Network protecting authentication proxy

[0001] The invention generally relates to authenticating with a resource, e.g., user login for resource access, and more particularly to providing a front-end to process certain authentication requests, such as ones from an extranet, to allow the front-end to facilitate avoiding authentication lockouts.

[0002] Corporations and other entities often have bifurcated networks comprised of an “intranet” and an “extranet.” An intranet is generally accessible only by the corporation's employees, associates, and machines having authorization to access the intranet. An extranet is generally considered to be a network portion that is not directly part of the intranet, but that is communicatively coupled with the intranet and an external network, such as the Internet, through a firewall or other security barrier. An outsider, e.g. an entity of the external network, seeking access to an externally facing application or intranet resources may contact an extranet server which would prompt the outsider for security credentials, e.g., a username and password for an authorized account, that would be evaluated to determine the outsider's authorization to access the intranet.

[0003] Often, the extranet authentication infrastructure maintains user accounts duplicating valid accounts on the intranet to enable intranet users to use outward facing applications by validating against a duplicate set of security credentials. But, while this may enable use of the extranet application by intranet users, significant password synchronization problems may result. In addition, there may be difficulty in propagating new accounts between intranet and extranet servers. One common solution to these problems is to have the extranet application server pass security credentials which are directly validated against an authentication server for the intranet, e.g., the intranet's login server. This configuration removes the risk that the intranet and extranet servers may be out of sync, and other problems.

[0004] Unfortunately, by effectively allowing access to the intranet's authentication server from the extranet, the intranet becomes susceptible to attack, such as a denial of service attack. For example, most authentication servers only allow a certain number of improper authentication attempts, such as three attempts, before an account is blocked. Thus, if the extranet is allowed direct access to the intranet authentication server, an external malicious party can block network access for an employee, such as a high level executive, simply by intentionally performing incorrect extranet-based authentication requests. Lockouts may also occur in the process of performing a brut-force password-cracking attempt.

[0011] FIG. 1 illustrates an exemplary system according to one embodiment for authenticating an outsider with an intranet (internal) authentication system, without invalid authentications resulting in being locked out from the intranet. Illustrated are three regions 100, 102, 104 corresponding to a public network 100, such as the Internet, an extranet 102, and an intranet 104.

[0012] An external machine 106 on the external network, such as a client computer, handheld device, etc., may seek access to intranet 104 resources, such as resources of an intranet server (not illustrated), through the extranet 102. The external machine is communicatively coupled with an application 108 that has an external facing interface reachable over the public network. For example, the application may be an “ebusiness” application, business-to-business (B2B) application, accounting program, application for traveling employees, a web server, or other application to which authorized intranet users may require access externally. It will be appreciated that the application may reside on a machine on the intranet, extranet, or external network, with appropriate communication links (or tunnels) provided to allow resource access.

[0013] As will be discussed further below, the application 108 is configured to authenticate the external machine 106 (or user thereof), before allowing the external machine access to intranet 104 resources. Towards this end, the application 108 is communicatively coupled with an authentication front-end 110 which operates to receive authentication information, e.g., security credentials, from the application 108 and present the security credentials to an internal authentication system 112 of the intranet, such as a login server or other account authenticator. In one embodiment, the authentication front-end is a proxy for the internal authentication system.

[0014] However, rather than simply forwarding the security credentials to the internal authentication system 112, instead the authentication front-end 110 first queries the authentication system to determine login rules and/or a current status for the security credentials to make sure a login attempt does not risk locking out the security credentials due to excessive invalid authentication attempts. For example, if the external machine 106 attempts to access the intranet 104 with a user identifier “Joe” and a password “Secret” as security credentials, the external machine provides these credentials to the application 108, which provides them to the authentication front-end. The authentication front-end then queries the authentication system 112 for information relating to the credentials to determine whether a lockout condition may occur.

[0015] Assume a security policy allows three incorrect logins before locking out an account. The authentication front-end may determine, for example, that two previous incorrect attempts have occurred, and thus a third invalid attempt would result in locking out the account. The authentication front-end may then decide to generate a login error to the external machine, as if the security credentials had been provided to the authentication system, but without having actually risked their presentation. Thus, if the “Joe” account is under attack from the external network 100, Joe will nonetheless still be able to log in from the intranet, while leaving extranet access denied. It will be appreciated that various policies or decision systems can be employed to determine if and when to resume extranet access to a particular account. For example, a time out period may be employed, an administrator may be required to review the lockout and approve extranet reinstatement, the account owner may be sent a message requesting the account owner to validate the extranet access attempts when back on the intranet (e.g., the account owner may be requested to acknowledge that the account owner was the source of the extranet authentication failures before extranet access is allowed), etc.

[0016] It will be appreciated that various technologies may be employed to allow the authentication front-end 110 to access information relating to the credentials to determine whether a lockout condition may occur. For example, in one embodiment, the internal authentication system 112 is based on a Microsoft Active Directory Server (or equivalent), and the authentication front-end operates as a proxy for the directory server and is thus able to query the directory server for account status information. In one embodiment, the authentication front-end 110 utilizes the Lightweight Directory Access Protocol (LDAP) (see Internet Engineering Task Force (IETF) Request for Comments (RFC) 2251-2254) to query the directory server for lockout conditions for the security credentials. In another embodiment, the authentication front-end utilizes the International Organization for Standardization (ISO)/International Telecommunication Union (ITU) X.500 standard to query the directory server. Note that even though the application 108 and front-end 110 are shown separately, it will be appreciated they may be embodied within a single machine 114 or implemented as a single application program (the dashed lines represent potential combination).

[0017] In the illustrated embodiment, security boundary 116 defines a boundary between the external network 100 and the extranet 102, and may be implemented with a firewall or other gateway to limit communication between the external machine 106 and the application 108. Similarly, in the illustrated embodiment, there is a security boundary 118 defining a boundary between the extranet and the intranet 104. It will be appreciated that the authentication front-end 110 may operate in conjunction with various authentication protocols, including Radius, Kerberos, and other authentication infrastructures.

[0018] FIG. 2 illustrates a data flow diagram according to one embodiment for the FIG. 1 system. An external machine 106 seeks to access resources on an intranet or authenticate to an extranet application, e.g., FIG. 1 region 104. Towards this end, the external machine sends data 200 to initiate a communication session with an application 108 having an externally facing interface or interfaces. The application 108 responds by sending an authentication request 202 requesting the external machine to identify itself, e.g., to proffer security credentials. In response, the external machine provides security credentials 204.

[0019] After the application 108 provides the security credentials 204, the application forwards the credentials 206 to an authentication front-end 110. Note that the credentials 204, 206, while having different reference numerals, may be the same credentials, e.g., the forwarded credentials 206 may be identical to the received credentials 204; alternatively, the application may alter or change the credentials before forwarding them on, such as to convert or transcode between different authentication systems. Thus, in one embodiment, the application operates to convert or transcode between authentication systems to allow a new incompatible protocol, or an older disused protocol, to be used.

[0020] As discussed above for FIG. 1, In contrast with conventional authorization schemes where the internal authenticator 112 would be requested to validate the security credentials, and thus risk a lockout from malicious external network activity, instead the authentication front-end 110 queries 208 the internal authenticator to determine if the account for the security credentials 206 risks an invalid authentication threshold. That is, the authentication front-end may query the internal authenticator to determine how many invalid authentication requests remain before the account would be locked out. If the threshold is near, the authentication front-end may elect to deny external network access to preserve intranet access to the account.

[0021] The authenticator sends a response 210 indicating the current state of the account. For example, assuming lockouts are based on the number of invalid attempts, the response could indicate the account is allowed three invalid login attempts, and that two invalid login attempts have been recorded. If the account is not at threshold risk, then the authentication front-end 110 may present security credentials 212 to the internal authenticator 112. As discussed above, it will be appreciated that the provided security credentials 212 may be received security credentials 204, or modified security credentials. The internal authenticator sends a response 214, which may a grant of access, or a denial of access. This grant or denial will be cascaded 216, 218 with appropriate security credential modifications or conversions, if necessary, back to the external machine.

[0022] FIG. 3 is a flowchart according to one embodiment.

[0023] An external machine 106 seeks to access resources on an intranet, and initiates 300 a communication session with an application having an externally facing interface. In one embodiment, the application may receive contact from both an intranet and an external network, and thus a test is performed to determine if 302 the contact is from an external network. If external, the application responds 304 with an authentication request for the external machine to identify itself, e.g., to proffer security credentials. In response, the external machine provides 306 security credentials.

[0024] It will be appreciated that a variety of application programs and/or hardware may be engaged in the exchange of security credentials. For example, the external machine may be a computing device operating an Internet-type browser, and the application may be a public portion of an Internet web server. The browser may contact the web server, receive an instruction to display a username/password dialog box, in response to which a user of the external machine fills in requested credentials and submits the credentials back to the web server. Or, the external machine's operating system may be attempting to establish an encrypted or secure tunnel, and the application may be a publicly accessible virtual private network (VPN) server. Or, well-known authentication systems for use over conventional physically insecure networks may be modified to implement disclosed embodiments. (See FIG. 4.)

[0025] The provided 306 security credentials are then forwarded 308 to an authentication front-end 110 which attempts to query 310 an internal authenticator to determine whether attempting to validate the provided 306 security credentials risks locking out the account identified in the security credentials. If 312 the account is at risk of being locked out, then the authentication front-end returns 314 an authentication error to the external machine without having actually formally attempted to validate the security credentials with the internal authenticator. If 312 the account is not at risk, then the provided 306 security credentials are sent 314 to the internal authenticator for authentication. The internal authenticator responds 318 indicating authentication success or failure. However, it is known even if authentication fails due to a malicious attack from the external network, the account remains accessible from the intranet.

[0026] If 302 the communication initiation was not from an external source, then conventional authentication 320 may be performed, e.g., the operations of boxes 304, 306, 316, and 318 without using an authentication front-end to pre-validate login.

[0027] FIG. 4 illustrates a flowchart according to one embodiment for modifying Kerberos authentication. Kerberos, as described in RFC 1510, is a well-known authentication system that facilitates identity verification, prevents eavesdropping and replay attacks, and provides data stream integrity and secrecy.

[0028] Kerberos operates by providing principals (users or services, e.g., of external machine 106) with “tickets” used to identify themselves, and cryptographic keys for securing communication. In one embodiment, Kerberos is modified to recognize zones from which authentication is being attempted, e.g., to recognize authentication over an intranet, e.g., FIG. 1 region 104, versus contact from an external network, e.g., FIG. 1 region 100. It is assumed Kerberos authentication occurs on a first machine separate from a second machine having a desired resource; the second machine may be different from a third machine receiving login credentials. The second and third machines may be the same machine.

[0029] Security credentials are received 400, for example, incident to entering a user name and password to login to external machine 106. A test is performed to determine if 402 the contact is from an external source, e.g., the external network. If authorization is attempted from an extranet, a check 404 is performed to determine whether attempting to authenticate the security credentials may result in an account lockout. As discussed above, in one embodiment, a Microsoft Active Directory Server or other device tracking account status data such as login policies, the number of invalid login attempts, etc. may be queried. If pre-authentication is being used, this check 404 is made before Kerberos attempts to pre-authenticate the login, as pre-authentication failure can incur a lockout. In one embodiment, the Kerberos server may incorporate Microsoft Active Directory Server services and be able to directly determine risk of lockout, e.g., the Active Directory Service is acting as the store that contains state data about lockout conditions.

[0030] If 406 there is a lockout risk, then an authentication error is returned 408 without actually attempting the Kerberos authentication process. If lockout is not a risk, then authentication may occur normally. That is, the external machine contacts 410 an initial ticketing server such as a Kerberos Initial Ticketing Service (KITS), or, in a Windows environment such as Windows 2000, contacts the nearest Active Directory Key distribution center (KDC). To prevent password guessing, the KITS/KDC may send the external machine pre-authentication data, such as a random sequence that has been encrypted with a secret key associated with the login credentials. When received 412, the external machine must decrypt the pre-authentication data to prove 414 it knows the correct password. After supplying this proof, the external machine identifies 416 to a Ticket Granting Server a server it wishes to contact, e.g., a server having a desired resource, such as a file, directory, etc. The Ticket Granting Server responds 418 with a session ticket including a unique session key that is dual-encrypted with respect to the login credentials and with a secret key for the server to be contacted.

[0031] In one embodiment, rather than modifying an authentication system, e.g. Kerberos or another system, instead the invention operates as a wrapper about the system. That is, the invention may be configured to listen on a communication channel typically used by the authentication system, e.g., Transmission Control Protocol (TCP)/Internet Protocol (IP) port 88 for Kerberos, receive an initial contact from the external machine, perform the preliminary check against a lockout condition, and if no lockout is threatened, then tunnel further authentication communication between the external machine and the authentication system.

[0032] If 402 the authentication security credentials were not received from the external network, then authentication proceeds conventionally as discussed above, e.g., as if an account were not at risk for a lockout. It will be appreciated by one skilled in the art that the above Kerberos description leaves out many operational details of Kerberos authentication to facilitate readability. It should further be appreciated that the disclosed principles are applicable to most if not all other authentication systems.

[0033] FIG. 5 and the following discussion are intended to provide a brief, general description of a suitable machine in which certain aspects of the illustrated invention may be implemented. As used herein, the term “machine” includes a single machine, such as a computer, handheld device, transportation device, etc., or a system of communicatively coupled machines or devices.

[0034] Typically, a machine 500 includes a system bus 502 to which is attached processors 504, a memory 506, e.g., some state preserving medium, storage devices 508, a video interface 510, and input/output interface ports 512. The machine may be controlled, at least in part, by input from conventional input devices, such as keyboards, mice, etc., as well as by directives received from another machine, interaction with a virtual reality (VR) environment, biometric feedback, or other input source or signal.

[0035] The machine may include or be embodied in embedded controllers, such as programmable or non-programmable logic devices or arrays, Application Specific Integrated Circuits, embedded computers, smart cards, and the like. The machine may utilize connections to one or more remote machines 514, 516, such as through a network interface 518, modem 520, or other communicative coupling. Machines may be interconnected by way of a physical and/or logical network 522, such as the FIG. 1 intranet 104, external network 100, the Internet, local area networks, and wide area networks. One skilled in the art will appreciated that network 522 may utilize various wired and/or wireless short range or long range carriers and protocols, including radio frequency (RF), satellite, microwave, Institute of Electrical and Electronics Engineers (IEEE) 802.11, Bluetooth, optical, infrared, cable, laser, etc.

[0036] The invention may be described by reference to or in conjunction with associated data including functions, procedures, data structures, application programs, etc. which when accessed by a machine results in the machine performing tasks or defining abstract data types or low-level hardware contexts. Associated data may be stored in, for example, volatile and/or non-volatile memory 506, or in storage devices 508 and their associated storage media, including hard-drives, floppy-disks, optical storage, tapes, flash memory, memory sticks, digital video disks, biological storage, etc. Associated data may be delivered over transmission environments, including network 522, in the form of packets, serial data, parallel data, propagated signals, etc., and may be used in a compressed or encrypted format. Associated data may be used in a distributed environment, and stored locally and/or remotely for access by single or multi-processor machines, portable computers, handheld devices, e.g., Personal Digital Assistants (PDAs), cellular telephones, tablets, etc.

[0037] Thus, for example, with respect to the illustrated embodiments, assuming machine 500 includes the application 108 of FIG. 1, remote machines 514, 516 may respectively include the authentication front-end 110 and the internal authentication system 112. It will be appreciated that remote machines 514, 516 may be configured like machine 500 and include many or all of the elements discussed for the machine.

[0038] Having described and illustrated the principles of the invention with reference to illustrated embodiments, it will be recognized that the illustrated embodiments can be modified in arrangement and detail without departing from such principles. And, though the foregoing discussion has focused on particular embodiments, other configurations are contemplated. In particular, even though expressions such as “in one embodiment,” “in another embodiment,” or the like are used herein, these phrases are meant to generally reference embodiment possibilities, and are not intended to limit the invention to particular embodiment configurations. As used herein, these terms may reference the same or different embodiments that are combinable into other embodiments.

[0039] Consequently, in view of the wide variety of permutations to the embodiments described herein, this detailed description is intended to be illustrative only, and should not be taken as limiting the scope of the invention. What is claimed as the invention, therefore, is all such modifications as may come within the scope and spirit of the following claims and equivalents thereto.