Second factor based realm selection for federated authentications

Patent metadata

Field	Value
Publication number	US-11606351-B2
Application number	US-202017122519-A
Country	US
Kind code	B2
Filing date	Dec 15, 2020
Priority date	Dec 15, 2020
Publication date	Mar 14, 2023
Grant date	Mar 14, 2023

Abstract

In an approach for authentication of a username, a processor maintains a mapping of usernames and realms. A processor receives a username and a time-based one-time password code (TOTP code) for the username based on an authentication application. A processor, upon receiving the TOTP code: determines a realm from the mapping based on the received username and the received TOTP; and requests an entry of a credential relating to the username in the realm. A processor, upon receiving of the requested credential, authenticates the username by determining that the received credential matches an expected credential for the realm.

First claim

What is claimed is:

1. A computer-implemented method comprising:
receiving, by one or more processors, a username and a time-based one-time password (TOTP) for said username based on an authentication application;
subsequent to receiving said TOTP:
determining, by one or more processors, a realm from said TOTP, based on a mapping of TOTPs and a plurality of realms; and
requesting, by one or more processors, entry of a credential relating to said username in said realm; and

subsequent to receiving said requested credential, authenticating, by one or more processors, said username by determining that said received credential matches an expected credential for said realm.

2. The method of claim 1 , further comprising:
receiving, by one or more processors, said username and said TOTP in two steps.

3. The method of claim 2 , further comprising:
providing, by one or more processors, a user-interface adapted for receiving said username and said TOTP.

4. The method of claim 3 , wherein said user interface is a command line interface.

5. The method of claim 1 , further comprising:
receiving, by one or more processors, said username and said TOTP in a single step process.

6. The method of claim 1 , wherein said realm is a software development environment.

7. The method of claim 1 , wherein said authentication application is a client-side TOTP generator.

8. The method of claim 1 , wherein said mapping is performed using a table.

9. The method of claim 1 , further comprising:
determining, by one or more processors, that said TOTP is no longer valid; and
subsequent to determining that said TOTP is no longer valid, terminating, by one or more processors, a process.

10. A computer program product comprising:
one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, the program instructions comprising:
program instructions to receive a username and a time-based one-time password code (TOTP) for said username based on an authentication application;
program instructions to, subsequent to receiving said TOTP:
determine a realm from said TOTP, based on a mapping of TOTPs and a plurality of realms; and
request entry of a credential relating to said username in said realm; and

program instructions to, subsequent to receiving said requested credential, authenticate said username by determining that said received credential matches an expected credential for said realm.

11. The computer program product of claim 10 , further comprising:
program instructions, collectively stored on the one or more computer readable storage media, to receive said username and said TOTP in two steps.

12. The computer program product of claim 11 , further comprising:
program instructions, collectively stored on the one or more computer readable storage media, to provide a user-interface adapted for receiving said username and said TOTP.

13. The computer program product of claim 12 , wherein said user interface is a command line interface.

14. The computer program product of claim 10 , further comprising:
program instructions, collectively stored on the one or more computer readable storage media, to receive said username and said TOTP in a single step process.

15. The computer program product of claim 10 , wherein said realm is a software development environment.

16. The computer program product of claim 10 , wherein said authentication application is a client-side TOTP generator.

17. The computer program product of claim 10 , wherein said mapping is performed using table.

18. The computer program product of claim 10 , further comprising:
program instructions, collectively stored on the one or more computer readable storage media, to determine that said TOTP is no longer valid; and
program instructions, collectively stored on the one or more computer readable storage media, to, subsequent to determining that said TOTP code no longer valid, terminate a process.

19. A computer system comprising:
one or more computer processors, one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media for execution by at least one of the one or more computer processors, the program instructions comprising:
program instructions to receive a username and a time-based one-time password code (TOTP) for said username based on an authentication application;
program instructions to, subsequent to receiving said TOTP:
determine a realm from said TOTP, based on a mapping of TOTPs and a plurality of realms; and
request entry of a credential relating to said username in said realm; and

program instructions to, subsequent to receiving said requested credential, authenticate said username by determining that said received credential matches an expected credential for said realm.

20. The computer system of claim 19 , further comprising:
program instructions, collectively stored on the one or more computer readable storage media, to receive said username and said TOTP in two steps.

21. The computer system of claim 20 , further comprising:
program instructions, collectively stored on the one or more computer readable storage media, to provide a user-interface adapted for receiving said username and said TOTP.

22. The computer system of claim 21 , wherein said user interface is a command line interface.

23. The computer system of claim 19 , further comprising:
program instructions, collectively stored on the one or more computer readable storage media, to receive said username and said TOTP in a single step process.

24. The method of claim 1 , wherein each realm is a sub group of dynamically configurable computing resources in a cloud computing environment.

25. The method of claim 1 , wherein said username is associated with the plurality of realms.

Assignees

• IBM

Inventors

• Dürr Thomas
• Baessler Michael
• Koenig Holger
• Koeth Oliver
• Schwarz Thomas

Classifications

• H04L63/0838 Primary

  using one-time-passwords · CPC title

• H04L2463/082

  applying multi-factor authentication · CPC title

• H04L63/0846

  using time-dependent-passwords, e.g. periodically changing passwords · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L63/0815

  providing single-sign-on or federations · CPC title