Technical Field of the Invention
Embodiments described herein relate to the field of network authentication for user devices and provides methods, systems and computer program products for facilitating authenticated communication with a service.
Description of the Related Technology
Access to services provided by a secure network is typically restricted to authorized users and/or user devices (or user terminals), which may include wireless transmit/receive units. In this regard, an authentication server associated with a secure network, or more specifically an authentication domain or realm, authenticates user devices on the basis of an authentication protocol, such as Kerberos authentication protocol developed by the Massachusetts Institute of Technology in the United States of America, and selectively authorizes these devices to access one or more services provided by the secure network. For example, in accordance with the Kerberos authentication protocol, upon receiving an authentication request from a user device, a Key Distribution Centre (KDC) component of the authentication server verifies whether the user device is authorized to access services provided by the network. If so, the KDC provisions an authentication credential, such as a Ticket Granting Ticket (TGT), for use in obtaining a service credential, such as a service ticket, from a Ticket Granting Service (TGS) component of the authentication server for use in accessing a service provided by the network.
Increasingly, user devices are able to access services from a plurality of domains, each of which independently authenticates user devices before allowing access to a service. Each of these domains is referred to herein as an “authentication domain.” Typically, a user will connect to an authentication server in an authentication domain via their user device, whereupon the user is authenticated on the basis of an authentication protocol by the authentication server and thereafter selectively authorized to obtain a service credential for use in accessing a service provided by the corresponding domain. However, these mechanisms require users to separately authenticate in each authentication domain, and can be cumbersome for users.
To alleviate this problem, authentication protocols such as the Kerberos authentication protocol include a constrained delegation mechanism (so-called “Kerberos Constrained Delegation” (KCD)), in which a first authentication server of a first authentication domain, subsequent to authenticating the user device, is permitted to obtain a TGS from a second authentication server of a second authentication domain. This enables the first authentication server to obtain a service ticket corresponding to a service associated with the second domain on behalf of the user device. Specifically, the second authentication server provides a TGS to the first authentication server that allows it to obtain a service ticket on behalf of the user device for use in establishing authenticated communication between the user device and the service associated with the second authentication domain. Subsequent to obtaining the service ticket, the first authentication server transmits the service ticket to the user device, which then uses it to authenticate to the service and the service selectively permits the user device to communicate therewith.
One drawback of the KCD based cross-domain authentication mechanism is that it cannot be used to access services that are not configured to authenticate user devices on the basis of the KCD based cross-domain authentication mechanism.