System and method for authenticating clients in a client-server environment

Abstract

The idea of the present invention is to replace the existing password / user ID based authentication process by a new digital signature authentication process in which preferably the first HTTP-request header is extended by the client authentication information independently of the authentication process used by the destination server and without server requesting authentication information. The authentication information preferably includes the client certificate containing the client public key, signed by certification authority, and preferably a hash value calculated over the HTTP-request header data being sent in the request, and encrypted with the Client's private key. The certificate and digital signature may be added during the creation of the HTTP-request header in the client system itself, or may be added later in a server acting as a gateway, proxy, or tunnel. A destination server that does not support the new digital signature authentication process will simply ignore the certificate and digital signature in the HTTP-request header and will automatically initiate its own authentication process. The present invention simplifies the existing digital signature authentication process and concurrently allows the coexistence of different authentication processes without changing the HTTP-protocol or causing unnecessary network traffic.

Description

technical field [0001] The present invention relates generally to authentication, and in particular to authentication in a client-server environment, and more particularly to authentication of clients in the Internet. Background technique [0002] Authentication is the process of determining whether someone or something is actually who or what it is claimed to be. In private or public computer networks, authentication is usually accomplished through the use of login passwords. Typically, each server maintains its own data persistence for storing authentication data. Therefore, a password that is usable by a client on one server may have been blocked by another client on another server. This increases the number of different authentication sets the client has to remember and maintain. In an application distributed over multiple servers with different user authentication systems (for example, accessing the application through a portal server that uses its own user database)...

AI Technical Summary

Problems solved by technology

This can cause a lot of unnecessary network traffic between the client and server, since the server application itself ultimately determines the type of authentication

[0010] Furthermore, the existing digital signature authentication process has the disadvantage that some screens must be exchanged between the client and server until the client can provide its authentication information

This causes a lot of unnecessary network traffic

Images