Credential promotion

• US 20040059590A1
• Filed: 07/23/2003
• Published: 03/25/2004
• Est. Priority Date: 09/13/2002
• Status: Abandoned Application

• Current Assignee: Saflink Corporation (Imprivata Incorporated)
• Original Assignee: Saflink Corporation (Imprivata Incorporated)
• Inventors: Mercredi, Dwayne, Jensen, Gregory C., Frey, Rod
• Application Number:
  US10/398,355
• Publication Number:
  US 20040059590A1
• Time in Patent Office: Days
• US Class Current: 705/1
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

An apparatus, method and program product allow a user (100) who is authenticated (84) in one application to enroll in a different application (95) without having to accomplish conventional enrollment processes. The enrollment credential of the first application (84) is automatically transferred to the second application (95) as the new or updated enrollment credential for the second application (95).

Claims

1. A method of automatically enrolling a user who is already enrolled into a first computer application into a second computer application for which the user is not yet enrolled, comprising:

retrieving an enrollment credential correlated to the user'"'"'s enrollment in the first computer application;

retrieving a capture credential correlated to the user;

determining if the capture credential matches the retrieved enrollment credential within predetermined parameters; and

if there is a match of the capture credential and the retrieved enrollment credential, storing the retrieved enrollment credential as correlated to the user'"'"'s enrollment in the second computer application, whereby to enroll the user into the second application.

2. The method of claim 1, wherein if there is a match of the capture credential and the retrieved enrollment credential, further comprising allowing the user access to at least a portion of the second application.

3. The method of claim 1, wherein if there is no match of the capture credential and the retrieved enrollment credential, further comprising not storing the retrieved enrollment credential.

4. The method of claim 1, wherein if there is no match of the capture credential and the retrieved enrollment credential, further comprising not allowing the user access to the second application.

5. The method of claim 1, wherein if there is no match of the capture credential and the retrieved enrollment credential, further comprising initiating a different enrollment procedure.

6. The method of claim 1, wherein retrieving the enrollment credential correlated to the user'"'"'s enrollment credential in the first computer application further comprises determining an identifier correlated to the user for the first computer application.

7. The method of claim 1, wherein retrieving the enrollment credential correlated to the user'"'"'s enrollment credential in the first computer application further comprises retrieving the user'"'"'s enrollment credential from a login application used by the user to access the local machine from which the user initiated enrollment procedures for the second computer application.

8. The method of claim 1, wherein retrieving the enrollment credential correlated to the user'"'"'s enrollment credential in the first computer application further comprises locating the first computer application from an application address input by the user.

9. The method of claim 1, wherein retrieving the enrollment credential correlated to the user'"'"'s enrollment credential in the first computer application further comprises retrieving the user'"'"'s enrollment credential from a primary application designated for the user.

10. The method of claim 1, wherein retrieving the enrollment credential correlated to the user'"'"'s enrollment credential in the first computer application further comprises retrieving a set of credentials.

11. The method of claim 10, further comprising determining an appropriate credential from among the set of credentials in response to user input.

12. The method of claim 10, further comprising automatically determining the appropriate credential from among the set of credentials.

13. The method of claim 12, wherein determining the appropriate credential further comprises accessing at least one policy selected from a group consisting of:

a system policy, a local policy, a user policy, a confidence rating and authenticating device availability.

14. The method of claim 1, wherein storing the retrieved enrollment credential further comprises storing the retrieved enrollment credential on at least one platform selected from a group consisting of:

a local computer, a networked computer, a server, a token and a portable electronic device.

15. The method of claim 1, wherein storing the retrieved enrollment credential further comprises first verifying that the user desires to store the retrieved enrollment credential in the second application.

16. The method of claim 1, wherein storing the retrieved enrollment credential further comprises first determining if a second capture credential received from the user matches the retrieved enrollment credential within the predetermined parameters.

17. The method of claim 1, wherein the credential further comprises at least one authentication mechanism selected from a group consisting of:

a BIR, a token and a password.

18. The method of claim 1, wherein retrieving the capture credential further comprises retrieving the capture credential from memory.

19. The method of claim 1, wherein retrieving the capture credential further comprises receiving the capture credential from the user.

20. The method of claim 1, wherein retrieving the capture credential further comprises retrieving the capture credential from an electronic transmission.

21. The method of claim 1, wherein storing the retrieved enrollment credential further includes storing an updated credential from the first computer application.

22. The method of claim 21, wherein storing the updated credential further comprises storing the updated credential in response to user input.

23. The method of claim 21, wherein storing the updated credential further comprises automatically storing the updated credential in response to the updated credential being accomplished in the first computer application.

24. The method of claim 1, further comprising storing an accounting of the automatic enrollment within memory.

25. The method of claim 1, wherein storing the retrieved enrollment credential as correlated to the user'"'"'s enrollment credential in the second computer application further comprises simultaneously storing the retrieved enrollment credential as correlated to the user'"'"'s enrollment in a third application, whereby to enroll the user into the third application.

26. The method of claim 25, wherein the retrieved enrollment credential further comprises an update.

27. The method of claim 1, wherein retrieving the enrollment credential correlated to the user'"'"'s enrollment in the first computer application further comprises determining a trust network.

28. A method of automatically enrolling a user who is already biometrically enrolled in a first computer application into a second computer application for which the user is not yet biometrically enrolled, comprising:

retrieving an enrollment BIR correlated to the user'"'"'s enrollment in the first computer application;

receiving a capture BIR submitted by the user;

determining if the capture BIR matches the retrieved enrollment BIR within predetermined parameters; and

if there is a match of the capture BIR and the retrieved enrollment BIR, storing the retrieved enrollment BIR as correlated to the user'"'"'s enrollment in the second computer application, whereby to enroll the user into the second application.

29. A method of automatically updating an enrollment credential of a first application in response to the user'"'"'s establishing an enrollment credential for a second application, comprising:

storing a retrieved enrollment credential as correlated to the user'"'"'s enrollment in the second application;

determining if the retrieved enrollment credential is appropriate for use in the user'"'"'s enrollment into the first application;

if the retrieved enrollment credential is determined to be appropriate, storing the retrieved enrollment credential as correlated to the user'"'"'s enrollment into the first application, whereby to update the enrollment credential of the first application.

30. The method of claim 29, further comprising retrieving the retrieved enrollment credential from memory.

31. The method of claim 29, further comprising retrieving the retrieved enrollment credential from a capture authentication credential.

32. The method of claim 29, wherein determining if the enrollment credential is appropriate further comprises verifying the user'"'"'s desire to store the retrieved enrollment credential as correlated to the user'"'"'s enrollment into the first application.

33. The method of claim 32, wherein the verifying further comprises receiving a capture authentication credential submitted by the user.

34. The method of claim 29, wherein storing the retrieved enrollment further comprises storing the retrieved enrollment credential as an additional enrollment credential correlated to the user'"'"'s enrollment into the first application.

35. An apparatus, comprising:

a controller having access to first and second computer applications; and

program code configured to execute on the controller and to retrieve an enrollment credential correlated to a user'"'"'s enrollment in the first computer application;

the program code further configured to retrieve a capture credential correlated to the user and to determine if the capture credential matches the retrieved enrollment credential within predetermined parameters, and if there is a match of the capture credential and the retrieved enrollment credential, the program code is further configured to store the retrieved enrollment credential as correlated to the user'"'"'s enrollment in the second computer application, whereby to enroll the user into the second application.

36. The apparatus of claim 35, wherein if there is a match of the capture credential and the retrieved enrollment credential, the program code allows the user access to at least a portion of the second application.

37. The apparatus of claim 35, wherein if there is no match of the capture credential and the retrieved enrollment credential, the program code does not store the retrieved enrollment credential.

38. The apparatus of claim 35, wherein if there is no match of the capture credential and the retrieved enrollment credential, the program code denies the user access to the second application.

39. The apparatus of claim 35, wherein if there is no match of the capture credential and the retrieved enrollment credential, the program code initiates a different enrollment procedure.

40. The apparatus of claim 35, wherein the program code initiates retrieval of the user'"'"'s enrollment credential from a login application used by the user to access the local machine from which the user initiated enrollment procedures for the second computer application.

41. The apparatus of claim 35, wherein the program code initiates locating the first computer application from an application address input by the user.

42. The apparatus of claim 35, wherein the program code initiates retrieving the user'"'"'s enrollment credential from a primary application designated for the user.

43. The apparatus of claim 35, wherein the program code initiates retrieving an appropriate credential from among the set of credentials in response to user input.

44. The apparatus of claim 43, wherein the program code initiates determining the appropriate credential further comprises accessing at least one policy selected from a group consisting of:

a system policy, a local policy, a user policy, a confidence rating and authenticating device availability.

45. The apparatus of claim 35, wherein the program code initiates storing the retrieved enrollment credential on at least one platform selected from a group consisting of:

a local computer, a networked computer, a server, a token and a portable electronic device.

46. The apparatus of claim 35, wherein the program code first verifies that the user desires to store the retrieved enrollment credential in the second application.

47. The apparatus of claim 35, wherein the program code initiates determining if a second capture credential received from the user matches the retrieved enrollment credential within the predetermined parameters prior to storing the retrieved enrollment credential.

48. The apparatus of claim 35, wherein the credential further comprises at least one authentication mechanism selected from a group consisting of:

a BIR, a token and a password.

49. The apparatus of claim 35, wherein the program code initiates retrieving the capture credential from a group consisting of:

an electronic transmission, a memory, a user submission and a combination thereof.

50. The apparatus of claim 35, wherein the retrieved enrollment credential is stored as an update.

51. The apparatus of claim 35, wherein the program code initiates storing an accounting of the automatic enrollment within memory.

52. The apparatus of claim 35, wherein the program code initiates simultaneously storing the retrieved enrollment credential as correlated to the user'"'"'s enrollment in a third application, whereby to enroll the user into the third application.

53. The apparatus of claim 52, wherein the retrieved enrollment credential is an update.

54. The apparatus of claim 35, wherein the program code initiates determining a trust network.

55. An apparatus, comprising:

a controller having access to first and second computer applications; and

program code configured to execute on the controller and to retrieve an enrollment BIR correlated to a user'"'"'s enrollment in the first computer application;

the program code further configured to receive a capture BIR correlated to the user and to determine if the capture BIR matches the retrieved enrollment BIR within predetermined parameters, and if there is a match of the capture BIR and the retrieved enrollment BIR, the program code is further configured to store the retrieved enrollment BIR as correlated to the user'"'"'s enrollment in the second computer application, whereby to enroll the user into the second application.

56. An apparatus, comprising:

a controller having access to first and second computer applications; and

program code configured to execute on the controller and to store a retrieved enrollment credential as correlated to a user'"'"'s enrollment in a first application;

the program code further configured to determine if the retrieved enrollment credential is appropriate for use in the user'"'"'s enrollment into a second application, wherein the user is already enrolled in the second application, and if the retrieved enrollment credential is determined to be appropriate, the program code being further configured to store the retrieved enrollment credential as correlated to the user'"'"'s enrollment into the second application, whereby to update the enrollment credential of the second application.

57. The apparatus of claim 56, wherein the program code initiates retrieval of the retrieved enrollment credential from memory.

58. The apparatus of claim 56, wherein the program code initiates retrieval of the retrieved enrollment credential from a capture authentication credential submitted by the user.

59. The apparatus of claim 56, wherein the program code initiates verifying the user'"'"'s desire to store the retrieved enrollment credential as correlated to the user'"'"'s enrollment into the first application.

60. The apparatus of claim 59, wherein the program code initiates reception of a capture authentication credential.

61. The apparatus of claim 56, wherein the program code initiates storing the retrieved enrollment credential as an additional enrollment credential correlated to the user'"'"'s enrollment into the first application.

62. A program product, comprising:

a program configured to execute on a controller having access to first and second computer applications, and to retrieve an enrollment credential correlated to a user'"'"'s enrollment in the first computer application;

the program code further configured to retrieve a capture credential correlated to the user and to determine if the capture credential matches the retrieved enrollment credential within predetermined parameters, and if there is a match of the capture credential and the retrieved enrollment credential, the program code is configured to store the retrieved enrollment credential as correlated to the user'"'"'s enrollment in the second computer application, whereby to enroll the user into the second application; and

a signal bearing medium bearing the first program.

63. The program product of claim 62, wherein the signal bearing medium includes at least one of a recordable medium and a transmission-type medium.

64. A program product, comprising:

a program configured to execute on the controller and to store a retrieved enrollment credential as correlated to a user'"'"'s enrollment in a first application;

the program code further configured to determine if the retrieved enrollment credential is appropriate for use in the user'"'"'s enrollment into a second application, wherein the user is already enrolled in the second application, and if the retrieved enrollment credential is determined to be appropriate, the program code being further configured to store the retrieved enrollment credential as correlated to the user'"'"'s enrollment into the second application, whereby to update the enrollment credential of the second application; and

a signal bearing medium bearing the first program.

65. The program product of claim 64, wherein the signal bearing medium includes at least one of a recordable medium and a transmission-type medium.