Authenticator centralization and protection based on authenticator type and authentication policy

• US 10,616,222 B2
• Filed: 02/05/2019
• Issued: 04/07/2020
• Est. Priority Date: 09/21/2015
• Status: Active Grant

• Current Assignee: Payfone Incorporated
• Original Assignee: Early Warning Services, LLC
• Inventors: Rolfe, Andrew Robert, Dundas, Alan, Slowiak, Gregory
• Primary Examiner(s): Patel, Haresh N
• Application Number:
  US16/268,243
• Publication Number:
  US 20190260746A1
• Time in Patent Office: 427 Days
• Field of Search: 726 6
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity

Abstract

Provided is a method for authenticating a user communicating with an enterprise via a network. The method includes receiving, via the network, authenticators for a user from a first user device associated with the user, and storing the received authenticators. A first authenticator from the stored authenticators is selected to be used for authenticating the user based on an authentication policy received from the enterprise. An authentication request is transmitted to a user device requesting the first authenticator and the user is authentication by comparing the received authenticator with the stored first authenticator.

Claims

1. An authentication server for authenticating a user who is communicating with an enterprise via a network, comprising:

a memory for receiving, via the network, authenticators for a user from a user device associated with the user, and storing the received authenticators; and

a processor for;

receiving, from the enterprise, a request to authenticate the user with an authentication policy for authenticating the user, wherein the request does not identify which of the stored authenticators is to be used for authenticating the user, wherein the authentication policy establishes a type of authenticator to be used for authenticating the user;

determining a first authenticator from the stored authenticators to be used for authenticating the user based on the authentication policy received from the enterprise;

transmitting an authentication request to the user device via the network requesting the first authenticator;

in response to the authentication request, receiving from the first user device, an authenticator in response to the authentication request, and authenticating the user by comparing the received authenticator with the stored first authenticator.

2. The authentication server of claim 1, wherein the stored authenticators include a plurality of authenticators including at least two different authenticators in different categories of authenticators, the different categories including a knowledge category including information known to the user, a possession category including something physically possessed by the user, and a biometric category identifying physical attributes of the user.

3. The authentication server of claim 1, wherein the stored authenticators include a plurality of authenticators including one or more of:

(i) at least two different authenticators in different categories of authenticators, the different categories including at least two of a knowledge category including information known to the user, a possession category including something physically possessed by the user, and a biometric category identifying physical attributes of the user;

(ii) at least two different types of authenticators in a same category of authenticators;

or (iii) at least two different species of authenticators of the same type of authenticator.

4. The authentication server of claim 1, further comprising:

receiving from the user device, via the network, a device identifier that identifies the user device and storing the device identifier in association with a user account identifier, the stored received authenticators being stored with the user account identifier;

storing a relationship identifier that identifies a relationship between the enterprise and the user device using the device identifier; and

the determining whether the stored authenticators include the first authenticator comprises identifying the stored authenticators using the relationship identifier to identify the device identifier and using the device identifier to identify the user account identifier stored with the received authenticators.

5. The authentication server of claim 1, wherein the stored authenticators are stored in a hierarchy based on predetermined level of trust associated with each of the received authenticators.

6. The authentication server of claim 5, wherein the first authenticator of the stored authenticators is used for authenticating the user by applying the authentication policy to the stored hierarchy of authenticators.

7. The authentication server of claim 1, further comprising:

transmitting to the enterprise, via the network, a result of the authentication including a type of authenticator used for the authentication.

8. The authentication server of claim 1, wherein the authentication server does not store the true identity of the user.

9. The authentication server of claim 1, wherein the enterprise does not know what authenticators are stored in the memory of the authentication server.

10. A computer implemented method for authenticating a user who is communicating with an enterprise via a user device, comprising:

receiving authenticators for a user and storing the received authenticators;

receiving, from the enterprise, a request to authenticate the user with an authentication policy for authenticating the user, wherein the request does not identify which of the stored authenticators is to be used for authenticating the user, wherein the authentication policy establishes a type of authenticator to be used for authenticating the user;

determining whether the stored authenticators include a first authenticator to be used for authenticating the user based on the authentication policy;

when the stored indicators include the first authenticator, transmitting an authentication request to the user device requesting the first authenticator, receiving, from the user device, an authenticator in response to the authentication request, and authenticating the user by comparing the received authenticator with the stored first authenticator; and

when the stored authenticators do not include the first authenticator, transmitting to the entity an identification of at least one of the stored authenticators, for the entity to determine if the at least one of stored authenticators is to be used for authentication.

11. The method of claim 10, wherein the stored authenticators include a plurality of authenticators including at least two different authenticators in different categories of authenticators, the different categories including a knowledge category including information known to the user, a possession category including something physically possessed by the user, and a biometric category identifying physical attributes of the user.

12. The method of claim 10, wherein the stored authenticators include a plurality of authenticators including one or more of:

(i) at least two different authenticators in different categories of authenticators, the different categories including at least two of a knowledge category including information known to the user, a possession category including something physically possessed by the user, and a biometric category identifying physical attributes of the user;

(ii) at least two different types of authenticators in a same category of authenticators;

or (iii) at least two different species of authenticators of the same type of authenticator.

13. The method of claim 10, further comprising:

receiving from the user device, via the network, a device identifier that identifies the user device and storing the device identifier in association with a user account identifier, the stored received authenticators being stored with the user account identifier;

storing a relationship identifier that identifies a relationship between the enterprise and the user device using the device identifier; and

the determining whether the stored authenticators include the first authenticator comprises identifying the stored authenticators using the relationship identifier to identify the device identifier and using the device identifier to identify the user account identifier stored with the received authenticators.

14. The method of claim 10, wherein the stored authenticators are stored in a hierarchy based on predetermined level of trust associated with each of the received authenticators.

15. The method of claim 14, wherein the first authenticator of the stored authenticators is used for authenticating the user by applying the authentication policy to the stored hierarchy of authenticators.

16. The method of claim 10, further comprising:

transmitting to the enterprise a result of the authentication including a type of authenticator used for the authentication.

17. A computer implemented method for authenticating a user who is communicating with an enterprise via a network, comprising:

receiving, via the network, authenticators for a user from a first user device associated with the user and authenticators for a second user device associated with the user, and storing the received authenticators;

receiving, from the enterprise, a request to authenticate the user with an authentication policy for authenticating the user, wherein the request does not identify which of the stored authenticators is to be used for authenticating the user, wherein the authentication policy establishes a type of authenticator to be used for authenticating the user;

determining whether the stored authenticators include a first authenticator to be used for authenticating the user based on the authentication policy; and

when the stored indicators include the first authenticator, selecting one of the first user device and the second user device to use for authentication, transmitting an authentication request to the selected user device via the network requesting the first authenticator, receiving, from the selected user device, an authenticator in response to the authentication request, and authenticating the user by comparing the received authenticator with the stored first authenticator; and

when the stored authenticators do not include the first authenticator, transmitting to the enterprise an identification of at least one of the stored authenticators, for the entity to determine if the at least one of stored authenticators is to be used for authentication.

18. The method of claim 17, further comprising:

receiving from the first user device, via the network, a first device identifier that identifies the first user device and storing the first device identifier in association with a user account identifier, the stored authenticators being stored with the user account identifier;

receiving from the second user device, via the network, a second device identifier that identifies the second user device and storing the second device identifier in association with the user account identifier, the stored received authenticators being stored with the user account identifier;

storing a first relationship identifier that identifies a relationship between the enterprise and the first user device using the first device identifier;

storing a second relationship identifier that identifies a relationship between the enterprise and the second user device using the second device identifier; and

the determining whether the stored authenticators include the first authenticator comprises identifying the stored authenticators using the first relationship identifier to identify the first device identifier and using the first device identifier to identify the user account identifier stored with the received authenticators.

19. The method of claim 17, wherein the received authenticators are stored in a hierarchy based on predetermined level of trust associated with each of the received authenticators.

20. The method of claim 17, wherein the first authenticator of the stored authenticators is used for authenticating the user by applying the authentication policy to the stored hierarchy of authenticators, and the first user device or the second user device is selected to be used for authentication based on the stored hierarchy.