DYNAMIC AUTHENTICATION IN ALTERNATE OPERATING ENVIRONMENT

• US 20130333002A1
• Filed: 06/07/2012
• Published: 12/12/2013
• Est. Priority Date: 06/07/2012
• Status: Active Grant

• Current Assignee: Wells Fargo NA (Wells Fargo & Company)
• Original Assignee: Wells Fargo Bank NA (Wells Fargo & Company)
• Inventors: Belton, Lawrence T., Benskin, Ryan Bernard, Gabel, Jon, Grove, Michael, Morris, Timothy H., Russell, Jonathan D., Yelton, Robert Glenn Jr., Rodgers, Doug S.
• Granted Patent: US 8,875,252 B2
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

Systems and methods that employ dynamic credentials across distinct authentication standards can be used to reduce the burden associated with repeated re-authentication. A utility can be employed during logon in an alternate operating environment that stores information from the logon dynamically and generates a credential file that is employed to grant access to a resource without repeating the earlier logon procedure, even if the device changes its user state. After processes requiring resource access are complete, or when an allowed time expires, the granted access is revoked and the device returns to a default or standard authentication technique.

Claims

1. A system for defining access to remote resources, comprising:

a first access control that defines access to a remote resource based at least in part on a client credential;

a second access control that defines access to the remote resource based at least in part on a client identifier; and

a utility component that integrates the first access control and the second access control into a client environment.

2. The system of claim 1, wherein the second access control allows a client associated with the client credential and the client identifier access to the remote resource without client interaction.

3. The system of claim 2, wherein the client access is subject to a timeframe that denies access to the remote resource via the second access control upon expiration of the timeframe.

4. The system of claim 1, wherein the second access control includes an exception table that includes information on at least one client that is authorized to bypass the first access control.

5. The system of claim 1, wherein the client identifier is a media access control address.

6. The system of claim 1, wherein the client credential includes at least a user name and password.

7. The system of claim 1, wherein the first access control is an 802.1X authentication.

8. The system of claim 1, wherein the second access control is a media access control authentication bypass structure.

9. A method for imaging a client device, comprising:

authenticating the client device to a network via a first authentication technique;

storing information related to the first authentication technique;

creating a record of the client related to a second authentication technique, wherein the record includes at least the information related to the first authentication technique; and

authenticating the client device to the network via the second authentication technique.

10. The method of claim 9, further comprising creating a trusted path between the client device and the second authentication technique.

11. The method of claim 9, wherein the record permits the second authentication technique to authenticate the client device at least in part by recognizing a network identifier associated with the client device.

12. The method of claim 9, further comprising:

changing an authentication status of the client device; and

authenticating the client device via the second authentication technique.

13. The method of claim 9, further comprising imaging the client device.

14. The method of claim 13, further comprising:

removing the information related to the first authentication technique; and

removing the record of the client related to the second authentication technique.

15. The method of claim 9, further comprising:

counting an expiration time;

removing the information related to the first authentication technique; and

removing the record of the client related to the second authentication technique.

16. The method of claim 9, further comprising providing compatibility between the client device and the network.

17. The method of claim 9, further comprising modifying an image to be applied to the client device based on at least one of the information related to the first authentication technique and a network identifier associated with the client device.

18. A system, comprising:

means for authenticating a client via a graphical logon challenge;

means for capturing at least information related to the client;

means for authenticating the client via a bypass table based at least in part on the information related to the client; and

means for transmitting to the client over a network secured at least by the bypass table.

19. The system of claim 18, further comprising means for integrating at least the graphical logon challenge into an alternate operating environment.

20. The system of claim 18, further comprising means for repeatedly authenticating the client via the bypass table.