Authenticator centralization and protection

• US 10,084,782 B2
• Filed: 09/19/2016
• Issued: 09/25/2018
• Est. Priority Date: 09/21/2015
• Status: Active Grant

• Current Assignee: Payfone Incorporated
• Original Assignee: Early Warning Services, LLC
• Inventors: Rolfe, Andrew Robert, Dundas, Alan, Slowiak, Gregory
• Primary Examiner(s): Patel, Haresh N
• Application Number:
  US15/269,287
• Publication Number:
  US 20170085568A1
• Time in Patent Office: 736 Days
• Field of Search: 726 6
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity

Abstract

Provided is a method for authenticating a user communicating with an enterprise via a network. The method includes receiving, via the network, authenticators for a user from a first user device associated with the user, and storing the received authenticators. A first authenticator from the stored authenticators is selected to be used for authenticating the user based on an authentication policy received from the enterprise. An authentication request is transmitted to a user device requesting the first authenticator and the user is authentication by by comparing the received authenticator with the stored first authenticator.

Claims

1. A computer implemented method for authenticating a user who is communicating with an enterprise via a network, comprising:

receiving, via the network, authenticators for a user from a first user device associated with the user, and storing the received authenticators;

receiving, from the enterprise, a request to authenticate the user with an authentication policy for authenticating the user, wherein the request does not identify which of the stored authenticators is to be used for authenticating the user;

determining, a first authenticator from the stored authenticators to be used for authenticating the user based on the authentication policy received from the enterprise;

transmitting an authentication request to the first user device via the network requesting the first authenticator;

receiving, from the first user device via the network, an authenticator in response to the authentication request; and

authenticating the user by comparing the received authenticator with the stored first authenticator.

2. The method of claim 1, wherein the stored authenticators include a plurality of authenticators including at least two different authenticators in different categories of authenticators, the different categories including a knowledge category including information known to the user, a possession category including something physically possessed by the user;

and a biometric category identifying physical attributes of the user.

3. The method of claim 2, wherein the stored authenticators are stored in a hierarchy based on predetermined level of trust associated with each of the received authenticators.

4. The method of claim 3, wherein the first authenticator of the stored authenticators is determined to be used for authenticating the user by applying the authentication policy to the stored hierarchy of authenticators.

5. The method of claim 1, wherein the stored authenticators include a plurality of authenticators including one or more of:

(i) at least two different authenticators in different categories of authenticators, the different categories including at least two of a knowledge category including information known to the user, a possession category including something physically possessed by the user; and

a biometric category identifying physical attributes of the user;

(ii) at least two different types of authenticators in a same category of authenticators or (iii) at least two different species of authenticators of the same type of authenticator.

6. The method of claim 1, further comprising:

receiving from the first user device, via the network, a first device identifier that identifies the first user device and storing the first device identifier in association with a user account identifier, the stored received authenticators being stored with the user account identifier;

storing a relationship identifier that identifies a relationship between the enterprise and the first user device using the first device identifier; and

the determining the first authenticator from the stored authenticators comprises identifying the stored authenticators using the relationship identifier to identify the first device identifier and using the first device identifier to identify the user account identifier stored with the received authenticators.

7. The method of claim 1, further comprising:

transmitting to the enterprise, via the network, a result of the authentication including a type of authenticator used for the authentication.

8. A computer implemented method for authenticating a user who is communicating with an enterprise via a network, comprising:

receiving, via the network, authenticators for a user from a first user device associated with the user and authenticators for a second user device associated with the user, and storing the received authenticators;

receiving, from the enterprise, a request to authenticate the user with an authentication policy for authenticating the user, wherein the request does not identify which of the stored authenticators is to be used for authenticating the user;

determining, a first authenticator from the stored authenticators to be used for authenticating the user based on the authentication policy received from the enterprise and selecting one of the first user device and the second user device to use for authentication;

transmitting an authentication request to the selected one of the first user device and the second user device via the network requesting the first authenticator;

receiving, from the selected one of the first user device and the second user device, an authenticator in response to the authentication request; and

authenticating the user by comparing the received authenticator with the stored first authenticator.

9. The method of claim 8, wherein the stored authenticators include a plurality of authenticators including at least two different authenticators in different categories of authenticators, the different categories including a knowledge category including information known to the user, a possession category including something physically possessed by the user;

and a biometric category identifying physical attributes of the user.

10. The method of claim 9, wherein the received authenticators are stored in a hierarchy based on predetermined level of trust associated with each of the received authenticators.

11. The method of claim 10, wherein the first authenticator of the stored authenticators is determined to be used for authenticating the user by applying the authentication policy to the stored hierarchy of authenticators;

and the first user device or the second user device is selected to be used for authentication based on the stored hierarchy.

12. The method of claim 8, wherein the stored authenticators include a plurality of authenticators including one or more of:

(i) at least two different authenticators in different categories of authenticators, the different categories including at least two of a knowledge category including information known to the user, a possession category including something physically possessed by the user; and

a biometric category identifying physical attributes of the user;

(ii) at least two different types of authenticators in a same category of authenticators or (iii) at least two different species of authenticators of the same type of authenticator.

13. The method of claim 8, further comprising:

receiving from the first user device, via the network, a first device identifier that identifies the first user device and storing the first device identifier in association with a user account identifier, the stored authenticators being stored with the user account identifier;

receiving from the second user device, via the network, a second device identifier that identifies the second user device and storing the second device identifier in association with the user account identifier, the stored received authenticators being stored with the user account identifier;

storing a first relationship identifier that identifies a relationship between the enterprise and the first user device using the first device identifier;

storing a second relationship identifier that identifies a relationship between the enterprise and the second user device using the second device identifier; and

the determining the first authenticator from the stored authenticators comprises identifying the stored authenticators using the first relationship identifier to identify the first device identifier and using the first device identifier to identify the user account identifier stored with the received authenticators.

14. An article of manufacture for authenticating a user who is communicating with an enterprise via a network, comprising:

a non-transitory storage medium; and

logic stored on the storage medium, wherein the stored logic is configured to be readable by a processor and thereby causes the processor to operate so as to;

receive, via the network, authenticators for a user from a first user device associated with the user, and store the received authenticators;

receive, from the enterprise, a request to authenticate the user with an authentication policy for authenticating the user, wherein the request does not identify which of the stored authenticators is to be used for authenticating the user;

determine, a first authenticator from the stored authenticators to be used for authenticating the user based on the authentication policy received from the enterprise;

transmit an authentication request to the first user device via the network requesting the first authenticator;

receive, from the first user device via the network, an authenticator in response to the authentication request; and

authenticate the user by comparing the received authenticator with the stored first authenticator.

15. The article of manufacture according to claim 14, wherein the stored authenticators include a plurality of authenticators including at least two different authenticators in different categories of authenticators, the different categories including a knowledge category including information known to the user, a possession category including something physically possessed by the user;

and a biometric category identifying physical attributes of the user.

16. The article of manufacture according to claim 15, wherein the stored authenticators are stored in a hierarchy based on predetermined level of trust associated with each of the received authenticators.

17. The article of manufacture according to claim 16, wherein the first authenticator of the stored authenticators is determined to be used for authenticating the user by applying the authentication policy to the stored hierarchy of authenticators.

18. The article of manufacture according to claim 14, wherein the stored authenticators include a plurality of authenticators including one or more of:

(i) at least two different authenticators in different categories of authenticators, the different categories including at least two of a knowledge category including information known to the user, a possession category including something physically possessed by the user; and

a biometric category identifying physical attributes of the user;

(ii) at least two different types of authenticators in a same category of authenticators or (iii) at least two different species of authenticators of the same type of authenticator.

19. The article of manufacture according to claim 14, further comprising:

receiving from the first user device, via the network, a first device identifier that identifies the first user device and storing the first device identifier in association with a user account identifier, the stored received authenticators being stored with the user account identifier;

storing a relationship identifier that identifies a relationship between the enterprise and the first user device using the first device identifier; and

the determining the first authenticator from the stored authenticators comprises identifying the stored authenticators using the relationship identifier to identify the first device identifier and using the first device identifier to identify the user account identifier stored with the received authenticators.

20. The article of manufacture according to claim 14, further comprising:

transmitting to the enterprise, via the network, a result of the authentication including a type of authenticator used for the authentication.