System and method for adaptive multifactor authentication

Patent metadata

Field	Value
Publication number	US-9622075-B2
Application number	US-201313755256-A
Country	US
Kind code	B2
Filing date	Jan 31, 2013
Priority date	Jan 31, 2013
Publication date	Apr 11, 2017
Grant date	Apr 11, 2017

Abstract

In one embodiment, a method includes receiving a request for wireless connection from a supplicant device via a service path. The service path includes a peer-to-peer communication path. The method further includes, based on an indication received from the supplicant device, adapting an authentication method to the supplicant device. The adapting includes selecting at least one authentication factor from a plurality of supported authentication factors. Each of the plurality of supported authentication factors comprises an authentication path that is distinct from the service path. In addition, the method includes authenticating the supplicant device via each of the at least one authentication factor.

First claim

What is claimed is:

1. A method comprising:
on an access-point (AP) device, receiving a request for wireless connection from a supplicant device via a service path, the service path comprising a peer-to-peer communication path;
based on an indication received from the supplicant device, adapting, by the AP device, an authentication method to the supplicant device;
wherein the adapting comprises selecting at least one authentication factor from a plurality of supported authentication factors;
wherein each of the plurality of supported authentication factors comprises an authentication path that is distinct from the service path; and
on the AP device, authenticating the supplicant device via each of the at least one authentication factor.

2. The method of claim 1 , comprising, responsive to the authenticating resulting in success, granting the supplicant device access to a service over the service path.

3. The method of claim 2 , comprising performing additional user authentication prior to performing the service.

4. The method of claim 1 , comprising:
wherein the at least one authentication factor comprises a proximity-communication factor;
wherein the indication comprises an indication that the supplicant device has an access token, the access token comprising a shared secret;
wherein the selecting comprises selecting the proximity-communication factor; and
wherein the authenticating comprises authenticating the supplicant device via the proximity-communication factor.

5. The method of claim 4 , wherein authenticating the supplicant device via the proximity-communication factor comprises:
establishing a connection with the supplicant device;
receiving the shared secret; and
validating the shared secret.

6. The method of claim 5 , wherein the supplicant device has obtained the access token from the AP device via near-field communication (NFC).

7. The method of claim 1 , comprising:
wherein the at least one authentication factor comprises an interactive-presence-validation (IPV) factor; and
wherein the authenticating comprises performing IPV.

8. The method of claim 1 , wherein the service path comprises a network path between a Wi-Fi direct interface of the AP device and a Wi-Fi interface of the supplicant device.

9. The method of claim 1 , wherein the at least one authentication factor comprises a plurality of authentication factors.

10. The method of claim 1 , wherein the at least one authentication factor comprises an interactive-presence-validation (IPV) factor and a proximity-communication factor.

11. An information handling system comprising:
a network interface operable to enable peer-to-peer connections thereto via a service path;
a processing unit communicably coupled to the network interface, wherein the processing unit is operable to:
receive a request for wireless connection from a supplicant device via the service path;
based on an indication received from the supplicant device, adapt an authentication method to the supplicant device;
wherein the adaption comprises selection of at least one authentication factor from a plurality of supported authentication factors;
wherein each of the plurality of supported authentication factors comprises an authentication path that is distinct from the service path; and
authenticate the supplicant device via each of the at least one authentication factor.

12. The information handling system of claim 11 , wherein the processing unit is operable, responsive to the authenticating resulting in success, to grant the supplicant device access to a service over the service path.

13. The information handling system of claim 12 , wherein the processing unit is operable to perform additional user authentication prior to performing the service.

14. The information handling system of claim 11 , comprising:
wherein the at least one authentication factor comprises a proximity-communication factor;
wherein the indication comprises an indication that the supplicant device has an access token, the access token comprising a shared secret;
wherein the selection comprises selection of the proximity-communication factor; and
wherein the authentication comprises authentication of the supplicant device via the proximity-communication factor.

15. The information handling system of claim 14 , wherein authentication of the supplicant device via the proximity-communication factor comprises:
establishment of a connection with the supplicant device;
receipt of the shared secret; and
validation of the shared secret.

16. The information handling system of claim 15 , comprising:
a near-field communication (NFC) network interface; and
wherein the information handling system has transmitted the access token to the AP device via the NFC network interface.

17. The information handling system of claim 11 , comprising:
wherein the at least one authentication factor comprises an interactive-presence-validation (IPV) factor; and
wherein the authentication comprises performance of IPV.

18. The information handling system of claim 11 , wherein the service path comprises a network path between a Wi-Fi direct interface of the AP device and a Wi-Fi interface of the supplicant device.

19. The information handling system of claim 11 , wherein the at least one authentication factor comprises a plurality of authentication factors.

20. A computer-program product comprising a non-transitory computer-usable medium having computer-readable program code embodied therein, the computer-readable program code adapted to be executed to implement a method comprising:
receiving a request for wireless connection from a supplicant device via a service path, the service path comprising a peer-to-peer communication path;
based on an indication received from the supplicant device, adapting an authentication method to the supplicant device;
wherein the adapting comprises selecting at least one authentication factor from a plurality of supported authentication factors;
wherein each of the plurality of supported authentication factors comprises an authentication path that is distinct from the service path; and
authenticating the supplicant device via each of the at least one authentication factor.

Assignees

• Dell Products Lp

Inventors

• Ali Raziuddin
• Cox Claude Lano
• Lo Yuan-Chang
• Sanaullah Abu Shaher
• Krishnakumar Karthikeyan

Classifications

• H04L63/205

  involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24) · CPC title

• H04L63/18

  using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215) · CPC title

• H04L63/0492

  by using a location-limited connection, e.g. near-field communication or limited proximity of entities · CPC title

• H04L2463/082

  applying multi-factor authentication · CPC title

• H04W12/06 Primary

  Authentication · CPC title