identifying the operator and authorizing the operator to manage the device;
• receiving, from the core, said session certificate;
• submitting said received session certificate to the device to initiate a management session;
• and
• validating, by the device, said session certificate;
• and
• accepting, by the device, of the management session if said session complies with a management policy maintained by the device.

In a heterogeneous networked operating system environment, a method for an operator of a console to manage a device, comprising:

• means for creating a temporary encryption and a decryption key pairing;
• means for identifying a core for said device to be managed;
• means for requesting, by the operator of the console, a signed short-lived session certificate from the core identifying the operator and authorizing the operator to manage the device;
• means for receiving, from the core, said session certificate;
• means for submitting said received session certificate to the device to initiate a management session;
• and
• means for validating, by the device, said session certificate;
• and
• means for accepting, by the device, of the management session if said session complies with a management policy maintained by the device.