International Business Machines Corporation

Patrick S Botz

Timothy James Hahn

Carol Jean Woodbury

Michael J Branson

Brian John Cragun

Gregory Richard Hintermeister

Donna N Dillenberger

John C Dayka

William Craig Rapp

Mark A Nelson

Devon D Snyder

Richard Henry Guski

Mark Linus Bauman

Patrick Jerome Fleming

Thomas Michael Moskalik

Margaret K LaBelle

Barbara Ann Smith

Anthony Paul Bachand

In an embodiment, a verifier receives requirements for membership in a group from a service and receives proof of attributes from users. The verifier verifies whether the proof of attributes meets the membership requirements and sends acceptance or rejection to the service. If the proof meets the requirements, the service allows the users to become members of the group and allows the members to transfer data to and from other members. If the proof does not meet the requirements, the service prevents the users from becoming members. In this way, the service and group members know that other group members satisfy the group membership requirements without needing to know the identity of the group members or other information unrelated to the group membership requirements.

Verifying that group membership requirements are met by users

In a multi-tiered computing environment, a first program may authenticate with a second program using dynamically-generated public/private key pairs. An authentication token is constructed that includes user information and information about the first program and the second program. The first program then digitally signs the authentication token using the dynamically-generated private key, and sends the authentication token to the second program. The second program then verifies the authentication token using the public key corresponding to the first program. Once verified, the first program is authenticated to the second program. The second program may then authenticate to a next-tier program by constructing an authentication token that includes the information in the authentication token received from the first program. This may continue to any suitable number of tiers, using dynamically-generated public/private key pairs to allow authentication between programs without requiring any user interaction or input from a system administrator.

Inter-program authentication using dynamically-generated public/private key pairs

An authenticated identity propagation and translation technique is provided based on a trust relationship between multiple user identification and authentication services resident on different computing components of a multi-component transaction processing computing environment including distributed and mainframe computing components. The technique includes, in one embodiment, forwarding, in association with transaction requests, identified and authenticated user identification and authentication information from a distributed component to a mainframe component, facilitating the selection of the appropriate mainframe user identity with which to execute the mainframe portion of the transaction, and creating the appropriate run-time security context.

Authenticated identity propagation and translation within a multiple computing unit environment

Apparatus and method for inter-program authentication using dynamically-generated public/private key pairs

An apparatus and method allow a system administrator to manage multiple user identities in multiple user registries in different processing environments. An identity mapping mechanism is provided that includes a directory service that includes entries that reference user identities in the multiple registries, and that reference identity mappings between those entries. The identity mapping mechanism includes an interface defined by a plurality of APIs that allow accessing and correlating the multiple user identities and the identity mappings. A programmer can generate an application or tool that uses the identity mapping mechanism by calling the APIs in the interface. In this manner, administration of user identities occurs with the user as the primary focus, rather than the platform. In addition, a common tool can be used to manage the user identities of different environments, making administration of user identities in a heterogenous network more efficient and cost-effective.

Apparatus and method for managing multiple user identities on a networked computer system

A user within a multiple process environment is initially authenticated, such as by verifying the user's identification and password. A first process, such as a client, requests a profile token representative of the user in response to authenticating the user. The profile token has associated with it one or more usage limitations. The profile token is transferred from the first process to a second process, such as a server. The second process, upon receiving a valid profile token, is allowed to perform one or more tasks on behalf of the user within the token's usage limitations. A profile token is invalidated upon violation of a usage limitation, such as a preestablished time-out period. One or more lookup tables are used to manage the profile tokens and to store certain user and profile token information, providing increased processing security.

User authentication system and method for multiple process applications

Method for providing at least a portion of a disguised password in an undisguised form is described. More particularly, a program is described having a capability of displaying a single character at a time, more than one character at a time or all of otherwise disguised characters of a password in an undisguised form in response to a successful pre-password check.

User interface for displaying protected information

A method, system and computer program product for selectively restricting access to a program function in a computer system having an operating system security mechanism operates via an application programming interface (API) that includes a program function registration API function, an authorization selection API function, and an authorization query API function. In response to a call to the API registration function, the program function is registered in a repository in the computer system. After the program function has been registered, a system administrator can select user authorizations using a software tool that includes calls to the authorization selection API function. The system administrator may select whether a particular user or group of users is authorized to access each registered program function. A programmer can embed a call to the authorization query API function in an application program, which includes or calls the program function. When the application program reaches the call to the authorization query API function, the function is executed and returns an indicator or value indicating whether or not that user is allowed to access the program function.

Limit access to program function

The present invention provides a system and method of performing user authentication on web based applications, such as IBM's Network Station Configuration Preference Manager. In particular, the system and method saves and continuously passes user information back and forth between a web client and a web server. The user information can then be used by CGI programs being executed on the web server for authentication purposes. Specifically, each CGI program will examine the user information, determine the authority privileges of the user, run the CGI program under a non-default user mode, return user information back to the web client, and return the CGI job to run in a default user mode.

Growing community of inventors

Rochester, MN, United States of America

Patrick S Botz