Step-up authentication for single sign-on

Patent metadata

Field	Value
Publication number	US-9578015-B2
Application number	US-201414530064-A
Country	US
Kind code	B2
Filing date	Oct 31, 2014
Priority date	Oct 31, 2014
Publication date	Feb 21, 2017
Grant date	Feb 21, 2017

Abstract

A method for authenticating a user seeking access to first and second resources that have different authentication levels. The method includes receiving a primary token that is associated with a first authentication event of the user and authenticates the user to access the first resource, and receiving a first request to access the second resource. The method further includes receiving first credentials of the user. The method further includes, responsive to validating the first credentials, generating a second authentication event, associating the second authentication event with the primary token, and issuing a first secondary token that authenticates the user to access the second resource.

First claim

We claim:

1. A method for authenticating a user seeking access to first and second resources that have different authentication levels, comprising:
receiving, at a token agent installed on a computing device of a user, information authenticating the user, wherein the token agent is not a browser;
sending, from the token agent to an authentication server, a request for a primary token authorizing access to the first resource, the request including the information authenticating the user;
receiving the primary token at the token agent, from the authentication server, wherein the token agent associates the primary token with a plurality of applications installed on the computing device;
receiving, at the token agent, a request to access the second resource from a first application of the plurality of applications installed on the computing device;
sending, from the token agent to the authentication server, the primary token and the request to access the second resource;
receiving, at the token agent, instructions from the authentication server to perform a second authentication event;
in response to receiving instructions from the authentication server to perform a second authentication event, launching a user interface on the computing device through which the user provides authentication information for the second authentication event;
sending, from the token agent to the authentication server, information associated with the second authentication event;
receiving, at the token agent, an updated primary token from the authentication server, wherein the token agent associates the updated primary token with more than one of the plurality of applications installed on the computing device;
resubmitting, from the token agent to the authentication server, the request to access the second resource from the first application, the resubmitted request including the updated primary token; and
receiving, at the token agent, a secondary token from the authentication server, the secondary token authorizing the first application to access the second resource.

2. The method of claim 1 , further comprising:
receiving, at the token agent, a request to access the second resource from a second application of the plurality of applications installed on the computing device;
sending, from the token agent to the authentication server, the updated primary token and the request to access the second resource; and
receiving, at the token agent, an additional secondary token from the authentication server, the additional secondary token authorizing the second application to access the second resource.

3. The method of claim 2 , further comprising:
receiving, at the token agent, a request to access a third resource from a second application of the plurality of applications installed on the computing device;
sending, from the token agent to the authentication server, the updated primary token and the request to access the third resource; and
receiving, at the token agent, another secondary token from the authentication server, the another secondary token authorizing the second application to access the third resource.

4. The method of claim 1 , wherein the instructions from the authentication server to perform a second authentication event are generated based on a determination by the authentication server that an access policy associated with the primary token does not provide for access to the secondary resource.

5. The method of claim 1 , wherein receiving instructions from the authentication server to perform a second authentication event further comprises receiving a one-time access (OTA) token from the authentication server.

6. The method of claim 1 , wherein the request to access the second resource from the first application includes a first application identification (ID) that identifies the first application to the authentication server.

7. The method of claim 2 , wherein the request to access the second resource from the second application includes a second application identification (ID) that identifies the second application to the authentication server.

8. A non-transitory, computer-readable storage medium comprising instructions that, when executed by a processor of a computing device of a user, performs stages for authenticating a user seeking access to first and second resources having different authentication levels, the stages comprising:
receiving, at a token agent installed on a computing device of a user, information authenticating the user, wherein the token agent is not a browser;
sending, from the token agent to an authentication server, a request for a primary token authorizing access to the first resource, the request including the information authenticating the user;
receiving the primary token at the token agent, from the authentication server, wherein the token agent associates the primary token with a plurality of applications installed on the computing device;
receiving, at the token agent, a request to access the second resource from a first application of the plurality of applications installed on the computing device;
sending, from the token agent to the authentication server, the primary token and the request to access the second resource;
receiving, at the token agent, instructions from the authentication server to perform a second authentication event;
in response to receiving instructions from the authentication server to perform a second authentication event, launching a user interface on the computing device through which the user provides authentication information for the second authentication event;
sending, from the token agent to the authentication server, information associated with the second authentication event;
receiving, at the token agent, an updated primary token from the authentication server, wherein the token agent associates the updated primary token with more than one of the plurality of applications installed on the computing device;
resubmitting, from the token agent to the authentication server, the request to access the second resource from the first application, the resubmitted request including the updated primary token; and
receiving, at the token agent, a secondary token from the authentication server, the secondary token authorizing the first application to access the second resource.

9. The non-transitory, computer-readable storage medium of claim 8 , wherein the stages performed by the processor of the computing device further comprise:
receiving, at the token agent, a request to access the second resource from a second application of the plurality of applications installed on the computing device;
sending, from the token agent to the authentication server, the updated primary token and the request to access the second resource; and
receiving, at the token agent, an additional secondary token from the authentication server, the additional secondary token authorizing the second application to access the second resource.

10. The non-transitory, computer-readable storage medium of claim 8 , wherein the stages performed by the processor of the computing device further comprise:
receiving, at the token agent, a request to access a third resource from a second application of the plurality of applications installed on the computing device;
sending, from the token agent to the authentication server, the updated primary token and the request to access the third resource; and
receiving, at the token agent, another secondary token from the authentication server, the another secondary token authorizing the second application to access the third resource.

11. The non-transitory, computer-readable storage medium of claim 8 , wherein

Assignees

• Vmware Inc

Inventors

• Xu Emily Hong
• Ladda Shraddha
• Olds Dale Robert

Classifications

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04L63/105

  Multiple levels of security · CPC title

• G06F21/62

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title

• H04L63/0815 Primary

  providing single-sign-on or federations · CPC title

• G06F2211/003

  Mutual Authentication Bi-Directional Authentication, Dialogue, Handshake · CPC title