METHODS AND SYSTEMS FOR SINGLE SIGN ON WITH DYNAMIC AUTHENTICATION LEVELS

• US 20090292927A1
• Filed: 05/20/2009
• Published: 11/26/2009
• Est. Priority Date: 05/23/2008
• Status: Active Grant

• Current Assignee: HSBC Technology & Services Incorporated (HSBC Holdings plc)
• Original Assignee: HSBC Technologies Inc.
• Inventors: KALINOVSKY, Alexander, KOMMARAJU, Aditya, WENZEL, Roberto, BILLINGHAY, Justin Michael, HOYSTED, Fred, KUMAR, Akhilesh, MICHALUK, Henry Robert, HOYLE, Rachel, MADHAVAN, Suresh
• Granted Patent: US 8,141,140 B2
• Time in Patent Office: Days
• US Class Current: 713/185
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

Method and systems for single sign on with dynamic authentication levels is described. The method include receiving a data request for access to a second application, where the user is already authenticated to the first application at a first authentication level. Application information about the authentication level necessary to access the second application is retrieved. In response to a request, the user provides the further authentication data for accessing the second application. The type of the further authentication data required is based on the first authentication level and the minimum authentication level necessary to access the second application. The user is then authenticated to the second application at the minimum authentication level necessary to access the second application.

Claims

1. A computer implemented method for automatically providing access to a second application to a user authenticated to a first application, the method comprising:

(a) receiving from the user authenticated to the first application, using at least one computer system communicating with an electronic network, a data request for access to the second application, wherein the user is authenticated to the first application at a first authentication level;

(b) processing by a computer server, by retrieving application information stored in a database, the minimum authentication level necessary to access the second application;

(c) receiving, from the user via the computer network, further authentication data to access the second application, provided in response to a request, wherein the type of the further authentication data required is based on the first authentication level and the minimum authentication level necessary to access the second application; and

(d) authenticating the user to the second application at the minimum authentication level necessary to access the second application.

2. The method of claim 1, further comprising pre-linking, by the user, the first and second application.

3. The method of claim 1, wherein the user links the second application before accessing it, and wherein linking comprises providing identification and authentication data and creating an entry in a user profile database.

4. The method of claim 3, wherein an entry in the user profile database contains at least one linked application and a username and authentication data associated with the at least one linked application.

5. The method of claim 4, further comprising the user delinking the second application.

6. The method of claim 1, wherein the type of authentication data is at least one of entering a password, responding to challenge questions, and providing biometric information.

7. The method of claim 1, wherein the first authentication level and the minimum authentication level necessary to access the second application are selected from one of four authentication levels.

8. The method of claim 1, wherein the request to access the second application is received from a web browser, and the second application is a web application.

9. The method of claim 1, wherein the request to access the second application is accompanied by a token, and wherein the token contains the user'"'"'s identification, and wherein the token is used by the second application to retrieve information about the user'"'"'s session.

10. The method of claim 9, further comprising encrypting the token using public key cryptography.

11. The method of claim 10, further comprising at least one encryption key is stored in a hardware security manager coupled to the computer server by a computer network.

12. The method of claim 1, further comprising generating a token when the user requests access to the second application from the first application.

13. The method of claim 12, further comprising the token containing the user'"'"'s identification, and wherein the token is used by the computer server to retrieve information about the user'"'"'s session.

14. The method of claim 13, wherein the token contains an identifier and the information necessary to authenticate the user.

15. The method of claim 14, wherein the information is represented using extensible markup language, and wherein the information is encrypted.

16. The method of claim 12, wherein the minimum authentication level necessary to access the second application is determined from a database of application profiles and the user'"'"'s first authentication level contained in the token.

17. The method of claim 1, wherein the second application is a portlet, and wherein a request to access the portlet is automatically received from a the client application after authenticating the client to the first application.

18. The method of claim 1, further comprising:

receiving a request to log off the user to the first application;

receiving a request to authenticate the user to the first application, wherein the request comprises a different username and authentication data;

receiving from the user, via at least one computer system and an electronic network, a request to access the second application, wherein the user is authenticated to the first application at a first authentication level and with the different username;

logging the user off the second application;

determining by a computer server, and using a database of application information, the minimum authentication level necessary to access the second application with the different user name;

receiving from the user, via the computer network, a further authentication data to access the second application, in response to a request, wherein the type of the further authentication data required is based on the first authentication level and the minimum authentication level necessary to access the second application with the different username; and

authenticating the user to the second application at the minimum authentication level necessary to access the second application.

19. The method of claim 1, wherein the authentication data required is dynamically adapted to the user'"'"'s current authentication level.

20. The method claim 19, wherein the authentication data is dynamically adapted for the user'"'"'s current authentication level at each authentication level within an authentication hierarchy.

21. A method for automatically stepping down a user authenticated to an application at a first authentication level, after a period of time, to a lower second authentication level, the method comprising:

(a) a user authenticated to an application at a first authentication level;

(b) receiving, using at least one computer system in communication with an electronic network, after a period of time, a request from a user to access the application;

(c) stepping down, by a computer server, the user'"'"'s authentication level from the first authentication level to a lower second authentication level, based on predetermined criteria, wherein the computer server updates session information regarding the user'"'"'s authentication level, and wherein the predetermined criteria is the period of the time and the first authentication level; and

(d) receiving, through the computer network, further authentication data from the user, wherein the further authentication data is receiving in response to a request, and wherein the type of authentication requested from the user is based on the lower authentication level and the authentication necessary to access the application.

22. The method of claim 21, wherein the stepping down of step (c) is also based on the lower authentication level.

23. The method of claim 21, wherein the type of authentication data is at least one of entering a password, responding to challenge questions, and providing biometric information.

24. The method of claim 21 wherein the request from the user to access the application is received from a web browser, and wherein the application is a web application.

25. The method of claim 21, further comprising:

(e) stepping down, after a second period of time, the user'"'"'s lower authentication level to a still lower authentication level, based on the second period of the time and the lower authentication level.

26. The method of claim 21, wherein stepping down, by a computer server, the user'"'"'s authentication level from the first authentication level to a lower authentication level comprises receiving a request to log off the user from the application.

27. The method of claim 21, further comprising:

a user authenticated to a second application at a first authentication level;

stepping down with respect to the second application, by a computer server, the user'"'"'s authentication level from the first authentication level to a lower authentication level, based on the period of the time and the first authentication level.

28. The method of claim 27 wherein stepping down, by a computer server, the user'"'"'s authentication level from the first authentication level to a lower authentication level, based on the period of the time and the first authentication level is done by receiving a message from the application through a message passing interface.

29. The method of claim 21, wherein the type of authentication requested is dynamically adapted to the user'"'"'s current authentication level.

30. The method of claim 29, wherein the type of authentication requested is dynamically adapted for user'"'"'s current authentication level at each authentication level within an authentication hierarchy.

31. A computer-readable medium of instructions for automatically providing access to a second application to a user authenticated to a first application, the method comprising:

(a) receiving from the user authenticated to the first application, via at least one computer system and an electronic network, a request to access the second application, wherein the user is authenticated to the first application at a first authentication level;

(b) determining by a computer server, and using a database of application information, the minimum authentication level necessary to access the second application;

(c) transmitting to the user via the computer network a request for further authentication to access the second application, based on the first authentication level and the minimum authentication level necessary to access the second application, wherein a type of the further authentication required is abased on the first authentication level and the minimum authentication level necessary to access the second application;

(d) receiving, via the least one computer system and electronic network, the further authentication from the user;

(e) authenticating the user to the second application at the minimum authentication level necessary to access the second application; and

(f) providing the requested access to the second application.

32. A computer implemented system for automatically providing access to a second application to a user authenticated to a first application, the system comprising:

a front end server receiving from the user authenticated to the first application, using at least one computer system communicating with an electronic network, a data request for access to the second application, wherein the user is authenticated to the first application at a first authentication level;

a computer server retrieving application information stored in a database, the minimum authentication level necessary to access the second application;

the front end server receiving from the user, via the computer network, further authentication data to access the second application, provided in response to a request, wherein the type of the further authentication data required is based on the first authentication level and the minimum authentication level necessary to access the second application; and

authenticating the user to the second application at the minimum authentication level necessary to access the second application.

33. The system of claim 32, further comprising pre-linking, by the user, the first and second application.

34. The system of claim 32, wherein the user links the second application before accessing it, and wherein linking comprises providing identification and authentication data and creating an entry in a user profile database.

35. The system of claim 32, wherein the first authentication level and the minimum authentication level necessary to access the second application are selected from one of four authentication levels.

36. The system of claim 32, wherein the request to access the second application is accompanied by a token, and wherein the token contains the user'"'"'s identification, and wherein the token is used by the second application to retrieve information about the user'"'"'s session.

37. The system of claim 32, further comprising generating a token when the user requests access to the second application from the first application, and wherein the token is used by the computer server to retrieve information about the user'"'"'s session.

38. The system of claim 32, further comprising:

receiving a request to log off the user to the first application;

receiving a request to authenticate the user to the first application, wherein the request comprises a different username and authentication data;

receiving from the user, via at least one computer system and an electronic network, a request to access the second application, wherein the user is authenticated to the first application at a first authentication level and with the different username;

logging the user off the second application;

determining by a computer server, and using a database of application information, the minimum authentication level necessary to access the second application with the different user name;

receiving from the user, via the computer network, a further authentication data to access the second application, in response to a request, wherein the type of the further authentication data required is based on the first authentication level and the minimum authentication level necessary to access the second application with the different username; and

authenticating the user to the second application at the minimum authentication level necessary to access the second application.

39. The system of claim 32, wherein the authentication data required is dynamically adapted to the user'"'"'s current authentication level.

40. The system claim 39, wherein the authentication data is dynamically adapted for the user'"'"'s current authentication level at each authentication level within an authentication hierarchy.

41. A system for automatically stepping down a user authenticated to an application at a first authentication level, after a period of time, to a lower second authentication level, the system comprising:

a computer system, in communication with an electronic network, receiving after a period of time, a request from a user to access the application, wherein the user is authenticated to the application at a first authentication level;

a computer server stepping down the user'"'"'s authentication level from the first authentication level to a lower second authentication level, based on predetermined criteria, wherein the computer server updates session information regarding the user'"'"'s authentication level, and wherein the predetermined criteria is the period of the time and the first authentication level; and

receiving, through the computer network, further authentication data from the user, wherein the further authentication data is receiving in response to a request, and wherein the type of authentication requested from the user is based on the lower authentication level and the authentication necessary to access the application.

42. The system of claim 41, wherein the stepping down of step (c) is also based on the lower authentication level.

43. The system of claim 41, further comprising:

a user authenticated to a second application at a first authentication level;

stepping down with respect to the second application, by a computer server, the user'"'"'s authentication level from the first authentication level to a lower authentication level, based on the period of the time and the first authentication level.

44. The system of claim 41, wherein the type of authentication requested is dynamically adapted to the user'"'"'s current authentication level.

45. The method of claim 44, wherein the type of authentication requested is dynamically adapted for user'"'"'s current authentication level at each authentication level within an authentication hierarchy.