Fortified authentication on multiple computers using collaborative agents

• US 20070050845A1
• Filed: 10/21/2005
• Published: 03/01/2007
• Est. Priority Date: 08/31/2005
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Das, Tapas, Sharma, Nitin, Shen, Jingxue
• Granted Patent: US 7,617,523 B2
• Time in Patent Office: Days
• US Class Current: 726/17
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers

Abstract

A method and system of authentication for accessing one or more applications by a user by using collaborative agents for automating authentication to the one or more applications. The use of collaborative agents obviates a need for the user to remember fortified authentication credentials for each application.

Claims

1. A computer-implemented method for providing a user secure access to a plurality of applications that run on one or more computers of a plurality of computers, the computer-implemented method comprising using a corresponding computer-implemented authentication agent on each computer of said plurality of computers, wherein said corresponding computer-implemented authentication agents are suitable for collaborating with each other for automating authentication to access any application of said plurality of applications running on any of said one or more computers, wherein said automating authentication obviates a need for said user to remember corresponding authentication credentials for said any application.

2. The computer-implemented method of claim 1, further comprising securely logging onto a local computer-implemented authentication agent on a local computer associated with said user, wherein said local computer-implemented authentication agent is one of said corresponding computer-implemented authentication agents.

3. The computer-implemented method of claim 2, further comprising using a password and a second factor authentication credential.

4. The computer-implemented method of claim 3, wherein said second factor authentication credential comprises any second factor authentication credential from a set of second factor authentication credentials comprising a USB smart card token, a USB thumb drive with corresponding ID, an RFID proximity card, and a fingerprint.

5. The computer-implemented method of claim 2, further comprising retrieving application authentication credentials for said plurality of applications by said local computer-implemented authentication agent.

6. The computer-implemented method of claim 2, further comprising retrieving operating system login credentials associated with said local computer by said local computer-implemented authentication agent.

7. The computer-implemented method of claim 5, wherein said application authentication credentials for said plurality of applications are retrieved from one or more of:

a hard disk that is associated with said local computer, a remote credential management server, a removable storage media, and a USB smart card token.

8. The computer-implemented method of claim 6, wherein said operating system login credentials are retrieved from one or more of:

a hard disk that is associated with said local computer, a remote credential management server, a removable storage media, and a USB smart card token.

9. The computer-implemented method of claim 1, further comprising establishing a secure channel of communication between any two of said corresponding computer-implemented authentication agents.

10. The computer-implemented method of claim 1, further comprising securely logging onto a remote computer-implemented authentication agent corresponding to a remote computer, wherein said remote computer-implemented authentication agent is one of said corresponding computer-implemented authentication agents.

11. The computer-implemented method of claim 10, further comprising collaborating with a local computer-implemented authentication agent on a local computer associated with said user to assist with verifying second factor credentials.

12. The computer-implemented method of claim 10, further comprising retrieving operating system login credentials associated with said remote computer for starting an operating system session on said remote computer.

13. The computer-implemented method of claim 12, wherein said operating system login credentials associated with said remote computer are retrieved from one or more of:

a hard disk that is associated with a local computer associated with said user, a remote credential management server, a removable storage media, and a USB smart card token.

14. The computer-implemented method of claim 10, further comprising collaborating with a local computer-implemented authentication agent on a local computer associated with said user for obtaining a credential wallet of said user, wherein said credential wallet includes:

operating system login credentials for starting an operating system session on said remote computer for said user; and

application authentication credentials for accessing said plurality of applications.

15. The computer-implemented method of claim 14, further comprising injecting, by said remote computer-implemented authentication agent, a corresponding application authentication credential from said wallet for a selected application of said plurality of applications on behalf of said user when attempting to access said selected application.

16. The computer-implemented method of claim 14, further comprising injecting, by said remote computer-implemented authentication agent, said operating system login credentials for starting said operating system session on said remote computer on behalf of said user.

17. The computer-implemented method of claim 14, further comprising:

receiving a request by said local computer-implemented authentication agent on said local computer from said remote computer-implemented authentication agent for a one-time password;

generating said one-time password; and

sending said one-time password to said remote computer-implemented authentication agent for injection to a one-time-password enabled application on said remote computer.

18. The computer-implemented method of claim 17, further comprising:

requesting said user for a token pin associated with a USB Smart Card;

sending said token pin by said remote computer-implemented authentication agent to said local computer-implemented authentication agent on said local computer for verification with said USB Smart Card; and

upon successful verification then injecting said one-time password to said one-time-password enabled application on said remote computer by said remote computer-implemented authentication agent.

19. The computer-implemented method of claim 1, further comprising synchronizing amongst two or more relevant authentication information keepers, any updated credentials information associated with said plurality of applications.

20. The computer-implemented method of claim 1, further comprising synchronizing, amongst said corresponding computer-implemented authentication agents, any updated credentials information associated with said plurality of applications.

21. The computer-implemented method of claim 11, further comprising verifying a password and user name of said user before verifying said second factor credentials.

22. The computer-implemented method of claim 11, further comprising verifying a password of said user after verifying said second factor credentials.

23. The computer-implemented method of claim 21, wherein said second factor credentials includes an RFID proximity card and wherein verifying said second factor credentials further comprises using said local computer-implemented authentication agent to send an RFID associated with said RFID proximity card to said remote computer-implemented authentication agent for verification.

24. The computer-implemented method of claim 21, wherein said second factor credentials includes a fingerprint or other biometric data and wherein verifying said second factor credentials further comprises using said local computer-implemented authentication agent to send said fingerprint information or said biometric data to said remote computer-implemented authentication agent for verification.

25. The computer-implemented method of claim 21, wherein said second factor credentials includes a USB thumb drive with ID and wherein verifying said second factor credentials further comprises using said local computer-implemented authentication agent to send said ID associated with said USB thumb drive to said remote computer-implemented authentication agent for verification.

26. The computer-implemented method of claim 21, wherein said second factor credentials includes a USB smart card token and wherein verifying said second factor credentials further comprises:

using said local computer-implemented authentication agent to request a PIN associated with said USB smart card token from said remote computer-implemented authentication agent;

using said remote computer-implemented authentication agent to send said PIN to said local computer-implemented authentication agent for verification with said USB smart card token.

27. The computer-implemented method of claim 22, wherein said second factor credentials includes an RFID proximity card and wherein verifying said second factor credentials further comprises:

using said local computer-implemented authentication agent to send an RFID associated with said RFID proximity card to said remote computer-implemented authentication agent; and

using said remote computer-implemented authentication agent to request said password from said user and verifying said RFID and said password received from said user.

28. The computer-implemented method of claim 22, wherein said second factor credentials includes a fingerprint or other biometric data and wherein verifying said second factor credentials further comprises:

using said local computer-implemented authentication agent to send said fingerprint information or said biometric data to said remote computer-implemented authentication agent; and

using said remote computer-implemented authentication agent to request said password from said user and verifying said fingerprint information or said biometric data and said password received from said user.

29. The computer-implemented method of claim 22, wherein said second factor credentials includes a USB thumb drive with ID and wherein verifying said second factor credentials further comprises:

using said local computer-implemented authentication agent to send said ID to said remote computer-implemented authentication agent; and

using said remote computer-implemented authentication agent to request said password from said user and verifying said ID and said password received from said user.

30. The computer-implemented method of claim 22, wherein said second factor credentials includes a USB smart card token and wherein verifying said second factor credentials further comprises:

using said local computer-implemented authentication agent to request a PIN associated with said USB smart card token from said remote computer-implemented authentication agent; and

using said remote computer-implemented authentication agent to request said password from said user and to send said password to said local computer-implemented authentication agent for verification with said USB smart card token.

31. An authentication system for authenticating a user who wishes to access a plurality of applications that are managed by any computer of a plurality of computers, said authentication system comprising a corresponding computer-implemented authentication agent on each computer of said plurality of computers, wherein said corresponding computer-implemented authentication agents are suitable for collaborating with each other for automating fortified authentication to access any application of said plurality of applications running on any of said plurality of computers, wherein said automating fortified authentication obviates a need for said user to remember corresponding authentication credentials for said any application.

32. The authentication system of claim 31, wherein said corresponding computer-implemented authentication agents include a local computer-implemented authentication agent on a local computer associated with said user.

33. The authentication system of claim 31, further comprising a second factor authentication credential wherein said second factor authentication credential comprises any second factor authentication credential from a set of second factor authentication credentials comprising a USB smart card token, a USB thumb drive with ID, an RFID proximity card, and a fingerprint.

34. The authentication system of claim 31, further comprising a remote credential management server from which user authentication credentials and application authentication credentials for said plurality of applications are retrieved.

35. The authentication system of claim 31, further comprising a local hard disk associated with a local computer that is associated with said user, wherein user authentication credentials and application authentication credentials for said plurality of applications are retrieved from said local hard disk.

36. The authentication system of claim 31, further comprising a removable storage medium from which user authentication credentials and application authentication credentials for said plurality of applications are retrieved.

37. The authentication system of claim 31, further comprising a secure channel of communication between any two of said corresponding computer-implemented authentication agents.

38. The authentication system of claim 31, further comprising a credential wallet of said user, wherein said credential wallet includes:

operating system login credentials for starting an operating system session on a remote computer for said user; and

application login credentials for accessing said plurality of applications.

39. The authentication system of claim 38, further comprising sending said credential wallet to a remote computer-implemented authentication agent on said remote computer by a local computer-implemented authentication agent on a local computer that has access to said credential wallet.

40. An authentication system for authenticating a user who wishes to access a plurality of applications that are protected by fortified authentication credentials and that are managed by any computer of a plurality of computers, the authentication system comprising:

a means for authenticating said user for logging onto a local computer of said plurality of computers;

a means for automating authentication of said user for logging onto a remote computer of said plurality of computers; and

a means for automating access to said plurality of applications that are protected by fortified authentication credentials.

41. The authentication system of claim 40, further comprising a means for secure communication between said local computer and said remote computer.

42. The authentication system of claim 40, further comprising a means for synchronizing authentication information amongst said plurality of computers.

43. The authentication system of claim 40, further comprising a storage means for storing authentication information wherein said storage means is accessible by said local computer and said remote computer.

44. The authentication system of claim 40, further comprising a means for employing a second factor authentication credential.