Method for secure access control

• US 5,510,777 A
• Filed: 12/28/1993
• Issued: 04/23/1996
• Est. Priority Date: 09/23/1991
• Status: Expired due to Term

• Current Assignee: AT&T IPM Corp. (AT&T, Inc.)
• Original Assignee: AT&T Corporation (AT&T, Inc.)
• Inventors: Pilc, Randolph J., Weber, Roy P.
• Primary Examiner(s): ZIMMERMAN, BRIAN A
• Application Number:
  US08/174,579
• Time in Patent Office: 847 Days
• Field of Search: 340/825.30, 340/825.31, 340/825.34, 340/825.06, 340/825.07, 340/825.15, 379/95, 379/200, 379/62, 235/380
• US Class Current: 340/5.27
• CPC Class Codes: G07C 9/27 with central registration
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04M 3/382 using authorisation codes or passwords

Abstract

A requester making a request for access to a destination is prompted to supply additional authentication information, beyond that which may be supplied by the requester in an attempt to meet a first level of security processing specified by the nature of the request itself, only if it is determined from a predetermined set of attributes of the particular access request that additional security processing is necessary before access can be granted to the destination.

Claims

1. A method for use in obtaining access to a credit account for use in the billing of telephone calls placed through a telephone network that controls the establishing of connections among a plurality of telephone stations, said method comprising the steps of:

receiving from a requester a request for access to a particular credit account for charging thereto charges arising from a proposed connection from a first of said plurality of telephone stations to a second of said plurality of telephone stations, said request for access specifying said first and second of said plurality of telephone stations and requiring at least a first level of security processing that collects authentication information and authenticates said requester at least to said first level based only on said collected authentication information before access to said particular credit account may be granted;

making a determination, as a joint function of at least (i) the location of said first telephone station (ii) the location of said second telephone station and (iii) said requester having been authenticated to said first level, that additional security processing beyond said first level is required before access to said particular credit account can be granted; and

prompting said requester, only when said additional security processing is required, to provide additional authentication information beyond that collected from said requester in the satisfying of said first level of security processing.

2. The method as defined in claim 1 further including the step of receiving said additional authentication information by said system as an input for use in further authentication of said requester if said additional authentication information is supplied by said requester.

3. The method as defined in claim 2 further including the step of making a comparison between said received additional authentication information and previously stored authentication information corresponding to an identity alleged by said requester as part of said first level of security processing, the result of said comparison for use in determining a level of access to be granted to said requester.

4. The method as defined in claim 3 further including the step of reiterating said steps of prompting, receiving additional authentication information and making a comparison for further authentication information beyond that already received from said requester only if a predetermined authentication threshold was reached in said step of making a comparison during at least one preceding iteration of said steps of prompting, receiving additional authentication information and making a comparison, said authentication threshold being insufficient to achieve a level of access desired by said requester.

5. The method as defined in claim 4 wherein said further authentication information is of a type not previously prompted for in said step of prompting.

6. The method as defined in claim 3 wherein said alleged identity is associated with multiple authorized users, each of said multiple authorized users having his own previously stored authentication information and further including the step of determining from said received additional authentication information which of said multiple authorized users said requester is.

7. The method as defined in claim 6 wherein any requester is granted access if that requester'"'"'s supplied additional authentication information matches with authentication information previously stored for one of said authorized users associated with said alleged identity.

8. The method as defined in claim 6 further including the steps of:

retrieving a previously stored profile for said requester; and

stimulating said destination to grant access by said requester to said destination at a predetermined level, said predetermined level being determined from said profile, said predetermined attributes of said particular access request joint function, and the result of said comparison.

9. The method as defined in claim 3 further including the steps of:

retrieving a previously stored profile for said alleged identity; and

granting access by said requester to said credit account at a predetermined level, said predetermined level being determined from said profile, said joint function and the result of said comparison.

10. The method as defined in claim 9 wherein said predetermined level of access is unlimited access.

11. The method as defined in claim 9 wherein said predetermined level of access is a restricted form of access.

12. A method for use in obtaining access to a credit account for use in the billing of telephone calls placed through a telephone network that controls the establishing of connections among a plurality of telephone stations, said method comprising the steps of:

receiving from a requester a request for access to a particular credit account for charging thereto charges arising from a proposed connection from a first of said plurality of telephone stations to a second of said plurality of telephone stations, said request for access specifying said first and second of said plurality of telephone stations and requiring at least a first level of security processing that collects authentication information and authenticates said requester at least to said first level based only on said collected authentication information before access to said particular credit account may be granted;

making a determination, as a joint function of at least (i) the type of said first telephone station (ii) the location of said second telephone station and (iii) said requester having been authenticated to said first level, that additional security processing beyond said first level is required before access to said particular credit account can be granted; and

prompting said requester, only when said additional security processing is required, to provide additional authentication information beyond that collected from said requester in the satisfying of said first level of security processing.

13. A method for use in obtaining access to a credit account for use in the billing of telephone calls placed through a telephone network that controls the establishing of connections among a plurality of telephone stations, said method comprising the steps of:

receiving from a requester a request for access to a particular credit account for charging thereto charges arising from a proposed connection from a first of said plurality of telephone stations to a second of said plurality of telephone stations, said request for access specifying said first and second of said plurality of telephone stations and requiring at least a first level of security processing that collects authentication information and authenticates said requester at least to said first level based only on said collected authentication information before access to said particular credit account may be granted;

making a determination, as a joint function of at least (i) the type of said first telephone station (ii) the cost of said call and (iii) said requester having been authenticated to said first level, that additional security processing beyond said first level is required before access to said particular credit account can be granted; and

prompting said requester, only when said additional security processing is required, to provide additional authentication information beyond that collected from said requester in the satisfying of said first level of security processing.