System and method for off-host abstraction of multifactor authentication

Patent metadata

Field	Value
Publication number	US-9779230-B2
Application number	US-201514852198-A
Country	US
Kind code	B2
Filing date	Sep 11, 2015
Priority date	Sep 11, 2015
Publication date	Oct 3, 2017
Grant date	Oct 3, 2017

Abstract

An information handling system includes a first processor, a second processor, and a third processor. The first processor requests a single-factor authentication from the second processor. The second processor receives a first authentication factor in response to the single-factor authentication request and requests a multi-factor authentication from the third processor. The third processor receives a second authentication factor in response to the multi-factor authentication request and provides the second authentication factor to the second processor. The second processor further verifies the first authentication factor and the second authentication factor and provides a single-factor authentication reply to the first processor in response to verifying the first authentication factor and the second authentication factor.

First claim

What is claimed is:

1. A method, comprising:
requesting, from a first processor of an information handling system, a single-factor authentication from a second processor of the information handling system;
receiving a first authentication factor in response to the single-factor authentication request;
requesting, from the second processor, a multi-factor authentication from a third processor of the information handling system via a Baseboard Management Controller (BMC) of the information handling system;
receiving a second authentication factor in response to the multi-factor authentication request via the BMC;
providing, from the third processor, the second authentication factor to the second processor;
verifying the first authentication factor and the second authentication factor; and
providing, from the second processor, a single-factor authentication reply to the first processor in response to verifying the first authentication factor and the second authentication factor.

2. The method of claim 1 , further comprising:
instantiating an operating system on the first processor, wherein the single-factor authentication request is from the operating system.

3. The method of claim 2 , wherein the second processor, the third processor, and the BMC are isolated from the operating system.

4. The method of claim 1 , further comprising:
receiving a third authentication factor in response to the multi-factor authentication request;
providing, from the third processor, the third authentication factor to the second processor;
verifying the third authentication factor; and
providing, from the second processor, the single-factor authentication reply to the first processor in further response to verifying the third authentication factor.

5. The method of claim 4 , wherein the third authentication factor includes an authentication credential from a location service.

6. The method of claim 4 , wherein the third authentication factor includes an authentication credential from a direct access service.

7. The method of claim 1 , wherein the first authentication factor includes a template based upon a fingerprint scan.

8. The method of claim 1 , wherein the second authentication factor includes an authentication credential from a Bluetooth radio.

9. An information handling system, comprising:
a first processor;
a second processor;
a third processor; and
a baseboard management controller (BMC);
wherein the first processor requests a single-factor authentication from the second processor, the second processor receives a first authentication factor in response to the single-factor authentication request and requests a multi-factor authentication from the third processor, the third processor receives a second authentication factor in response to the multi-factor authentication request and provides the second authentication factor to the second processor, the second processor verifies the first authentication factor and the second authentication factor and provides a single-factor authentication reply to the first processor in response to verifying the first authentication factor and the second authentication factor, and the second processor requests the multi-factor authentication from the third processor and receives the second authentication factor from the third processor via the BMC.

10. The information handling system of claim 9 , wherein the first processor instantiates an operating system, and the single-factor authentication request is from the operating system.

11. The information handling system of claim 10 , wherein the second processor, the third processor, and the BMC are isolated from the operating system.

12. The information handling system of claim 9 , wherein the third processor receives a third authentication factor in further response to the multi-factor authentication request and provides the third authentication factor to the second processor, and the second processor verifies third authentication factor, and wherein the single-factor authentication reply is in further response to verifying the third authentication factor.

13. The information handling system of claim 12 , wherein the third authentication factor includes an authentication credential from a location service.

14. The information handling system of claim 12 , wherein the third authentication factor includes an authentication credential from a direct access service.

15. The information handling system of claim 9 , wherein the first authentication factor includes a template based upon a fingerprint scan.

16. The information handling system of claim 9 , wherein the second authentication factor includes an authentication credential from a Bluetooth radio.

17. A non-transitory computer-readable medium including code for performing a method, the method comprising:
requesting, from a first processor of an information handling system, a single-factor authentication from a second processor of the information handling system;
receiving a first authentication factor in response to the single-factor authentication request;
requesting, from the second processor, a multi-factor authentication from a third processor of the information handling system via a Baseboard Management Controller (BMC) of the information handling system;
receiving a second authentication factor in response to the multi-factor authentication request via the BMC;
providing, from the third processor, the second authentication factor to the second processor;
verifying the first authentication factor and the second authentication factor; and
providing, from the second processor, a single-factor authentication reply to the first processor in response to verifying the first authentication factor and the second authentication factor.

18. The computer-readable medium of claim 17 , wherein the first authentication factor includes a template based upon a fingerprint scan.

19. The computer-readable medium of claim 17 , wherein the second authentication factor includes an authentication credential from a Bluetooth radio.

20. The computer-readable medium of claim 17 , the method further comprising:
receiving a third authentication factor in response to the multi-factor authentication request;
providing, from the third processor, the third authentication factor to the second processor; and
verifying the third authentication factor;
wherein providing the single-factor authentication reply is in further response to verifying the third authentication factor.

Assignees

• Dell Products Lp

Inventors

• Hamlin Daniel L
• Robison Jr Charles D
• Grobelny Nicholas D

Classifications

• G06F21/31 Primary

  User authentication · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F21/445 Primary

  by mutual authentication, e.g. between devices or programs · CPC title

• H04L2463/082

  applying multi-factor authentication · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title