Techniques for access management based on multi-factor authentication including knowledge-based authentication

• US 10,157,275 B1
• Filed: 10/12/2017
• Issued: 12/18/2018
• Est. Priority Date: 10/12/2017
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Venkatasamy, Satishkumar, Rana, Rima, Panda, Durga Harini, Ramadoss, Lakshmi
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): Beheshti Shirazi, Sayed Aresh
• Application Number:
  US15/782,700
• Time in Patent Office: 432 Days
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/3215 using a plurality of channels network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

An access management system is disclosed that can employ multi-factor authentication (MFA) using multiple types of authentication. In at least one embodiment, techniques may include implementing multi-factor authentication (MFA) including knowledge-based authentication (KBA). MFA may be based on multiple factors, such as “what you know” (e.g., a password or an answer to a question known by a user) and “what you have” (e.g., a trusted device registered for a user). In at least one embodiment, multiple devices (e.g., a desktop computer and a mobile device) may be utilized to provide for stronger authentication using a combination of what a user has. The combination of MFA based on what you know (e.g., KBA) and what you have (e.g., a trusted device) may further ensure authentication is not compromised. The techniques disclosed herein may provide for a stronger form of authentication to reduce, if not eliminate, possible vulnerabilities for access management.

Claims

1. A method comprising:

performing a first authentication of a user in response to receiving, from a first device of the user, a request to access a resource;

based on the first authentication being successful, performing a second authentication of the user to determine whether to permit access to the resource, the second authentication comprising;

identifying, by a computer system of an access management system, a second device associated with the user, wherein the second device is registered with the access management system as a trusted device for the user, and wherein the second device is different from the first device;

transmitting, by the computer system, via a communication system, to the second device, encrypted data including a first identifier, wherein the first identifier is used by an application on the second device when communicating with the access management system;

receiving, from the application, a request to perform the second authentication;

determining that the request to perform the second authentication includes a second identifier;

responsive to determining that the second identifier matches the first identifier, obtaining authentication data, the authentication data including media content provided by the user at the first device for use in connection with the second authentication, one or more questions related to the media content, and one or more answers corresponding to the one or more questions;

sending, to the second device, the media content, wherein the application displays the media content to the user at the second device;

sending, to the first device, the one or more questions related to the media content, wherein the first device displays the one or more questions to the user;

receiving, from the first device, a response by the user to the one or more questions; and

determining, by the computer system, whether the response satisfies the one or more answers corresponding to the one or more questions; and

based on determining that the response satisfies the one or more answers corresponding to the one or more questions, permitting the first device to access the resource.

2. The method of claim 1, wherein sending the media content and sending the one or more questions occurs concurrently.

3. The method of claim 1, further comprising:

generating security data for use in communication between the application and the access management system; and

sending a portion of the security data to the second device in connection with registration of the second device.

4. The method of claim 3, wherein the request to perform the second authentication is encrypted using the portion of the security data sent to the second device.

5. The method of claim 3, wherein the media content sent to the second device is encrypted using the security data.

6. The method of claim 1, wherein the media content is an image.

7. The method of claim 1, wherein the media content is a video.

8. The method of claim 1, further comprising:

generating the first identifier, wherein the first identifier is a transaction identifier generated for the second device.

9. The method of claim 1, wherein the communication system is a push notification system.

10. The method of claim 1, wherein the second device is a mobile device.

11. An access management system comprising:

one or more processors; and

a memory accessible to the one or more processors, the memory storing one or more instructions that, upon execution by the one or more processors, cause the one or more processors to;

perform a first authentication of a user in response to receiving, from a first device of the user, a request to access a resource;

based on the first authentication being successful, perform a second authentication of the user to determine whether to permit access to the resource, the second authentication comprising;

identifying a second device associated with the user, wherein the second device is registered with the access management system as a trusted device for the user, and wherein the second device is different from the first device;

transmitting, via a communication system, to the second device, encrypted data including a first identifier, wherein the first identifier is used by an application on the second device when communicating with the access management system;

receiving, from the application, a request to perform the second authentication;

determining that the request to perform the second authentication includes a second identifier;

responsive to determining that the second identifier matches the first identifier, obtaining authentication data, the authentication data including media content provided by the user at the first device for use in connection with the second authentication, one or more questions related to the media content, and one or more answers corresponding to each of the one or more questions;

sending, to the second device, the media content, wherein the application displays the media content to the user at the second device;

sending, to the first device, the one or more questions related to the media content, wherein the first device displays the one or more questions to the user;

receiving, from the first device, a response by the user to the one or more questions; and

determining whether the response satisfies the one or more answers corresponding to the one or more questions; and

based on determining that the response satisfies the one or more answers corresponding to the one or more questions, permit the first device to access the resource.

12. The access management system of claim 11, wherein sending the media content and sending the one or more questions occurs concurrently.

13. The access management system of claim 11, wherein the instructions, upon execution by the one or more processors, further cause the one or more processors to:

generate security data for use in communication between the application and the access management system; and

send a portion of the security data to the second device in connection with registration of the second device.

14. The access management system of claim 13, wherein the request to perform the second authentication is encrypted using the portion of the security data sent to the second device.

15. The access management system of claim 13, wherein the media content sent to the second device is encrypted using the security data.

16. The access management system of claim 11, wherein the instructions, upon execution by the one or more processors, further cause the one or more processors to:

generate the first identifier, wherein the first identifier is a transaction identifier generated for the second device.

17. A non-transitory computer-readable medium storing one or more instructions that, upon execution by one or more processors, causes the one or more processors to:

perform a first authentication of a user in response to receiving, from a first device of the user, a request to access a resource;

based on the first authentication being successful, perform a second authentication of the user to determine whether to permit access to the resource, the second authentication comprising;

identifying, at an access management system, a second device associated with the user, wherein the second device is registered with the access management system as a trusted device for the user, and wherein the second device is different from the first device;

transmitting, via a communication system, to the second device, encrypted data including a first identifier, wherein the first identifier is used by an application on the second device when communicating with the access management system;

receiving, from the application, a request to perform the second authentication;

determining that the request to perform the second authentication includes a second identifier;

responsive to determining that the second identifier matches the first identifier, obtaining authentication data, the authentication data including media content provided by the user at the first device for use in connection with the second authentication, one or more questions related to the media content, and one or more answers corresponding to the one or more questions;

sending, to the second device, the media content, wherein the application displays the media content to the user at the second device;

sending, to the first device, the one or more questions related to the media content, wherein the first device displays the one or more questions to the user;

receiving, from the first device, a response by the user to the one or more questions; and

determining whether the response satisfies the one or more answers corresponding to the one or more questions; and

based on determining that the response satisfies the one or more answers corresponding to the one or more questions, permit the first device to access the resource.

18. The non-transitory computer-readable medium of claim 17, wherein the one or more instructions, upon execution by the one or more processors, further cause the one or more processors to:

generate security data for use in communication between the application and the access management system; and

send a portion of the security data to the second device in connection with registration of the second device.

19. The non-transitory computer-readable medium of claim 17, wherein the one or more instructions, upon execution by the one or more processors, further cause the one or more processors to:

generate the first identifier, wherein the first identifier is a transaction identifier generated for the second device.

20. The non-transitory computer-readable medium of claim 17, wherein sending the media content and sending the one or more questions occurs concurrently.