Method and architecture to provide a secured remote access to private resources

[0002] 1. Field of the Invention

[0003] The invention concerns a method to provide a secured remote access to private resources.

[0004] More specifically, the method allows remote Internet users to access securely to private resources protected by a firewall.

[0005] The invention also concerns an architecture implementing said method.

[0006] Within the framework of the invention, “resources” are related to all kinds of “objects”: hardware or logical units, such as a particular computer, microcomputer or server in a data processing system, a disk unit, a database, or a software application, etc.

[0007] 2. Description of the Prior Art

[0008] When a user or a client device attempts to access to a particular protected resource located in a data processing system, generally it is necessary to check whether it may or not access to said resource. For example, if the user sends a request so as to read some protected data, its requests must be filtered, before granting such an access. On the one hand, the authentication of the user must be performed. On the second hand, after this authentication stage is performed, the request is allowed or discarded according to his rights or privileges.

[0009] If the problem is to be handled on a local area or on a LAN (Local Area Network), the solution is generally quiet simple. The number of users and their rights and other identification data are well known and mastered. The information is usually stored in a secured data base. These data and associated security mechanisms are under control of a security officer or a system administrator.

[0010] When a session is started at a user's station or the like, the usual process is the following :

[0011] The user enters some identification data, for example a log-in and a password, which are sent to a server.

[0012] Upon reception, the server or a security device filters the request, i.e. it compares the received data with filtering rules stored in a secured data base. If the user is authorized to access the resource, the operation is allowed. Otherwise, the operation is denied. The control may be more sophisticated: for example a given user may read data stored on a particular disk unit, but not write data nor erase them.

[0013] Another problem relates to a multiple access request, i.e. when a user's device requests to access successively to more than one resource, for example to three separate servers. The usual way to proceed is to enter as many different passwords (and eventually log-in words) as there are servers to be accessed, or more generally speaking number of resources to be accessed. Thus, the user has to remember a lot of authentication data.

[0014] Furthermore, the system has to cope with the necessity to change, at least at regular intervals, the set of passwords, identification data and authorization levels attributed to users and resources. Such modifications are also made when at least one of the following circumstances arises: addition, modification or deletion of one or more resources.

[0015] To overcome the above-recalled problems, as far as local access requests are concerned, some methods have been proposed in the prior art.

[0016] One method is based on the implementation of a special piece of security software in the user's station. When a user wants to access one or more servers or resources, he enters a log-in and a password, or any other authentication data sets, as usual. However, this stage is performed once for a whole session. Said piece of security software sends a request to a security manager unit or the like which looks at a secured data base. Said request consists in a message transmitted through any suitable channel that does not need to be secured per se. However, the data themselves are usually coded or more exactly enciphered. According to the result of the comparison between received data and stored data, the security unit makes a decision whether or not the user is permitted to use one or more resources. It send back an enciphered response message to the requesting user's station. Said message contains data indicating whether the connection to one or more resources is allowed or denied, and eventually which resources are allowed if all are not permitted, taking into account the entered password. The corresponding data is stored in the user's station under control of the special piece of security software.

[0017] Such a feature is often called “SSO” (“Single Sign-On”).

[0018] It is easy to understand that to manage the access of remote users, according to a given security policy, in a consistent way, is more difficult than locally.

[0019] As above-recalled, thought the invention is not limited to this sole application, the preferred application concerns remote accesses to private resources through Internet.

[0020] Such a network exhibits specific features. Some are recalled here-after.

[0021] The number of users connected to Internet is not limited. Solutions, such as the ones recalled, which are convenient for a LAN or the like are useless. As a matter of fact, it is not realistic or even possible that the security officer or the security manager unit can control hundred or thousand users, distributed on a worldwide basis, in particular when security data associated with various resources are to be changed very often. In other words, it is not possible to simply implement the above-recalled piece of security software in each user's workstation, remote personal computer or terminal to solve the above-recalled problem.

[0022] Transmissions use standardized protocols such as “FTP” (“File Transfer Protocol”), “Telnet” (terminal emulation), “HTTP” (“Hyper Text Transfer Protocol”) , etc. So, any solution implemented so as to secure data exchanges must cope with standardization requirements.

[0023] Internet constitutes a highly insecure network. Messages routing is never foreseeable. In particular, it depends on an eventual congestion along backbones or any transmission channels. Messages may be stored in “ISP” stations (“Internet Service Providers”) before to being delivered or downloaded, and can be copied. Thus security can not be guaranteed.

[0024] Usually, a security device, called a “firewall”, is provided in order to isolate the “outside world”, i.e. Internet, from the “inside world”, LAN or other computer facilities. But prior art devices only filter “IP” (“Internet Protocol”) addresses, i.e. one of the lowest layers of the architecture. Internet layers comprise the following ones “Physical”, “Data Link” (“PPP”, “Slip”, etc.), “Network” (“IP”), “Transport” (“TCP”, “UDP”) and “Application” (“HTTP”, “FTP”, “e-mail”, etc.).

[0025] The problem of securely filtering remote access requests to a protected server (i.e. a physical machine), an application, for example a “FTP” type application (i.e. a higher level layer), or any other resource remains unsolved.

[0026] In the prior art some attempts have been made to solve this problem.

[0027] The first solution is known as a “VPN” (“Virtual Private Network”). It consists in providing secured “data pipes” constituting so-called “Extranets” which are extensions of Intranets or LANs. As communication channels are not located inside a well delimited area (private building, manufacturing plant, etc.), it is necessary to use a cryptology method in order to secure transmitted data. Furthermore, as they are publicly transmitted and thus can be intercepted, enciphered data must be very difficult to be decrypted. It implies that high-level algorithms must be used, for example algorithms exhibiting a long-sized encoding key. However, such algorithms are not allowed in some country, for example in France (except if a special authorization is given: defense-related applications, etc.), at least when they the purpose is to encipher the whole message. They are only allowed for encoding authentication data, such as electronic signatures (sealing function). On networks of the “VPN” type, it is impossible to differentiate authentification data from application data. Thus, a “VPN” type solution commonly uses low-level algorithms or weak keys, which is not sufficient to protect very sensitive data, as passwords for example. Furthermore, problems in connection with the necessity to remember a lot of passwords and other authentication data remain unsolved.

[0028] An other known solution consists in securing the initial authentication stage with “One-Time Passwords” (“OTP”). Stealing such passwords is without importance as they can not be “re-played”. However, as above, the problem relating to the necessity to remember a lot of authentication data remains unsolved. At the beginning of a session, a final user must retrieve the connection data for each server or resource to be accessed. Furthermore, the solution is very expensive to implement as each protected accessed resource must be modified in order to install an authentication client which is able to handle one-time passwords.

[0029] Other solutions are based on standards authentication protocols as “TACACS” ® or “RADIUS” ® which permit to route authentication requests outside filter network hardware. These solutions allow the implementation of one-time passwords generation means, as above recalled. However, problems in connection to the necessity of remembering a lot of passwords and other authentication data remain again unsolved.

[0030] The invention is directed to alleviate the drawbacks of the prior art methods, some of which have just been referred to, and to meeting the stated requirements.

[0031] The main objectives of the invention are thus to allow remote users, especially Internet users, to access “friendly” and securely to given private resources protected by a firewall or the like.

[0032] To achieve these goals, means to filter remote requests are integrated in said firewall or the like. Managing of remote accesses to private resources is made from a single point. It obeys to the security policy of the domain, or more generally of the computer facility, in a consistent way. Said means are in close relation with a secured data base and control means there-of.

[0033] The users benefit of the so-called “Single Sign-On” feature. The user opens a session using one log-in and one password, or some other authentification data, and continues with the same data. Requests to access given successive private resources are under control of said centralized filtering means. From the user's side, the firewall remains transparent during a session.

[0034] It may be emphasized that the method according to the invention is only involved with protocols having a notion of authentication. For example, in the preferred application, i.e. related to Internet remote users, such protocols are “FTP”, “Telnet”, etc., but other protocols as “SMTP” (“email”), “NNTP” (“News”), etc. are not concerned.

[0035] In a preferred embodiment of the method according to the invention, authentification is performed with “One-Time Passwords”. Thus, passwords can not be re-played. This further feature is provided in combination with the implementation of centralized filtering means. It does increase dramatically the complexity and/or the cost. An authentication client which is able to handle one-time passwords must be implemented as in prior art methods. However, said client is installed once and only once in the firewall, not at the level of the different resources to secure.

[0036] The object of the invention is thus to provide a method allowing a remote user to gain a secured access to private resources of a digital data processing system protected by a firewall or the like, said method comprising at least the following steps:

[0037] an initial step comprising the stages of:

[0038] a/ implementing in said digital data processing system security storing means for storing security data, said security data comprising at least data to authenticate said user, security profiles indicating which private resources each user may use and security data associated with said private resources;

[0039] b/ implementing in said firewall centralized security means able to filter remote access requests to said private resources according to rules derived from said security data; and

[0040] operational subsequent steps comprising at least the following stages:

[0041] a/ at the user's side, a first stage comprising the opening of a session, a second stage comprising the entering of security data, including at least user's authentication data, and a third stage of requesting an access to a first private resource; and

[0042] b/ at the digital data processing system's side, a first stage, under control of said centralized security means, comprising a comparison between received security data from said remote user and said authentication data stored in said security means, in order to authenticate said remote user; if said authentication succeeds, a second stage providing said centralized security means with a security profile associated with said remote user; and a third stage providing said requested first private resource with security data allowing said remote user accessing to this first resource.

[0043] Another objet of the invention is an architecture to implement said method.

[0044] The invention will be more clearly understood and other features and advantages will emerge from reading the following description, given with reference to the appended drawings wherein:

[0045] FIG. 1 illustrates an example of an architecture allowing secured remote accesses to private resources, according to the method of the invention;

[0046] FIG. 2 illustrates an example of a firewall according to the invention;

[0047] FIG. 3 illustrates schematically a password interception by an unauthorized user;

[0048] FIGS. 4aand 4billustrate a method and a device to generate and retrieve one-time passwords.

[0049] Though the invention is not limited to remote accesses to private resource via Internet, the following detailed description will take place for such an application (which constitutes the preferred application), unless otherwise stated.

[0050] FIG. 1 illustrates a typical worldwide system comprising, for the sake of simplicity, one computer facility 1 connected to Internet 3, via a firewall 2, and various user's workstations, personal computers or terminals also connected to Internet 3, directly, WK₁to WK_x, or via a “ISP” (“Internet Service Provider”) 4, WK_ato WK_n. The computer facility 1 may be based on a LAN (not explicitly shown) and also comprises various local user's workstations. Only one is shown: workstation WK₁. Some private resources are connected to the LAN. In the described example, they are supposed to be servers, S₁to S_m. But, it must be clear that private resources may be indifferently physical machines such as servers or disks, data base, files, applications, etc. The remote users are referenced U₁to U_xand U_ato U_n, and the sole local shown user U₁.

[0051] A security server S_Sis also provided. It communicates with a security data base DB_Swhich contains security and authorization profiles of both secured or private resources, i.e. S₁to S_m, and local users, for example U₁. The security server S_Sis supposed to be under control of a security officer SO or any other authorized authority.

[0052] According to one of above-described prior art solutions, a local workstation, such as WK₁, may comprise a specific piece of security software 6, which will be called “workstation security interface”, intended to form an interface between the security server S_Sand the workstation WK₁. When a local user, such as U₁, opens a session, he enters single sign-on data and a request to access one of servers S₁to S_m, for example server S₂. A dialog is initiated between the security server S_Sand this piece of security software 6, via a bus 60. The data transmissions are enciphered. The server S_Slooks at the data base DB_Sand compares the received data (identity of user U₁, password, etc.) with the content of said data base DB_S. It authenticates the requester, i.e. user U₁, and send back a message to workstation WK₁and more precisely to its security interface 6. This message contains information on the authorization profile associated to user U₁. Authorization data is then securely stored in the station under control of the security interface 6. It contains all the resources that user U₁is authorized to access and, eventually, the specific operations he may realize. For example, he may only access servers S_yand S_z, and only perform read operations, y and z being arbitrary. Information transmitted back to the interface 6 further contains log-in data and/or passwords associated to each authorized resources. If user U₁does not stop the session in progress and requests an access to an other resource, for example to server S₁, it is not necessary to enter an other log-in and an other password. The interface 6 knows whether the requested access is possible or not. If said access is possible, the interface 6 send to the requested server or resource necessary security data. This last operation is completely transparent to user U₁.

[0053] Up to this point, the recalled architecture is common to the prior art, per se. But, the above-described solution is not realistic in order to cope with remote access requests as already demonstrated.

[0054] According to a first feature of the invention, centralized security means 5 is implemented in the firewall 2. Remote access requests to a given private resource are submitted to the security means 5. They are under control of security servers S_S. The main function is to filter said requests according to applicative filtering rules which are stored in database DB_S.

[0055] In fact, there are two levels of filtering.

[0056] FIG. 2 illustrates a more detailed block diagram of the firewall 2. It is connected to Internet 3 (FIG. 1) via a backbone B_i(incoming bus). As in the prior art, a first set of filtering rules is applied. It consists in IP addresses filtering rules. This stage is executed under control of a first module 20 which communicates with server S_S. In the described example, the lower part of block diagram 2 constitutes the kernel space. If the IP filtering rules are satisfied, incoming requests are submitted to the upper part of block diagram 2, which will be called user space. It comprises means 5 and more specifically a module 50 containing applicative services rules, established in accordance with data stored in data base DB_S, under control of server S_S. At this stage, if these further rules are satisfied, an access to the requested application is allowed. Otherwise, an access put discarded.

[0057] In case of Internet remote users, access is requested for a “FTP” application, a “Telnet” application, etc. As recalled, the invention is only involved with protocols having a notion of authentication. If needed, the other protocols may be filtered at the application level by other means, but this stage is not necessary.

[0058] In a preferred embodiment, the firewall 2 comprises intermediate circuits called “proxies”, 7_ato 7_p. A proxy acts as a relay between the user's client application (for example “FTP”) and the server application (also “FTP”). A typical proxy accepts a connection, makes a decision on whether or not the user or the client IP address is permitted to use the proxy (according to the requested server or resource, time period, etc.), possibly does additional authentication, and completes a connection on behalf of the user to the remote server or resource, through bus B_O(output bus). A proxy is thus “transparent” both for users and servers or resources (upward and downward connections, respectively). There are as many proxies as there are different types of applications: “FTP”, “Telnet”, etc. (including types not directly concerned by the invention, such as “SMTP”, etc., i.e. without a notion of authentification).

[0059] To summarize the main stages of the method according to a first aspect of the invention are as follows:

[0060] a/ A remote user, for example user U_X(FIG. 1), starts on workstation WK_X(FIG. 1) his standard “FTP” client or an other client having a notion of authentification.

[0061] b/ Said client provides a sequence of security data, especially identity of the target server, identify proves (name, role, password), etc.

[0062] c/ Following the IP routing rules, the request arrives on firewall 2 through backbone B_iand activates a proxy (7_ato 7_p) corresponding to the client started, for example “FTP”.

[0063] d/ The IP filtering rules (module 20) are applied: if the request is kept, the security interface 5 and the appropriate proxy ask for an authentication with the primary authentification data of the user (name, role, password).

[0064] f/ The security server S_Sauthenticates the user U_Xand if the authentication succeeds, the server S_Sreturns to the security interface 5, an operational profile of user U_X, and his “SSO” (“Single Sign-On”) data.

[0065] g/ If the session is maintained opened, any subsequent request to an other server or resource may be allowed or denied according to said operational profile. The security interface 5 sends requests to the server S_Swhich looks for a “SSO” line that matches the name of the asked target server or resource, the “FTP” or “Telnet” service, or optionally the name of the wanted account, if the user U_Xhas several accounts on said target server. Then, the target server or resource is provided with needed data. The application rules (module 50) are applied according to the operational profile of the user U_X.

[0066] Thus, the first feature of the invention allows remote users to access to a set of private servers or resources without need to employ several sets of authentication data, as long as the same session remains opened. Furthermore, as already noted, the firewall remains transparent to remote users and protocols.

[0067] However, as transmission paths between the user's workstation, for example WK_a(FIG. 1) and the firewall 2 are not secured, the “SSO” data, especially the passwords can be “listened” by a non-authorized user. FIG. 3 illustrates a non-authorized user U_NAintercepting a “SSO” traveling on a channel CH. Same data may be copied from the “ISP” station 4 (FIG. 1) which constitutes a transmission node and where they are temporary stored.

[0068] In a preferred embodiment, according to an other aspect of the invention, authentication is performed with “OTPs” (“One-Time Passwords”).

[0069] Per se, “OTP” technologies are well known. As an example it may be referred to the system called “SecureID” ®. It may be also referred to the U.S. Pat. No 5,657,388 (Kenneth P. Weiss), entitled “Method and apparatus for utilizing a token for resource access”, or to the article by McLellan: “The future of Data Security looks Credit-Card Thin”, in “Information Week”, Oct. 7, 1985, pp. 24-30.

[0070] Acoording to said technology, a first device, resident in each remote user's station, generates “OTPs” which can not be re-played. This technology is based on Hash codes.

[0071] FIG. 4aand 4billustrate an example of an “OTP” technology implemented in the architecture according to the invention.

[0072] FIG. 4aillustrates schematically a method to generate an “OTP”. The generator 8 comprise a clock unit 80 which produces continuously time words 800, at least on a regular time interval basis. A Hash function 82 combines a “secret” 810 with the time word 800 in order to generate password codes 820. Said password codes 820 consist in digital words, having for example 4 to 6 digits, and which changes regularly, for example every 1 minute. The secret number 810 may be a “hardwired” word, stored in a ROM 81 implemented in an integrated circuit card SMC_ifor example. Said card SMC_iis associated to a user's workstation WK_i(FIG. 4b). The integrated circuit card SMC_iacts as a small calculator and further combines password codes 820 with security data entered by the user U_i(FIG. 4b), e.g. a personal identification number (“PIN”) which do not change. If we call A and B the log-in and the user's password, respectively, a “OTPs” sequence, transmitted to the computer facility 1 (FIG. 4b), is A-B′, A-B″, etc.

[0073] In the computer facility 1, the security data base DB_Sstores a list of secret numbers, each associated with one the workstation WK_i, or more exactly with a secret number stored in one of the integrated circuit card SMC_i. The security server S_Scomprises a clock unit 80′, synchronized upon the clock unit 80, or alternatively it receives synchronized time signals. These two information data allow it to retrieve initial correct security data A-B, though the password part is continuously changing (B′, B″, etc.). The user U_iis thus authenticated and his requests are handled according to his recognized rights. On the other hand, even if an unauthorized user U_NA(FIG. 3) intercepts one of the “OTPs” and attempts to re-play it, his request will be denied.

[0074] Though allowing an authentication performed with “OTP”, the method of the invention remains quite simple to implement. Contrary to the prior art methods, the authentication module which is able to handle one-time passwords is centralized. In other words, the method does not need multiple implementations (in each resource to be securely accessed) which are very expensive and increases complexity.

[0075] A reading of the above description confirms that the invention achieves the stated objectives.

[0076] The comfort afforded to a remote user is enhanced as he has to remember only one security data set, such as a password and a log-in, for example.

[0077] The security of the authentication stage is guaranteed though the transmission network is not secured, or even is highly insecure (Internet case).

[0078] The authentication function and its managing are centralized (“one point”). Despite this centralization, the declaration of a connection name and the attribution of a password common to all remote accessible resources are avoided.

[0079] The modifications made in the final user's workstation or terminal are minimized.

[0080] The secured resources do not need to be modified, or at least not significantly modified.

[0081] The filtered protocols, which are a priori standardized, do not need to be modified.

[0082] It should be clear however that the invention is not limited to the embodiments previously described, in particular with reference to FIGS. 1 to 4b. As a matter of facts, as already stated, the invention is not limited to the authentication of Internet users, nor even remote users on a WAN (Wide Area Network). The invention also applies to the authentication and the protection of remote access requests to some private resources located in all kind of systems having a firewall or the like: filtering router, telephone access server, etc.