Method and apparatus for facilitating multi-level computer system authentication

• US 7,814,330 B2
• Filed: 08/01/2005
• Issued: 10/12/2010
• Est. Priority Date: 08/01/2005
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Wong, Daniel ManHung
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): RAHIM, MONJUR
• Application Number:
  US11/195,016
• Publication Number:
  US 20070028117A1
• Time in Patent Office: 1,898 Days
• Field of Search: 709/225, 713/193, 713/182, 713/168, 713/201, 713/202, 380/287
• US Class Current: 713/182
• CPC Class Codes: G06F 21/31 User authentication

Abstract

One embodiment of the present invention provides a system that facilitates authenticating a user at a computer system. During operation, the system creates an authentication profile and assigns the authentication profile to a user, wherein the authentication profile specifies authentication criteria. Next, the computer system receives a login request from the user, and in responding to the login request, the computer system checks if the authentication criteria in the authentication profile are satisfied. If so, the system allows the user to login. If not, the user is prevented from logging into the computer system.

Claims

1. A method for authenticating a user at a computer system comprising:

associating one or more authentication profiles prioritized in a priority order with the user at the computer system, wherein each authentication profile specifies authentication criteria and a set of privileges, and wherein a high priority authentication profile is associated with stricter authentication criteria and more privileges than a low priority authentication profile;

in response to a user login request, checking one or more authentication profiles in the priority order to determine whether all the authentication criteria corresponding to an authentication profile are satisfied;

if so, logging the user into the computer system granting the set of privileges specified in the authentication profile;

if not, preventing the user from logging into the computer system.

2. The method of claim 1, wherein logging the user into the computer system further involves associating the set of privileges with the user.

3. The method of claim 1, wherein the authentication profile is assigned to more than one user.

4. The method of claim 1, wherein the authentication criteria includes at least one of:

an IP address;

a client program;

a time range;

or

a credential.

5. The method of claim 1, wherein the computer system checks all authentication profiles assigned to the user, whereby the method further comprises:

in response to the login request, checking if authentication criteria in the highest priority authentication profile are met;

if so, logging the user into the computer system;

if not, checking if authentication criteria in the next highest priority authentication profile are met; and

if there are no remaining authentication profiles, preventing the user from logging into the computer system.

6. The method of claim 1, wherein the computer system sends a request to an authentication module to perform the authentication.

7. The method of claim 1, wherein preventing the user from logging into the computer system involves secondary actions, wherein secondary actions comprise at least one of:

preventing further login attempts from the user;

preventing further login attempts from the computer system;

reporting failed login attempts;

logging further activity; and

any other action in response to a failed login attempt.

8. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for authenticating a user at a computer system, the method comprising:

associating one or more authentication profiles prioritized in a priority order with the user at the computer system, wherein each authentication profile specifies authentication criteria and a set of privileges, and wherein a high priority authentication profile is associated with stricter authentication criteria and more privileges than a low priority authentication profile;

in response to a user login request, checking one or more authentication profiles in the priority order to determine whether all the authentication criteria corresponding to an authentication profile are satisfied;

if so, logging the user into the computer system granting the set of privileges specified in the authentication profile;

if not, preventing the user from logging into the computer system.

9. The non-transitory computer-readable storage medium of claim 8, wherein logging the user into the computer system further involves associating the set of privileges with the user.

10. The non-transitory computer-readable storage medium of claim 8, wherein the authentication profile is assigned to more than one user.

11. The non-transitory computer-readable storage medium of claim 8, wherein the authentication criteria includes at least one of:

an IP address;

a client program;

a time range;

or

credential.

12. The non-transitory computer-readable storage medium of claim 8, wherein the computer system checks all authentication profiles assigned to the user.

13. The non-transitory computer-readable storage medium of claim 8, wherein the computer system sends a request to an authentication module to perform the authentication.

14. The non-transitory computer-readable storage medium of claim 8, wherein preventing the user from logging into the computer system involves secondary actions, wherein secondary actions comprise at least one of:

preventing further login attempts from the user;

preventing further login attempts from the computer system;

reporting failed login attempts;

logging further activity; and

any other action in response to a failed login attempt.

15. The non-transitory computer-readable storage medium of claim 8, wherein the computer system can include a database.

16. The non-transitory computer-readable storage medium of claim 12, wherein the method further comprises:

in response to the login request, checking if authentication criteria in the highest priority authentication profile are met;

if so, logging the user into the computer system;

if not, checking if authentication criteria in the next highest priority authentication profile are met; and

if there are no more authentication profiles, preventing the user from logging into the computer system.

17. An apparatus that authenticates a user at a computer system comprising:

An associating mechanism configured to associate one or more authentication profiles to the with the user,

wherein each authentication profile specifies authentication criteria and a set of privileges;

an ordering mechanism configured to determine a priority order for the authentication profiles assigned to the user, wherein a high priority authentication profile is associated with stricter authentication criteria and more privileges than a low priority authentication profile;

a checking mechanism configured to check the authentication profiles in the priority order to determine whether all authentication criteria corresponding to an authentication profile are satisfied in response to a user login request;

a login mechanism, wherein, if the authentication criteria are satisfied, the login mechanism is configured to log the user into the computer system granting the set of privileges specified in the authentication profile; and

wherein, if the authentication criteria are not satisfied, the login mechanism is further configured to prevent the user from logging into the computer system.