Identity authentication using multiple devices

• US 10,063,564 B2
• Filed: 10/07/2015
• Issued: 08/28/2018
• Est. Priority Date: 10/07/2015
• Status: Active Grant

• Current Assignee: Quest Software, Inc.
• Original Assignee: Quest Software, Inc.
• Inventors: Seigel, Jake, Ali, Sohail, Jury, Derek
• Primary Examiner(s): Rahman, Shawnchoy
• Application Number:
  US14/877,391
• Publication Number:
  US 20170104761A1
• Time in Patent Office: 1,056 Days
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication

Abstract

A system, method, and computer-readable medium for performing an authentication operation comprising: identifying a plurality of user devices associated with a user of an information handling system; determining when at least some of the plurality of user devices are within a predetermined range of the information handling system; and, authenticating the user as an authorized user of the information handling system when at least some of the plurality of user devices are within the predetermined range of the information handling system.

Claims

1. A computer-implementable method, comprising:

registering a first user device associated with a user with an information handling system;

registering a second user device associated with the user with the information handling system;

determining that the first user device and the second user device are connected to a network associated with the information handling system;

receiving an authentication request from the first user device, the authentication request including an identifier of the first user device;

accessing an electronic record of the user based on the first user device to determine an identity of the user and other user devices that are registered with the user;

identifying the second user device in the electronic record;

determining that the first user device and the second user device are within a predetermined range of the information handling system based on a detected signal strength for each of the first user device and the second user device to the network;

determining a confidence value based on at least one of;

the first user device, the second user device, a type of device for the first user device, and a type of device of the second user device; and

authenticating the user as an authorized user of the information handling system (a) based on the first user device and the second device both being connected to the network, (b) when both the first user device and the second device are within the predetermined range of the information handling system, the authenticating using the first user device and the second user device to confirm an identity of the user for the user to access the information handling system, and (c) based on the confidence value being within a confidence value threshold.

2. The method of claim 1, wherein:

the authenticating is configured to only be enabled while the information handling system authenticating the user is coupled to the network.

3. The method of claim 1, wherein:

the first user device and the second user device comprise at least one of a smart phone type information handling system, a tablet type information handling system, a wearable fitness device, a smart watch, and an employee identification badge.

4. The method of claim 1, wherein:

a wireless communication technology is used to communicate between the first user device and the second user device and the information handling system.

5. The method of claim 1, wherein:

registering the first user device and the second user device further comprises determining a device identifier associated with each of the first user device and the second user device; and

,

the authenticating further comprises comparing the device identifier associated with each of the first user device and the second user device with a previously stored device identifier for each of the first user device and the second user device.

6. The method of claim 1, wherein:

the authenticating further comprises a learning operation, the learning operation identifying user devices within a predetermined range of the information handling system when the user is identified as an authorized user of the information handling system.

7. A system comprising:

a processor;

a data bus coupled to the processor; and

a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions that, when executed by the processor, cause the system to perform operations comprising;

register a first user device associated with a user with an information handling system;

register a second user device associated with the user with the information handling system;

determine that the first user device and the second user device are connected to a network associated with the information handling system

receive an authentication request from the first user device, the authentication request including an identifier of the first user device;

access an electronic record of the user based on the first user device to determine an identity of the user and other user devices that are registered with the user;

identify the second user device in the electronic record;

determine that the first user device and the second user device are within a predetermined range of the information handling system based on a detected signal strength for each of the first user device and the second user device to the network; and

,

determine a confidence value based on at least one of;

the first user device, the second user device, a type of device for the first user device, and a type of device of the second user device;

authenticate the user as an authorized user of the information handling system (a) based on the first user device and the second device both being connected to the network, (b) when both the first user device and the second device are within the predetermined range of the information handling system, the authenticating using the first user device and the second user device to confirm an identity of the user for the user to access the information handling system, and (c) based on the confidence value being within a confidence value threshold.

8. The system of claim 7, wherein:

the authenticating is configured to only be enabled while the information handling system authenticating the user is coupled to the network.

9. The system of claim 7, wherein:

the first user device and the second user device comprise at least one of a smart phone type information handling system, a tablet type information handling system, a wearable fitness device, a smart watch, and an employee identification badge.

10. The system of claim 7, wherein:

a wireless communication technology is used to communicate between the first user device and the second user device and the information handling system.

11. The system of claim 7, wherein:

registering the first user device and the second user device further comprises determining a device identifier associated with each of the first user device and the second user device; and

,

the authenticating further comprises comparing the device identifier associated with each of the first user device and the second user device with a previously stored device identifier for each of the first user device and the second user device.

12. The system of claim 7, wherein:

the authenticating further comprises a learning operation, the learning operation identifying user devices within a predetermined range of the information handling system when the user is identified as an authorized user of the information handling system.

13. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions that, when executed by a processor, cause a system to perform operations comprising:

registering a first user device associated with a user with an information handling system;

registering a second user device associated with the user with the information handling system;

determining that the first user device and the second user device are connected to a network associated with the information handling system;

receiving an authentication request from the first user device, the authentication request including an identifier of the first user device;

accessing an electronic record of the user based on the first user device to determine an identity of the user and other user devices that are registered with the user;

identifying the second user device in the electronic record;

determining that the first user device and the second user device are within a predetermined range of the information handling system based on a detected signal strength for each of the first user device and the second user device to the network;

determining a confidence value based on at least one of;

the first user device, the second user device, a type of device for the first user device, and a type of device of the second user device; and

authenticating the user as an authorized user of the information handling system (a) based on the first user device and the second device both being connected to the network, (b) when both the first user device and the second device are within the predetermined range of the information handling system, the authenticating using the first user device and the second user device to confirm an identity of the user for the user to access the information handling system, and (c) based on the confidence value being within a confidence value threshold.

14. The non-transitory, computer-readable storage medium of claim 13, wherein:

the authenticating is configured to only be enabled while the information handling system authenticating the user is coupled to the network.

15. The non-transitory, computer-readable storage medium of claim 13, wherein:

the first user device and the second user device comprise at least one of a smart phone type information handling system, a tablet type information handling system, a wearable fitness device, a smart watch, and an employee identification badge.

16. The non-transitory, computer-readable storage medium of claim 13, wherein:

a wireless communication technology is used to communicate between the first user device and the second user device and the information handling system.

17. The non-transitory, computer-readable storage medium of claim 13, wherein:

registering the first user device and the second user device further comprises determining a device identifier associated with each of the first user device and the second user device; and

,

the authenticating further comprises comparing the device identifier associated with each of the first user device and the second user device with a previously stored device identifier for each of the first user device and the second user device.

18. The non-transitory, computer-readable storage medium of claim 13, wherein:

the authenticating further comprises a learning operation, the learning operation identifying user devices within a predetermined range of the information handling system when the user is identified as an authorized user of the information handling system.