Authenticating users requesting access to computing resources

Patent metadata

Field	Value
Publication number	US-9824196-B2
Application number	US-201615048283-A
Country	US
Kind code	B2
Filing date	Feb 19, 2016
Priority date	Sep 11, 2014
Publication date	Nov 21, 2017
Grant date	Nov 21, 2017

Abstract

Systems and methods are provided for monitoring access of computing resources. Usage rules may be created and stored that define a usage constraint based on actions available to be performed at the computing resources. An authenticator may verify login credentials received from a user and authorize the user to access a computing resource. A request to perform an action at the computing resource may be received, and a usage monitor may apply a usage rule to the requested action. If the requested action violates the usage constraint of the usage rule, the usage monitor may halt performance of the requested action and notify another user of the usage constraint violation. The authenticator may receive and verify another set of login credentials from that other user. In response to successful verification of the additional set of login credentials, the usage monitor may resume performance of the requested action.

First claim

What is claimed is:

1. A computer-implemented method of authenticating a user comprising:
storing, at a data store of a first computing device, an authentication rule used to authenticate a user, the authentication rule indicating a set of first identity elements which comprises a plurality of first identity elements selectable for authentication of the user;
receiving, at the first computing device from a second computing device operated by the user, a request that a computing resource perform an action;
receiving, at the first computing device from the second computing device, a set of second identity elements comprising one or more second identity elements usable for authentication of the user, wherein the second computing device and the user are unaware of which first identity elements need to be submitted for the first computing device to grant the request;
selecting dynamically by the first computing device from the set of first identity elements, a subset of first identity elements which comprises at least one of the plurality of first identity elements, a first identity element in the subset of first identity elements being selected at random from the set of first identity elements;
performing, by the first computing device, an authentication attempt by verifying, for each first identity element selected, a second identity element received which corresponds to that first identity element; and
providing, by the first computing device, a response indicating whether the authentication attempt succeeded or failed but without informing the second computing device or the user which first identity elements were required to grant the request.

2. The computer-implemented method of claim 1 , further comprising:
performing, by the first computing device, a comparison of the subset of first identity elements to the set of second identity elements; and
determining, by the first computing device based on the comparison, whether to (i) attempt authentication of the user, or (ii) request an additional identity element.

3. The computer-implemented method of claim 2 , further comprising:
determining, by the first computing device, to attempt authentication of the user responsive to determining that the set of second identity elements includes, for each first identity element selected, a second identity element which corresponds to that first identity element.

4. The computer-implemented method of claim 2 , further comprising:
determining, by the first computing device, to request the additional identity element responsive to determining that the set of second identity elements does not include a second identity element that corresponds to one of the first identity elements selected.

5. The computer-implemented method of claim 4 , further comprising:
providing, by the first computing device to the second computing device, a request for the additional identity element; and
receiving, at the first computing device from the second computing device in response to that request, a second set of second identity elements.

6. The computer-implemented method of claim 5 , wherein:
one or more second identity elements in the second set of second identity elements were selected by an application residing at the second computing device.

7. The computer-implemented method of claim 1 , further comprising:
identifying, by the first computing device, a total number of first identity elements to select;
wherein a count of the plurality of first identity elements selected equals the total number of first identity elements identified.

8. The computer-implemented method of claim 7 , wherein:
the authentication rule specifies the total number of first identity elements to select.

9. The computer-implemented method of claim 7 , wherein:
the authentication rule specifies a numerical range; and
identifying the total number of first identity elements to select comprises selecting the total number from the numerical range.

10. The computer-implemented method of claim 9 , wherein:
selecting the total number from the numerical range comprises selecting the total number randomly from the numerical range.

11. The computer-implemented method of claim 1 , wherein:
the first set of identity elements comprises at least two of (i) login credentials comprising a username and password, (ii) a one-time password, (iii) user metadata, and (iv) device metadata.

12. The computer-implemented method of claim 1 , wherein:
verifying the second identity element comprises comparing the second identity element to an identity element associated with either the user or the second computing device and stored at the first computing device.

13. The computer-implemented method of claim 1 , wherein:
the request includes the set of second identity elements.

14. The computer-implemented method of claim 1 , wherein:
the subset of first identity elements includes each of the plurality of first identity elements in the set of first identity elements.

15. A device for authenticating a user, the device comprising:
at least one processor;
a data store storing an authentication rule used to authenticate a user, the authentication rule indicating a set of first identity elements which comprises a plurality of first identity elements selectable for authentication of the user; and
memory storing computer-executable instructions that, when executed by the at least one processor, cause the device to:
receive, from a second computing device operated by the user, a request that a computing resource perform an action;
receive, from the second computing device, a set of second identity elements comprising one or more second identity elements usable for authentication of the user, wherein the second computing device and the user are unaware of which first identity elements need to be submitted for the device to grant the request;
dynamically select, from the set of first identity elements, a subset of first identity elements which comprises at least one of the plurality of first identity elements, a first identity element in the subset of first identity elements being selected at random from the set of first identity elements;
perform an authentication attempt by verifying, for each first identity element selected, a second identity element received which corresponds to that first identity element; and
provide a response indicating whether the authentication attempt succeeded or failed but without informing the second computing device or the user which first identity elements were required to grant the request.

16. The device of claim 15 , wherein:
the computer-executable instructions, when executed by the at least one processor, further cause the device to:
perform a comparison of the subset of first identity elements to the set of second identity elements;
determine, based on the comparison, whether to (i) attempt authentication of the user, or (ii) request an additional identity element;
determine to attempt authentication of the user responsive to determining that the set of second identity elements includes, for each first identity element selected, a second identity element which corresponds to that first identity element; and
determine to request the additional identity element responsive to determining that the set of second identity elements does not include a second identity element that corresponds to one of the first identity elements selected.

17. The device of claim 16 , wherein:
the computer-executable instructions, when executed by the at least one processor, further cause the device to:

Assignees

• Bank Of America

Inventors

• Moloian Armen
• Kling John H

Classifications

• G06F21/31 Primary

  User authentication · CPC title

• H04L63/108

  when the policy decisions are valid for a limited amount of time · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F21/40

  by quorum, i.e. whereby two or more security principals are required · CPC title

• G06F21/62

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title