RU2626664C1 - Method of access granting to distributed data and computational resources as corporate portals via protected virtual environment - Google Patents

Abstract

FIELD: information technology.

SUBSTANCE: method includes identification of a portal network user by an active session and authentication of unidentified users by one of the access nodes of the protected virtual environment by the presence of user session attributes represented by the user session ID and authentication factors signed by the central node or the backup central node. And user authentication data is stored only in the central node LDAP server and the backup central node LDAP server of the protected virtual environment. The request for access to the data and computational resource is processed by one of the access nodes of the protected virtual environment that authenticates the user's session in the central node. As a result of successful authentication of the client PC user session, the central node, as a response to the request, sends the user session attributes to the access node, which the access node first saves in the access node LDAP server. The access node then checks the privilege of the user's access to the requested data of the data and computational resource and, as a result of the successful verification, provides access to them. And in the case of a user request to another data and computational resource, the user session authentication is performed by checking the session data attributes stored in the access node LDAP server.

EFFECT: increased reliability and protection of data from unauthorized access.

5 dwg

Description

The invention relates to the field of computer technology and can be used to provide secure access based on open data transfer protocols to distributed information and computing resources, presented in the form of corporate portals, through a secure virtual environment in global networks.

In the framework of this application, the following terms mean:

Corporate portal is an information system for presenting data of information and computing resources in the form of a web interface for organizing secure, delineated, collective access to information.

The architecture of building a virtual environment is the principle of building and organizing the operation of the main components of a virtual environment and communication protocols within a virtual environment.

Information and computing resource - a set of data stored on personal computers, integrated into the local network of the enterprise and presented in the form of a corporate portal.

Authentication - verification of the identity presented by the user.

Authorization - granting a certain person or group of persons the right to perform certain actions.

Open protocols are publicly available and non-secret technical specifications for communication that does not have a copyright holder.

At the time of the development of the invention, corporate portals on the Internet became a universal tool for interacting with the user, and more and more commercial structures, government bodies, various associations are guided in this approach by building their information systems. Corporate portals have a different meta-structural organization and are implemented on different hardware and software platforms using various, sometimes incompatible, technologies. The unification of their structures located on distributed nodes of the network, and access to them, as is known from the prior art, is an extremely laborious and expensive way to solve the problem.

The technical solution according to patent RU 2106014 (Published: 02/27/1998) is known from the prior art, namely, an information and computing system, the operation of which is based on realizing user identification and providing local access to the information and computing resources of the system using data encryption / decryption based keys generated by the device, including passing authentication and authorization procedures based on public keys, encryption and decryption of transmitted data, providing access to Ursu network based on user access rights.

The disadvantage is that this solution is intended to provide local access to a specific information and computing resource of the system, and not with the aim of gaining access to the resources of a distributed network based on centralized user authorization.

The technical solution according to patent RU 2169942 (Published: 06/27/2001) is known in the form of a distributed protection system for computer networks, which improves the functioning of a distributed protection system by making it possible for the security server to identify three states of the protection object, for example, a workstation or an information server where the agent of the distributed protection system is installed: "normal operation mode", "the agent of the protection system is deleted on the protected object - fix mode unauthorized access "," the protected object is physically disconnected from the network ", which allows providing an effective policy of a distributed protection system in the network.

The disadvantage is that this solution only allows you to track and reduce the risk of an attack or unauthorized access to a network resource due to the state of installed agents. In a distributed computing environment, installing and monitoring each resource using these measures is inefficient.

The prior art knows the technical solution according to the patent US7017183 System and method for administering security in a corporate portal (Published 2006-03-21). The system and method for administering security of a corporate portal described in the patent is based on the use of corporate portals to provide access to portal resources, including the organization of distributed information and computing resources based on corporate portal technology, organizing access to portals using web interfaces, determining rights user access using domain groups, encryption and decryption of transmitted data, providing access to a network resource based on Research Institute of user access rights.

The disadvantage is that this solution implies that in order to access each portal it is necessary to go through user authentication and authorization procedures. Also, during the authentication procedure, the use of security measures is not provided, except for a combination of username, domain and password. In addition, this solution is characterized by poor fault tolerance.

For the prototype, the method described in the article “Single model session in the distributed network” dated May 22, 2014, by I.S. Konstantinov, S.A. Lazarev, O.V. Mikhalev, which includes the implementation of a single user session mechanism in a network of portals, the possibility of creating user sessions in the event of a central node failure by using active replication of session data from access nodes to the central node and subsequent passive replication in the opposite direction, the ability to identify a user of a network of portals by active session and authentication requirement for unidentified users.

The implementation of the model described in the article provides one-time user authentication and one arbitrary entry point into the network of portals, regardless of which access nodes the first and subsequent calls occurred to, even when the central node is unavailable. The method provides reliability and fault tolerance of the portal network, as well as minimizing the required costs.

The disadvantage of this method is that authentication data as a result of passive replication is stored not only on the central node, but also on the access nodes, and therefore the risk of unauthorized access to confidential information increases, i.e., the method does not ensure compliance with international standards for storage security and data transmission in global distributed networks.

The objective of the invention is to provide a method that eliminates these disadvantages of the prototype.

Technical result:

- improving reliability and fault tolerance by introducing into the method of duplication of authentication data on the backup central node of a secure virtual environment by passively replicating them from the central node. At the same time, there remains the possibility of a centralized user authentication process in a secure virtual environment for access to distributed information and computing resources in the form of a network of corporate portals;

- increasing the security of information due to the fact that authentication data is stored only on the central node and the backup central node of the secure virtual environment, and on the access nodes store only the attributes of user sessions represented by the user session identifier and authentication factors signed by the specified central node or the backup central Node that provides compliance with security standards for wide area networks.

The problem is solved by the proposed method, including a centralized authentication process for users of a secure virtual environment with passive replication, creating sessions in the event of a central node failure, implementing a single user session mechanism, identifying a protected virtual environment user by an active session, and performing authentication for unidentified users in which The following new and unknown from the prior art features have been introduced:

- in the centralized authentication process of users of a secure virtual environment, passive replication of authentication data from a central node, in contrast to the prototype, is carried out to a backup central node, which allows to increase the fault tolerance and reliability of a protected virtual environment due to the introduction of a backup central node in case of failure central node. Thus, user authentication data is stored only on the central node and the backup central node of a secure virtual environment, as a result of which compliance with world standards for data security in global networks is achieved;

- the user of the protected virtual environment is authenticated by the active session and the user session is authenticated on the access nodes by checking the attributes of the session data stored on the LDAP server of the corresponding access node, while the session data attributes are represented by the user session identifier and authentication factors signed by the central node or a backup central site. Storage of attribute data allows the access node to authenticate the user session at the central node or at the backup central node;

- providing the user with access to the data set of the requested information resource in case of a positive result by the access node checking the user's access privileges.

The invention is characterized in the following figures.

FIG. 1 shows a simplified architecture diagram of a secure virtual environment for implementing the proposed method.

FIG. Figure 2 shows a detailed diagram of the protected architecture of a virtual environment, which displays the main components of the nodes of a protected virtual environment and shows the recommended open protocols that communicate between the components.

FIG. 3 shows a user access mechanism to an information and computing resource within a secure virtual environment.

FIG. 4 shows the procedure for passing the authentication procedure by the user on the central node of the network to gain access to distributed information and computing resources in the form of corporate portals through a secure virtual environment.

FIG. 5 shows the procedure for passing the authentication procedure by the user on the backup central node to gain access to distributed information and computing resources in the form of corporate portals through a secure virtual environment.

The method is implemented using the developed architecture of a secure virtual environment, a simplified view of which is shown in FIG. 1. As shown in FIG. 1, a plurality of client PCs 1 located in a global network interacts with a secure virtual environment including a central node 2, a plurality of access nodes 3 and at least one redundant central node 4, while the node 2 and the node 4 are server computers . A secure virtual environment provides access for users of client PCs 1 to distributed information and computing resources 5, each of which is a collection of data stored on personal computers, integrated into the local network of the enterprise and presented in the form of corporate portals. The number of redundant central nodes 4, to which the central node 2 makes passive replication of authentication data, is determined by the organizer of the secure virtual environment, based on reasons of expediency. The presence of additional redundant central nodes 4 increases fault tolerance, but on the other hand can lead to an increase in the time for providing access.

The user’s access to information and computing resources 5 begins with the formation of an access request for client PC 1, which is a personal computer containing an Internet connection module and a memory module that stores software components (Fig. 2) that allow encryption and decryption of transmitted data using a cryptographic library 6, and also provide access to the user to information and computing resources 5 through a web browser 7, with built-in scenes 8 with hints of authentication and access scenarios 9.

The access request from the client PC 1 arrives at the access node 3 of the secure virtual environment to authenticate the session. If the session data attributes represented by the user session identifier and authentication factors signed by the central node 2 or the backup central node 4 are stored on the access node 3 and the session is authenticated, the access node 3 checks the access privileges of the user of client PC 1 and in the case of a positive result, provides access to the user of PC1 to the totality of data stored on the personal computers of the requested information resource 5. if the session is not authenticated, access node 3 sends a request to the central node 2 that provides network administration, including user authentication and passive replication of user data to the backup central node 4. Central node 2 is a server computer containing a connection module to the Internet and a memory module, including software components that allow for interaction with the user of PC1 through the web server 10, with built-in script the processing of user forms 11 and authentication services 12, provide time synchronization inside a secure virtual environment using a time server 13, encrypt and decrypt the transmitted data using a cryptographic library 14, and store intranet data on an LDAP server 15 (Fig. 2).

The result of the authentication of the user session of the client PC 1, the central node 2 in the form of a response to the request is sent to the access node 3, which is a server computer containing an Internet connection module and a memory module including software components (Fig. 2) that allow verification the correctness of user sessions on the central node 2 or the backup central node 4, the processing of user requests and determine the privilege of user access to the requested information tionally 5-computing resource via the Web server 16 including the authentication scenarios 17 and 18 access services, intranet store data, including user session state attributes LDAP server 19 and encrypt and decrypt data transmitted through a cryptographic library 20.

If the session is authenticated, access node 3 saves the user session attributes represented by the user session identifier and authentication factors signed by central node 2 on the LDAP server 19. If the session is not authenticated, access node 3 sends a request to PC1 to carry out the authentication procedure on the central node 2 or on the backup central node 4, providing the functions of the central node 2 when it fails. The redundant central node 4 is a server computer containing an Internet connection module and a memory module, including software components that allow interacting with a user through a web server 21, with built-in scripts for processing user forms 22 and authentication services 23, to ensure time synchronization inside a secure virtual environment using a time server 24, to encrypt and decrypt the transmitted data using cryptographic library 25, and store data on the intranet LDAP server 26 (FIG. 2).

After successfully passing the authentication procedure on the central node 2 or on the backup central node 4, the user PC1 sends a second request for access to information and computing resources 5 for the client PC 1 to the access node 3, which sends a request to the central node 2 for session authentication. Session authentication from the central node 2 arrives at the access node 3 in the form of session data attributes represented by the user session identifier and authentication factors signed by the central node 2 or the backup central node 4. After this, the access node 3 stores the session data attributes on the LDAP server 19 and checks the privileges of user access. In the case of a positive result, provides access to the user PC1 to the set of data stored on the personal computers of the requested information resource 5, integrated into the local network of the enterprise in the form of a corporate portal through the web server 27 (Fig. 2). The denial of access to the requested information and computing resource 5 is received on PC1 in case of unsuccessful authentication of the user or if the user access privilege is negative.

The proposed method provides for the implementation of a single user session due to the fact that when a user of PC1 with an active session accesses any other access node 3, the authentication procedure is not required to access other information and computing resources of 5 corporate portals.

EXAMPLES

Examples include providing access to two computing resources. The first information and computing resource is presented in the form of a university corporate portal, including, for example, a public section, access to the data of which is provided to all registered users, and a closed subsection of the educational and scientific laboratory of information-measuring and control complexes and systems, access to which is provided only to privileged to users.

The second information and computing resource is represented by the corporate portal of a commercial company, including, for example, a public information section accessible to all registered users and a closed subsection for company employees, access to which is provided only to privileged users.

The secure virtual environment is represented by the central node 2, the backup central node 4, the first access node 3 and the second access node 3.

Access to information resources is provided to two users.

The first user is an employee of the educational and scientific laboratory of information-measuring and control complexes, and has access to both public sections and privileged access to the closed subsection of the first information-computing resource. The second user has access only to public sections of information and computing resources.

Example 1

In this example, the process of the first user accessing the data of the closed subsection of the educational and scientific laboratory of information-measuring and control complexes and systems of the corporate portal of the university is considered.

For example, the first user of PC 1 is registered in a secure virtual environment, and has an active session, the authentication data of which is stored on the LDAP server 15 of the central node 2 and on the LDAP server 26 of the backup central node 4, and the session attributes represented by the user session identifier and authentication factors signed by the central node 2 are stored on the LDAP server 19 of the first access node 3.

To access the data of the first information and computing resource 15, namely, the data of the closed subsection of the educational and scientific laboratory of information-measuring and control complexes and systems of the corporate portal of the university, the first user sends an access request to this resource to one of the access nodes 3.

In the case when the request arrives at the first access node 3, authentication of the session of the first user will be successful.

In the case when the request arrives at the second access node 3, the session authenticity of the first user cannot be established due to the absence of 3 session attributes on the second access node. In this case, the second access node 3 establishes a connection with the central node 2. In the case when the connection with the central node 2 is not established, the second access node 3 makes a connection with the backup central node 4. As a result of the successful authentication of the session of the first user on the central node 2 or on the backup central node 4, user session attribute data represented by the user session identifier and authentication factors signed by the central node 2 or by the central central node 4, write to the second access node 3. After the authentication of the session of the first user, the second access node 3 checks the privilege of access to the data of the subsection of the educational and scientific laboratory of information-measuring and control complexes and systems of the corporate portal of the university and as a result of confirmation of privilege the first user gains access to the requested data of the computing resource.

Thus, the claimed method implements a model of a single user session, in which the user does not need to go through the re-authentication procedure.

Example 2

In this example, we consider the process of attempts by a second user to access data from an information-computing resource 15, namely, data from a closed subsection of the educational and scientific laboratory of information-measuring and control complexes and systems of the university’s corporate portal.

The second user is registered in a secure virtual environment, but does not have an active session.

To attempt to access the data of the closed subsection of the educational and scientific laboratory of information-measuring and control systems and systems of the corporate portal of the university, the second user sends an access request to this resource to one of the access nodes 3.

Since none of the access nodes 3 contains data about the active user session, in this case there is no difference which access node the request came to, therefore the example considers the case when the request is processed by the first access node 3.

Due to the lack of data on the active user session, the authenticity of the second user's session by the first access node 3 cannot be established, therefore, the first access node 3 establishes a connection with the central node 2. In the case when the connection to the central node 2 cannot be established, the first access node 3 connects to the backup central node 4. Next, the central node 2 or the backup central node 3 authenticates the session of the second user, as a result of which the first access node 3 is semi gives a response about the absence of an active session of the second user.

Next, the second user PC1 performs the procedure shown in FIG. 4. In the case when the central node 2 is available, the second user of the client PC1 receives an authentication request on the central node 2 from the first access node 3. This request is processed by the web browser 7 of the client PC1, after which it establishes a connection between the client PC1 and the central node 2 and sends an authentication request to client PC1 to central node 2. Central node 2 checks the authentication data on the LDAP server 15 and registers a new session of the second user, then passes explicit replication of session data to the backup central node 4. And if the central node 2 determines that the authentication data is incorrect, then authentication is denied to client PC1.

In the case where the central node 2 is unavailable, the procedure shown in FIG. 5. The second user receives an authentication request on the backup central node 4 from the first access node 3. This request is processed by the web browser 7 of the client PC1, after which the client PC1 of the second user is connected to the backup central node 4 and sends the authentication request of the client PC1 to the backup central node 4. The redundant central node 4 verifies the validity of the authentication data and registers a new session of the second user.

After successful authentication, the second user makes a second request to the first access node 3 to gain access to the data of the closed subsection of the educational and scientific laboratory of information-measuring and control complexes and systems of the corporate portal of the university (Fig. 3). The first access node 3 processes the second request and attempts to authenticate the session of the second user. Due to the fact that the session data is stored only on the central node 2 or the backup central node 4, and there is no information about this data on the access node 3, the access node 3 cannot establish the authenticity of the session and connects to the central node 2 or to the backup central node 4, in the case when the connection with the Central node 2 is not established. After successful authentication of the second user's session on central node 2 or on the backup central node 4, the user session attribute data represented by the user session identifier and authentication factors signed by the central node 2 or the backup central node 4 is stored on the first access node 3, which then establishes a privilege check of the second user’s access to the data of the closed subsection of the educational research laboratory s and control complexes and systems of the corporate portal of the university. As a result of the privilege check, the first access node 3 establishes the lack of privilege for the second user to access the closed subsection and sends him a message about the denial of access to the requested data.

If the second user tries to access the public section of the first computing resource 5, he repeats the procedure shown in FIG. 3. At the same time, if the attributes of the user session, represented by the user session identifier and authentication factors, are stored on the first access node 3, which is accessed by the second user, access to the requested data will be granted to it without authentication of the user session on the central node 2 or backup central node 4, as the second user has privileged access to the public section.

Example 3

In this example, we consider the process of attempting the first or second user to access data sections of the second information and computing resource 5.

In the event that the user tries to access the public information section of the second information and computing resource 5, the procedure shown in FIG. 3. Since the user has privileged access to this section, access to the requested data will be provided to him.

If the user tries to access the data of the private subsection of the second information and computing resource 5, he will receive a message about the denial of access to the requested data, since he does not have privileged access to the private subsection of the second information and computing resource 5, unlike the users employees of a commercial company who have privileged access to the private subsection of the second information and computing resource 5.

The implementation of the proposed method is not limited to using only those protocols, which are shown in figure 2.

The above examples confirm the feasibility of the claimed method with the achievement of the specified technical result:

 - improving reliability and fault tolerance by introducing into the method of duplication of authentication data on the backup central node of a secure virtual environment by passively replicating them from the central node;

- increasing the security of information due to the fact that authentication data is stored only on the central node and the backup central node of the secure virtual environment, and on the access nodes only user session attributes are represented by the user session identifier and authentication factors signed by the specified central node or the backup central Node that ensures compliance with security standards for wide area networks;

- at the same time, there remains the possibility of a centralized user authentication process in a secure virtual environment for access to distributed information and computing resources in the form of a network of corporate portals.

Claims (1)

A method of providing access to distributed information and computing resources in the form of corporate portals through a secure virtual environment, including the implementation of a single user session mechanism in a network of portals through a centralized authentication process for users of a distributed network of portals with passive replication, creating sessions in the event of a central node failure, network user identification portals for an active session and authentication for unidentified users leu, characterized in that in the centralized authentication process of users of a distributed network, passive replication of authentication data from the central network node is carried out to the backup central node, while user authentication data is stored only on the LDAP server of the central node and the LDAP server of the central backup node of the protected virtual environment to access an information and computing resource, it processes one of the access nodes of a protected virtual environment, which produces verification of the authenticity of the user session on the central node, as a result of the successful authentication of the user session of the client PC user, the central node, in the form of a response to the request, sends to the access node user session attributes represented by the user session identifier and authentication factors signed by the central node, which the access node first saves on the LDAP server of the access node, then checks the privilege of user access to the requested data information -vychislitelnogo resource, and then, as a result of a successful verification, providing access to them, and in the case of a user to other information resources check the authenticity of the user session query is performed by checking the session attribute data stored in the LDAP node to access the server.

Images