Automatic upgrade from one step authentication to two step authentication via application programming interface

Patent metadata

Field	Value
Publication number	US-2019065731-A1
Application number	US-201715813712-A
Country	US
Kind code	A1
Filing date	Nov 15, 2017
Priority date	Aug 29, 2017
Publication date	Feb 28, 2019
Grant date	—

Abstract

A client transmits a user identifier and a password to a server via an application programming interface (API). The client establishes an authenticated session with the server in which the client has a first set of permissions for operations associated with the API. The client receives, responsive to a verification of the user identifier and password by the server, a logon response and a shared secret. The client generates a one time passcode (OTP) based upon the shared secret. The client sends the OTP to the server via the API. Responsive to the server validating the OTP against the shared secret, the server grants a second set of permissions for operations associated with the API.

First claim

What is claimed is:

1 . A method comprising:
transmitting, by a client, a user identifier and a password to a server via an application programming interface (API); establishing an authenticated session with the server, the client having a first set of permissions for operations associated with the API; receiving, responsive to a verification of the user identifier and password by the server, a logon response and a shared secret; generating, by the client, a one time passcode (OTP) based upon the shared secret; sending the OTP to the server via the API; and granting, responsive to the server validating the OTP against the shared secret, a second set of permissions for operations associated with the API.

2 . The method of claim 1 , further comprising:
receiving, by the client device, the user identifier and password, from a user.

3 . The method of claim 1 , wherein the receiving of the logon response and shared secret is responsive to a determination that a user associated with the user identifier is designated for upgrading from one factor authentication to two factor authentication.

4 . The method of claim 1 , further comprising:
storing, by the client, the shared secret within client preferences associated with a user.

5 . The method of claim 1 , wherein the server is configured to store the shared secret within a user profile associated with a user.

6 . The method of claim 1 , wherein the API includes a Representational state transfer (REST) API.

7 . The method of claim 1 , wherein the second set of permissions is greater than the first set of permissions.

8 . The method of claim 1 , further comprising:
transmitting the user ID, the password, and a current OTP generated based upon the shared secret to the server in a subsequent logon operation.

Assignees

• IBM

Inventors

• Brocious Larry A
• Howland Michael J
• Rogers Paul E

Classifications

• H04L2463/082

  applying multi-factor authentication · CPC title

• H04L63/205

  involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24) · CPC title

• G06F21/31 Primary

  User authentication · CPC title

• H04L9/0838

  Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these (network architectures or network communication protocols for key exchange in a packet data network H04L63/061) · CPC title

• H04L9/0863

  involving passwords or one-time passwords (network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067) · CPC title