Authenticator centralization and protection

Patent metadata

Field	Value
Publication number	US-10084782-B2
Application number	US-201615269287-A
Country	US
Kind code	B2
Filing date	Sep 19, 2016
Priority date	Sep 21, 2015
Publication date	Sep 25, 2018
Grant date	Sep 25, 2018

Abstract

Provided is a method for authenticating a user communicating with an enterprise via a network. The method includes receiving, via the network, authenticators for a user from a first user device associated with the user, and storing the received authenticators. A first authenticator from the stored authenticators is selected to be used for authenticating the user based on an authentication policy received from the enterprise. An authentication request is transmitted to a user device requesting the first authenticator and the user is authentication by by comparing the received authenticator with the stored first authenticator.

First claim

What is claimed is:

1. A computer implemented method for authenticating a user who is communicating with an enterprise via a network, comprising:
receiving, via the network, authenticators for a user from a first user device associated with the user, and storing the received authenticators;
receiving, from the enterprise, a request to authenticate the user with an authentication policy for authenticating the user, wherein the request does not identify which of the stored authenticators is to be used for authenticating the user;
determining, a first authenticator from the stored authenticators to be used for authenticating the user based on the authentication policy received from the enterprise;
transmitting an authentication request to the first user device via the network requesting the first authenticator;
receiving, from the first user device via the network, an authenticator in response to the authentication request; and
authenticating the user by comparing the received authenticator with the stored first authenticator.

2. The method of claim 1 , wherein the stored authenticators include a plurality of authenticators including at least two different authenticators in different categories of authenticators, the different categories including a knowledge category including information known to the user, a possession category including something physically possessed by the user; and a biometric category identifying physical attributes of the user.

3. The method of claim 2 , wherein the stored authenticators are stored in a hierarchy based on predetermined level of trust associated with each of the received authenticators.

4. The method of claim 3 , wherein the first authenticator of the stored authenticators is determined to be used for authenticating the user by applying the authentication policy to the stored hierarchy of authenticators.

5. The method of claim 1 , wherein the stored authenticators include a plurality of authenticators including one or more of: (i) at least two different authenticators in different categories of authenticators, the different categories including at least two of a knowledge category including information known to the user, a possession category including something physically possessed by the user; and a biometric category identifying physical attributes of the user; (ii) at least two different types of authenticators in a same category of authenticators or (iii) at least two different species of authenticators of the same type of authenticator.

6. The method of claim 1 , further comprising:
receiving from the first user device, via the network, a first device identifier that identifies the first user device and storing the first device identifier in association with a user account identifier, the stored received authenticators being stored with the user account identifier;
storing a relationship identifier that identifies a relationship between the enterprise and the first user device using the first device identifier; and
the determining the first authenticator from the stored authenticators comprises identifying the stored authenticators using the relationship identifier to identify the first device identifier and using the first device identifier to identify the user account identifier stored with the received authenticators.

7. The method of claim 1 , further comprising:
transmitting to the enterprise, via the network, a result of the authentication including a type of authenticator used for the authentication.

8. A computer implemented method for authenticating a user who is communicating with an enterprise via a network, comprising:
receiving, via the network, authenticators for a user from a first user device associated with the user and authenticators for a second user device associated with the user, and storing the received authenticators;
receiving, from the enterprise, a request to authenticate the user with an authentication policy for authenticating the user, wherein the request does not identify which of the stored authenticators is to be used for authenticating the user;
determining, a first authenticator from the stored authenticators to be used for authenticating the user based on the authentication policy received from the enterprise and selecting one of the first user device and the second user device to use for authentication;
transmitting an authentication request to the selected one of the first user device and the second user device via the network requesting the first authenticator;
receiving, from the selected one of the first user device and the second user device, an authenticator in response to the authentication request; and
authenticating the user by comparing the received authenticator with the stored first authenticator.

9. The method of claim 8 , wherein the stored authenticators include a plurality of authenticators including at least two different authenticators in different categories of authenticators, the different categories including a knowledge category including information known to the user, a possession category including something physically possessed by the user; and a biometric category identifying physical attributes of the user.

10. The method of claim 9 , wherein the received authenticators are stored in a hierarchy based on predetermined level of trust associated with each of the received authenticators.

11. The method of claim 10 , wherein the first authenticator of the stored authenticators is determined to be used for authenticating the user by applying the authentication policy to the stored hierarchy of authenticators; and the first user device or the second user device is selected to be used for authentication based on the stored hierarchy.

12. The method of claim 8 , wherein the stored authenticators include a plurality of authenticators including one or more of: (i) at least two different authenticators in different categories of authenticators, the different categories including at least two of a knowledge category including information known to the user, a possession category including something physically possessed by the user; and a biometric category identifying physical attributes of the user; (ii) at least two different types of authenticators in a same category of authenticators or (iii) at least two different species of authenticators of the same type of authenticator.

13. The method of claim 8 , further comprising:
receiving from the first user device, via the network, a first device identifier that identifies the first user device and storing the first device identifier in association with a user account identifier, the stored authenticators being stored with the user account identifier;
receiving from the second user device, via the network, a second device identifier that identifies the second user device and storing the second device identifier in association with the user account identifier, the stored received authenticators being stored with the user account identifier;
storing a first relationship identifier that identifies a relationship between the enterprise and the first user device using the first device identifier;
storing a second relationship identifier that identifies a relationship between the enterprise and the second user device using the second device identifier; and
the determining the first authenticator from the stored authenticators comprises identifying the stored authenticators using the first relationship identifier to identify the first device identifier and using the first device identifier to identify the user account identifier stored with the received authenticators.

14. An article of ma

Assignees

• Early Warning Services Llc

Inventors

• Rolfe Andrew Robert
• Dundas Alan
• Slowiak Gregory

Classifications

• H04L63/06

  for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08) · CPC title

• H04L63/0884 Primary

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title

• H04L63/0853

  using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234) · CPC title

• H04L2463/082

  applying multi-factor authentication · CPC title

• H04L63/0861 Primary

  using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231) · CPC title