Electrical computers and digital processing systems: support – Multiple computer communication using cryptography – Protection at a particular protocol layer
Reexamination Certificate
1999-02-22
2003-01-21
Hayes, Gail (Department: 2131)
Electrical computers and digital processing systems: support
Multiple computer communication using cryptography
Protection at a particular protocol layer
C709S225000, C709S226000, C709S229000
Reexamination Certificate
active
06510523
ABSTRACT:
FIELD OF INVENTION
The present invention relates generally to computer security and, more particularly, to a method and system for providing limited access privileges with an untrusted terminal that allow a user to perform privileged operations over a network in a controlled manner.
RELATED ART
Conventionally, only secure and trusted terminals are used to perform privileged operations, such as viewing confidential information or authorizing financial transactions. In recent years, increased travel and improved communications have increased the need to perform such operations at times and places where a trusted terminal may not be available. For example, when away from the office on business with no trusted terminal handy, a corporate executive may wish to access confidential electronic corporate files from a hotel computer. However, information displayed on this computer may be videotaped without knowledge of the corporate executive and reviewed by personnel who may later disclose it to the press. With current technology, the corporate executive and others are confronted with serious security issues, even when using a password or other secret to access the information.
A trusted terminal is a system that is trusted to be secure enough to allow all privileged operations to be requested and/or performed. For instance, a trusted terminal might be located in a secure environment and configured to send and receive encrypted messages. An untrusted terminal is a system that is not trusted to be secure enough to allow all our privileged operations to be requested and/or performed. For instance, an untrusted terminal might be unable to establish a confidential connection to remote systems. It might have hostile software installed that attempts to execute unauthorized operations. Any terminal that is not known to be trusted should normally be considered untrusted.
If a user wishes to access a remote server from an untrusted terminal, the server may require the user to enter in their user name and password (or secret). The untrusted terminal, however, may capture the user name and password, without the user's knowledge, to use at a later time. This operation allows the untrusted terminal to access the user's remote server account at any time, thus seriously jeopardizing the integrity of the information stored in the remote server. In addition, the untrusted terminal may simply disclose to a third party confidential information that passes through it during a session without the user's knowledge. Therefore, a need exists for a method and system that significantly reduces or eliminates risks typically associated with using an untrusted terminal to perform privileged operations.
There are current solutions which attempt to reduce or eliminate the aforementioned risks. One such solution establishes two separate accounts—one untrusted terminal account and one trusted terminal account—for a user wishing to perform privileged operations remotely. To perform privileged operations through an untrusted terminal, the user logs into the untrusted terminal account, which provides only limited access privileges. To perform privileged operations through a trusted terminal, the user logs into the trusted terminal account, which provides increased privileges. While providing limited access to confidential information, this solution is susceptible to password or secret capture by the untrusted terminal. That is, the untrusted terminal can capture user access information and perform operations allowed by the untrusted terminal account at a later time without the user's authorization.
Authentication tokens have been used to overcome the problem described above with respect to an untrusted terminal capturing a user's password to perform unauthorized operations. An authentication token is a physical device that can generate passwords. There are a variety of authentication tokens currently available in the marketplace including time-synchronized authentication tokens and challenge-response authentication tokens. The use of authentication tokens with untrusted terminals, however, is still subject to several problems. For example, there is no time limit on a user's session with the password generated by the authentication token. Thus, the untrusted terminal can keep the session open indefinitely to perform unauthorized operations. Also, each use of the authentication token only authenticates with a single remote server. It is desirable to provide authenticated access to multiple remote servers without requiring repeated use of an authentication token.
Another current solution involves the use of a smart card that has a user's encryption code, such as a private key used in a public key cryptography scheme. Using the smart card in connection with the untrusted terminal, the user can encrypt, decrypt, or sign data passed through the untrusted terminal without disclosing the user's encryption code to the terminal. However, there are two problems with this solution. First, the untrusted terminal may seize this opportunity to perform unauthorized operations using the private key from the smart card. Second, trusted hosts cannot determine whether the user is using an untrusted or trusted terminal. Consequently, the host may send the user confidential data or grant the user privileges that are not appropriate under the circumstances. In addition, most terminals currently are not equipped with smart card readers, thereby limiting smart card usage.
A further current solution involves using a gateway connected to a communication network (e.g., the Internet) to restrict access to information on a remote server. In this instance, the user establishes a connection with the gateway through an untrusted terminal. Once the connection is established, the user identifies herself to the gateway which determines the scope of access to the remote server. For this solution to be effective, however, the gateway must be able to determine the appropriate restrictions for each access request to the remote server based on the user's identity. The gateway solution has all the disadvantages of whatever technique is used to authenticate with the gateway (e.g., password and authentication token). Its primary advantage is that it does not require changes to remote server software. However, the gateway must understand the protocols used to communicate with the remote server software. Furthermore, depending on the nature of this protocol, it may not be possible to provide appropriate access controls, such as filtering out confidential e-mail. Also, the gateway does not usually distinguish between a trusted workstation and an untrusted workstation.
SUMMARY OF THE INVENTION
Accordingly, a need exists for a system that overcomes the shortcomings of conventional technology by allowing a user to perform privileged operations safely over a network through an untrusted terminal while limiting breaches that might be caused by a hostile environment. It is further desirable to indicate to a host terminal that a user is connected to an untrusted terminal. This feature would allow the host to determine the appropriate level of user privileges.
Methods and systems consistent with the present invention, embodied and broadly described herein, provide limited access privileges to a network with an untrusted terminal by establishing a secure communications channel between the untrusted terminal and a credentials server, sending credentials specific to the untrusted terminal from the credentials server to the untrusted terminal over the secure communications channel, and using the credentials to perform privileged operations over the network through the untrusted terminal.
Additional desires, features and advantages of the invention are set forth in the following description, apparent from the description, or may be learned by practicing the invention. Both the foregoing general description and the following detailed description are exemplary and explanatory and are intended to provide further explanation of the invent
Hanna Stephen R.
Perlman Radia J.
Finnegan Henderson Farabow Garrett & Dunner L.L.P.
Hayes Gail
Jackson Jenise
Sun Microsystems Inc.
LandOfFree
Method and system for providing limited access privileges... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Method and system for providing limited access privileges..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Method and system for providing limited access privileges... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-3003064