Out-of-band challenge in a computer system

Patent metadata

Field	Value
Publication number	US-11146589-B2
Application number	US-201816498880-A
Country	US
Kind code	B2
Filing date	Mar 26, 2018
Priority date	Mar 30, 2017
Publication date	Oct 12, 2021
Grant date	Oct 12, 2021

Abstract

A computer implemented method for access control for a consumer accessing a restricted resource in a network connected computer system, the method including receiving a continuous sequence of data records relating to use, by the consumer, of the restricted resource, the resource being accessed by the consumer over an access network; continuously comparing the data records with an access control policy for the restricted resource; in response to a determination that the behavior is non-compliant with respect to the policy, generating and communicating a shared secret to the consumer, the shared secret being communicated via a communications channel other than the access network; receiving a response to a challenge from the user via the access network; and notifying the computer system that access to the resource by the consumer should be precluded based on a comparison of the response to the challenge and the shared-secret.

First claim

The invention claimed is:

1. A computer implemented method for access control for a consumer accessing a restricted resource in a computer system connected to an access network, the method comprising:
receiving a continuous sequence of data records while the consumer is accessing and using the restricted resource over the access network;
continuously comparing the received data records with an access control policy for the restricted resource, wherein the access control policy is accessed or received and applied by an out-of-band (OOB) access control system to identify any deviation from the access policy by the consumer using the restricted resource;
in response to a determination that a behavior of the consumer is non-compliant with respect to the access control policy, generating and communicating a shared secret to the consumer, the shared secret being communicated via an OOB communications channel other than the access network;
receiving and validating, by the OOB access control system, a response to a challenge corresponding to the shared secret from the consumer via the access network; and
notifying the computer system that access to the restricted resource by the consumer should be precluded based on the validation of the response to the challenge and the shared secret.

2. A non-transitory computer-readable storage medium storing a computer program element comprising computer program code to, when loaded into a computer system and executed thereon, cause the computer system to perform the method as claimed in claim 1 .

3. The method of claim 1 , wherein the consumer authenticates with the computer system prior to accessing the restricted resource.

4. The method of claim 1 , wherein the continuous sequence of data records are received from at least one of the computer system or the restricted resource.

5. The method of claim 1 , wherein the data records include log information recording operations performed by at least one of the computer system or the restricted resource as part of the use of the restricted resource by the consumer.

6. The method of claim 1 , wherein the shared secret has an expiry time after which the shared secret ceases to be valid.

7. A computer system for access control for a consumer accessing a restricted resource comprising:
a processor device and memory storing computer program code for access control for the consumer accessing the restricted resource in the computer system connected to an access network;
receiving a continuous sequence of data records while the consumer is accessing and using the restricted resource over the access network;
continuously comparing the received data records with an access control policy for the restricted resource, wherein the access control policy is accessed or received and applied by an out-of-band (OOB) access control system to identify any deviation from the access policy by the consumer using the restricted resource;
in response to a determination that a behavior of the consumer is non-compliant with respect to the access control policy, generating and communicating a shared secret to the consumer, the shared secret being communicated via an OOB communications channel other than the access network;
receiving and validating, by the OOB access control system, a response to a challenge corresponding to the shared secret from the consumer via the access network; and
notifying the computer system that access to the restricted resource by the consumer should be precluded based on the validation of the response to the challenge and the shared secret.

Assignees

• British Telecomm

Inventors

• Daniel Joshua
• Ducatel Gery

Classifications

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L9/3215

  using a plurality of channels (network architectures or network communication protocols using different networks H04L63/18) · CPC title

• H04W12/065

  Continuous authentication · CPC title

• H04L63/0892

  by using authentication-authorization-accounting [AAA] servers or protocols · CPC title

• H04L63/18 Primary

  using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215) · CPC title