US 7,024,556 B1 · Distributed system authentication

Abstract

In a technique for authenticating a user submitting a service request from a client to a server, a service agent on the server receives the service request and submits an authentication request to a manager agent. If the user is successfully authenticated, the manager agent transmits a message to the service agent including user authentication information and stores a time-out value establishing a predetermined time period. The service agent stores the user authentication information and shares it with a distributed application which provides the requested service to the user. The manager agent determines whether the predetermined time period has been exceeded before another service request is received at the service agent, and if not then the service agent attempts to authenticate the user using the stored authentication information. Otherwise, the service agent submits another authentication request to the manager agent to authenticate the user.

Claims13

Dependent claims

A method of authenticating a user of a client computer at a server computer executing a distributed application on a plurality of first data processing agents, comprising the steps of:

receiving a first service request from the user at one of the plurality of first data processing agents;
submitting an authentication request from the one of the plurality of first data processing agents to a second data processing agent to authenticate the user;
authenticating the user at the second data processing agent;
if the user is successfully authenticated:
storing a first timeout value indicative of a predetermined first time period on the second data processing agent;
and
sending authentication information that the one of the plurality of first data processing agents can use to subsequently re-authenticate the user without submitting subsequent authentication request to the second data processing agent;
determining whether the predetermined first time period is exceeded;
if the predetermined first time period is exceeded without receiving a second service request from the user, requiring the user to log into the second data processing agent upon receipt of the second service request;
and
if the second service request is received from the user at another of the plurality of first data processing agents before the first time period is exceeded, restarting the first timeout value.

8 more elements

A system for authenticating a user of a client computer at a server computer executing a distributed application on a plurality of data processing agents, the system comprising:

a server including a plurality of first data processing agents for receiving service requests from the user and a second data processing agent for authenticating the user,
wherein each of the plurality of first data processing agents is configured to submit an authentication request to the second data processing agent to authenticate the user,
wherein the second data processing agent is configured to:
receive the authentication request from the submitting first data processing agent;
attempt to authenticate the user;
and
if the user is successfully authenticated, store a first timeout value indicative of a first predetermined time period, and send to the submitting data processing agent authentication information that the submitting first data processing agent can use to subsequently re-authenticate the user without submitting a subsequent authentication request to the second data processing agent;
and
determine whether the first predetermined time period is exceeded;
wherein each of the plurality of first data processing agents is further configured to notify the second data processing agent if a second service request is received from the user, and the second data processing agent is configured to restart the first timeout value in response to receiving the notification after receiving a previous notification, relative to the user, from another one of the first data processing agents,
wherein each of the plurality of first data processing agents is further configured to require the user to log into the second data processing agent upon receipt of a second service request if the first predetermined time period is exceeded before the second services request is received.

8 more elements

Dependencies are inferred from the claim text.

Distributed system authentication

Life of this patent

Distributed system authentication

Life of this patent

Abstract

Claims13