System, Method and Computer Program Product For An Authentication Management Infrastructure

• US 20140310766A1
• Filed: 02/24/2014
• Published: 10/16/2014
• Est. Priority Date: 03/09/1999
• Status: Active Grant

• Current Assignee: Citibank (South Dakota) NA (Citigroup Incorporated)
• Original Assignee: Citibank (South Dakota) NA (Citigroup Incorporated)
• Inventors: Bianco, Peter Garrett, Boon, William Taylor, Rochon, Anthony C., Sherman, Marc A., Sterling, Robert Brewster, Ware, Karl Roger
• Granted Patent: US 9,398,013 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A system and method for allowing a user to access enterprise resources comprising authentication devices and an authentication server. The authentication devices allow a user to enter authentication data. The authentication server is in communication with the authentication devices. The authentication server comprises a policy database storing a policy. The policy comprises guidelines including a first guideline establishes a qualification necessary for the user to access enterprise resources and a second guideline establishes a qualification necessary for the user to activate a silent signal. The authentication server is adapted to request assistance for the user if the silent signal is activated.

Claims

1. A method for allowing a user to access enterprise resources, the method comprising:

Implementing, by an authentication server, a policy that sets forth a plurality of guidelines for determining whether to authenticate the user and to allow the user to gain access to the enterprise resources, wherein at least one first guideline establishes at least one predetermined first qualification necessary for the user to be authenticated to access the enterprise resources and wherein at least one second guideline establishes at least one predetermined second qualification necessary for the user to activate a silent signal for requesting assistance;

requiring, by the authentication server, the user to establish authentication using at least one device associated with the policy;

creating, by the authentication server, a template for each device, wherein said template includes data unique to the user;

determining, by the authentication server, whether the user has activated the silent signal when the user attains the at least one predetermined second qualification; and

requesting, by the authentication server, assistance for the user if the silent signal is activated.

2. The method of claim 1, further comprising:

requiring, by the authentication server, the user to establish authentication using at least two devices associated with the policy to meet the second qualification, wherein

(i) if the policy is an OR policy, then requiring the user to establish authentication on only one of the at least two devices;

(ii) if the policy is an AND policy, then requiring the user to establish authentication on all of the at least two devices;

(iii) if the policy is a CONTINGENT policy, then requiring the user to exceed a minimum threshold associated with a first device or, if the user exceeds a contingent threshold associated with the first device, then requiring the user to exceed a minimum threshold associated with a second device;

(iv) if the policy is a RANDOM policy, then requiring the user to establish authentication on a randomly selected device from the at least two devices;

or (v) if the policy is a THRESHOLD policy, then requiring the user to exceed a total threshold value for the at least two devices.

3. The method of claim 1, further comprising

requiring, by the authentication server, the user to establish authentication with at least two devices;

determining, by the authentication server, whether the user is authenticated when the user attains the at least one predetermined first qualification; and

allowing, by the authentication server, the user to access the enterprise resources.

4. The method of claim 1, wherein the silent signal is activated by receiving a password entered by the user.

5. The method of claim 1, wherein the silent signal is activated by receiving biometric data entered by the user.

6. The method of claim 1, wherein requesting assistance for the user comprises notifying a law enforcement agency.

7. The method of claim 3, wherein each at least one predetermined second qualification has a corresponding first predetermined qualification based on the same one of the at least one device.

8. A method for allowing a user to access enterprise resources, the method comprising:

implementing, by an authentication server, a policy that sets forth a plurality of guidelines for determining whether to authenticate the user and to allow the user to gain access to the enterprise resources, wherein at least one first guideline establishes at least one predetermined first qualification necessary for the user to be authenticated to access the enterprise resources and wherein at least one second guideline establishes at least one predetermined second qualification necessary for the user to attain to pass the policy, and wherein the policy is formed by selecting one or more devices that the user must be tested on in order to activate a silent signal;

determining, by the authentication server, whether the user has activated the silent signal when the user attains the at least one predetermined second qualification; and

requesting, by the authentication server, assistance for the user if the silent signal is activated.

9. The method of claim 8, further comprising:

requiring, by the authentication server, the user to establish authentication using at least two devices associated with the policy to meet the second qualification, wherein

(i) if the policy is an OR policy, then requiring the user to establish authentication on only one of the at least two devices;

(ii) if the policy is an AND policy, then requiring the user to establish authentication on all of the at least two devices;

(iii) if the policy is a CONTINGENT policy, then requiring the user to exceed a minimum threshold associated with a first device or, if the user exceeds a contingent threshold associated with the first device, then requiring the user to exceed a minimum threshold associated with a second device;

(iv) if the policy is a RANDOM policy, then requiring the user to establish authentication on a randomly selected device from the at least two devices;

or (v) if the policy is a THRESHOLD policy, then requiring the user to exceed a total threshold value for the at least two devices.

10. The method of claim 8, further comprising:

requiring, by the authentication server, the user to establish authentication with at least two devices;

determining, by the authentication server, whether the user is authenticated when the user attains the at least one predetermined first qualification; and

allowing, by the authentication server, the authenticated user to access the enterprise resources.

11. The method of claim 8, wherein the silent signal is activated by receiving a password entered by the user.

12. The method of claim 8, wherein the silent signal is activated by receiving biometric data entered by the user.

13. The method of claim 8, wherein requesting assistance for the user comprises notifying a law enforcement agency.

14. The method of claim 10, wherein each at least one predetermined second qualification has a corresponding predetermined first qualification based on the same one of the selected one or more devices.

15. A system for allowing a user to access enterprise resources comprising:

one or more authentication devices that allow a user to enter authentication data; and

an authentication server in communication with the one or more authentication devices that authenticates the authentication data, the authentication server comprising a policy database storing a policy, the policy implemented by the authentication server;

wherein the policy comprises a plurality of guidelines for determining whether to authenticate the user and to allow the user to gain access to the enterprise resources, wherein at least one first guideline establishes at least one predetermined first qualification necessary for the user to be authenticated to access the enterprise resources and wherein at least one second guideline establishes at least one predetermined second qualification necessary for the user to attain to pass the policy and wherein the policy is formed by the authentication server selecting from the one or more authentication devices test devices that the user must be tested on in order to activate a silent signal;

wherein the authentication server is adapted to request assistance for the user if the silent signal is activated; and

the authentication server further comprising an authentication unit that determines whether the user has activated the silent signal based on the predetermined second qualification and an output from the test devices.

16. The system of claim 15, the test devices comprising at least two of the one or more authentication devices and the authentication unit requiring the user to establish authentication using at the least two test devices to meet the second qualification, wherein

(i) if the policy is an OR policy, then requiring the user to establish authentication on only one of the at least two test devices;

(ii) if the policy is an AND policy, then requiring the user to establish authentication on all of the at least two test devices;

(iii) if the policy is a CONTINGENT policy, then requiring the user to exceed a minimum threshold associated with a first test device or, if the user exceeds a contingent threshold associated with the first device, then requiring the user to exceed a minimum threshold associated with a second test device;

(iv) if the policy is a RANDOM policy, then requiring the user to establish authentication on a randomly selected device from the at least two test devices;

or (v) if the policy is a THRESHOLD policy, then requiring the user to exceed a total threshold value for the at least two test devices.

17. The system of claim 15, the authentication unit requiring the user to establish authentication with at least two of the test devices;

the authentication unit adapted to determine whether the user is authenticated when the user attains the at least one predetermined first qualification; and

the authentication unit adapted to allow the authenticated user to access the enterprise resources.

18. The system of claim 15, wherein at least one of the test devices is a device for the user to enter a password.

19. The system of claim 15, wherein at least one of the test devices is a device for the user to enter biometric data.

20. The system of claim 17, wherein each at least one predetermined second qualification has a corresponding predetermined first qualification based on the same one of the test devices.