Source access using request and one-way authentication tokens

#The present invention relates to a method for authenticating an entity at a data resource.

#Access to data resources such as data bases or applications running on a main-frame computer is typically controlled by providing an authorized user with a password. However, since data resources are nowadays more and more distributed, the authentication information, such as the user name and the password or a certificate, must be sent over sometimes unsecured channels between the client application of the user and the addressed data resource. This is particularly a problem if a user intends to access a data resource which is not directly connected the client application but only via one or more intermediate servers or the like so that the authentication information is passed on over various channels. In such a situation, the user cannot control, whether all of the sections of the communication between the client application and the addressed data resource are indeed secured.

#One way of improving the security of authentication information is the use of tokens, i.e., virtual objects, passed from the client to the data resource for authentication. To obtain a token, a client sends at first authentication information to a trusted third party. If the client is authenticated, the trusted third party issues a token to the client, wherein in some systems the trusted third party also verifies the authorization of the client to access a certain data resource. By means of this token the client can access the various data resources, which may validate the token with the trusted third party. As a result it is no longer the authentication information itself, which is sent over the possibly unsecured channels, but only a token.

#In the following detailed description presently preferred embodiments of the invention are described with reference to the drawings which show:

#FIG. 1: An arrangement of a web server connected to several data resources to illustrate the problem underlying the present invention; and

#FIG. 2: a schematic representation of the various steps performed in a method in accordance with a preferred embodiment of the present invention.

#FIG. 1 illustrates a typical situation as it is encountered in today's distributed networks of data resources: A web server 100 provides access for a user not only to the files of the web server 100 itself but also to several data resources either directly or indirectly connected to the web server 100. The data resources may in an exemplary configuration comprise one or more applications 200, 500, running for example on one or more mainframe computers (not shown), and a server 300 with a data base managing program handling requests for a database 400, such as an Adabas database.

#When a user at the web server 100 wants to access data at the database 400, his request is initially sent from the web server 100 to the application 200, which processes the request and sends a corresponding request to the server 300, which finally sends a request to the database 400. Whenever one of the data resources 200, 300 or 400 receives a request, it requires authentication information which enables the respective data resource to verify, whether the requesting user is authorized to access the requested data. As a result, the authentication information has in the above example to be communicated over the channels a, b and c (cf. FIG. 1).

#Whereas in the past the various applications, server and databases were typically localized in one, generally secure location interconnected by secure channels, the various data resources are nowadays typically distributed over several locations and interconnected by more or less open networks such as the Internet or an Intranet. As a consequence, the channels a, b, c, d are no longer secured channels. In particular, a user entering his authentication information at the web server 100 does not know and cannot control, whether one or more of the channels a, b, c, which are used to process his request, are secured or not. Therefore, there is a considerable risk that the authentication information supplied by a user and thereby his identity may be hijacked on its way to the data server 400.