Authenticating users requesting access to computing resources

Patent metadata

Field	Value
Publication number	US-10846382-B2
Application number	US-201916449732-A
Country	US
Kind code	B2
Filing date	Jun 24, 2019
Priority date	Sep 11, 2014
Publication date	Nov 24, 2020
Grant date	Nov 24, 2020

Abstract

Systems and methods are provided for monitoring access of computing resources. Usage rules may be created and stored that define a usage constraint based on actions available to be performed at the computing resources. An authenticator may verify login credentials received from a user and authorize the user to access a computing resource. A request to perform an action at the computing resource may be received, and a usage monitor may apply a usage rule to the requested action. If the requested action violates the usage constraint of the usage rule, the usage monitor may halt performance of the requested action and notify another user of the usage constraint violation. The authenticator may receive and verify another set of login credentials from that other user. In response to successful verification of the additional set of login credentials, the usage monitor may resume performance of the requested action.

First claim

What is claimed is:

1. A computer-implemented method of user authentication comprising:
storing, at a data store of a first computing device, an authentication rule used to authenticate a user, the authentication rule indicating a plurality of sets of first identity elements, each set of first identity elements comprising a plurality of first identity elements used for authentication of the user, wherein the plurality of sets of first identity elements comprises (i) a first set of first identity elements associated with a first action type, and (ii) a second set of first identity elements associated with a second action type different from the first action type;
receiving, at the first computing device from a second computing device operated by the user, a request that a computing resource perform an action;
receiving, at the first computing device from the second computing device, a set of second identity elements comprising one or more second identity elements usable for authentication of the user, wherein the second computing device and the user are unaware of which first identity elements need to be submitted for the first computing device to grant the request;
selecting, by the first computing device and from among the plurality of sets of first identity elements, a set of first identity elements to use for authentication of the user;
performing, by the first computing device, an authentication attempt by verifying, for each first identity element of the set of first identity elements selected, a second identity element, of the set of second identity elements received, which corresponds to that first identity element; and
based on unsuccessful authentication of the user, indicating, by the first computing device, that at least one additional identity element is needed in order to grant the request, but without identifying the at least one additional identity element to the second computing device or the user.

2. The computer-implemented method of claim 1 , wherein:
the first computing device selects the set of first identity elements at random from the plurality of sets of first identity elements.

3. The computer-implemented method of claim 1 , wherein:
the plurality of sets of first identity elements comprises (i) a first set of second identity elements associated with a first user type, and (ii) a second set of second identity elements associated with a second user type different from the first user type; and
the first computing device selects one of the first or second sets of second identity elements as the set of first identity elements based on a user type of the user.

4. The computer-implemented method of claim 1 , wherein:
the first computing device selects one of the first or second sets of first identity elements as the set of first identity elements based on an action type of the action requested.

5. The computer-implemented method of claim 1 , wherein:
the plurality of sets of first identity elements comprises (i) a first set of second identity elements associated with a first timeframe, and (ii) a second set of second identity elements associated with a second timeframe different from the first timeframe; and
the first computing device selects one of the first or second sets of second identity elements as the set of first identity elements based on a timeframe during which the request was received.

6. The computer-implemented method of claim 5 , wherein:
the first and second timeframes each comprise at least one of a day-of-the-week or a time-of-day.

7. The computer-implemented method of claim 5 , wherein:
the first timeframe comprises a previous timeframe within which the user previously requested one or more computing resources perform one or more actions.

8. The computer-implemented method of claim 1 , wherein:
the plurality of sets of first identity elements comprises (i) a first set of second identity elements associated with a first geographic location, and (ii) a second set of second identity elements associated with a second geographic location different from the first geographic location; and
the first computing device selects one of the first or second sets of second identity elements as the set of first identity elements based on a geographic location of the user.

9. The computer-implemented method of claim 1 , wherein:
the plurality of sets of first identity elements comprises (i) a first set of second identity elements associated with a first device location, and (ii) a second set of second identity elements associated with a second device location different from the first device location; and
the first computing device selects one of the first or second sets of second identity elements as the set of first identity elements based on a location of the second computing device operated by the user.

10. The computer-implemented method of claim 9 , wherein:
the first device location is internal to a network within which the first computing device resides; and
the second device location is external to that network.

11. A computing device comprising:
one or more processors;
a data store storing an authentication rule used to authenticate a user, the authentication rule indicating a plurality of sets of first identity elements, each set of first identity elements comprising a plurality of first identity elements used for authentication of the user, wherein the plurality of sets of first identity elements comprises (i) a first set of first identity elements associated with a first action type, and (ii) a second set of first identity elements associated with a second action type different from the first action type; and
memory storing executable instructions that, when executed by the one or more processors, cause the computing device to:
receive, from a second computing device operated by a user, a request that a computing resource perform an action;
receive, from the second computing device, a set of second identity elements comprising one or more second identity elements usable for authentication of the user, wherein the second computing device and the user are unaware of which first identity elements need to be submitted for the computing device to grant the request;
select, from among the plurality of sets of first identity elements, a set of first identity elements;
perform, an authentication attempt by verifying, for each first identity element of the set of first identity elements selected, a second identity element, of the set of second identity elements received, which corresponds to that first identity element;
based on successful authentication of the user, grant the request; and
based on unsuccessful authentication of the user, indicate, that at least one additional identity element is needed in order to grant the request, but without identifying the at least one additional identity element to the second computing device or the user.

12. The computing device of claim 11 , wherein:
the computing device selects the set of first identity elements at random from the plurality of sets of first identity elements.

13. The computing device of claim 11 , wherein:
the plurality of sets of first identity elements comprises (i) a first set of second identity elements associated with a first user type, and (ii) a second set of second identity elements associated with a second user type different from the first user type; and
the computing device selects one of the first or second sets of second identity elements as the set of first identity elements based on a user type of the user.

14. The computing device of claim 11 , wherein:
the computing device selects one of the

Assignees

• Bank Of America

Inventors

• Moloian Armen
• Kling John

Classifications

• H04L63/102

  Entity profiles · CPC title

• G06F21/62

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title

• H04L63/101

  Access control lists [ACL] · CPC title

• G06F21/31 Primary

  User authentication · CPC title

• H04L63/108

  when the policy decisions are valid for a limited amount of time · CPC title