Dynamic authentication in alternate operating environment

• US 8,875,252 B2
• Filed: 06/07/2012
• Issued: 10/28/2014
• Est. Priority Date: 06/07/2012
• Status: Active Grant

• Current Assignee: Wells Fargo NA (Wells Fargo & Company)
• Original Assignee: Wells Fargo Bank NA (Wells Fargo & Company)
• Inventors: Belton, Lawrence T., Benskin, Ryan Bernard, Gabel, Jon, Grove, Michael, Morris, Timothy H., Russell, Jonathan D., Yelton, Robert Glenn Jr., Rodgers, Doug S.
• Primary Examiner(s): Patel, Haresh N
• Application Number:
  US13/491,163
• Publication Number:
  US 20130333002A1
• Time in Patent Office: 873 Days
• Field of Search: 726 1- 10, 726/18, 726/21
• US Class Current: 726/5
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

Systems and methods that employ dynamic credentials across distinct authentication standards can be used to reduce the burden associated with repeated re-authentication. A utility can be employed during logon in an alternate operating environment that stores information from the logon dynamically and generates a credential file that is employed to grant access to a resource without repeating the earlier logon procedure, even if the device changes its user state. After processes requiring resource access are complete, or when an allowed time expires, the granted access is revoked and the device returns to a default or standard authentication technique.

Claims

1. A system for defining access to remote resources, comprising:

a processor;

a first access control that defines access to a remote resource based at least in part on a client credential;

a second access control that defines access to the remote resource based at least in part on a client identifier, wherein the second access control maintains access to the remote resource for one or more endpoints such that one or more of the endpoints has persistent access to the remote resource after a reboot for the respective endpoint;

an image component that images one or more of the endpoints based at least in part on the remote resource and applies firmware updates to respective endpoints based on hardware of one or more the endpoints; and

a utility component that integrates the first access control and the second access control into a client environment,

wherein the first access control, the second access control, the image component, or the utility component are implemented via the processor.

2. The system of claim 1, wherein the second access control allows a client associated with the client credential and the client identifier access to the remote resource without client interaction.

3. The system of claim 2, wherein the client access is subject to a timeframe that denies access to the remote resource via the second access control upon expiration of the timeframe.

4. The system of claim 1, wherein the second access control includes an exception table that includes information on at least one client that is authorized to bypass the first access control.

5. The system of claim 1, wherein the client identifier is a media access control address.

6. The system of claim 1, wherein the client credential includes at least a user name and password.

7. The system of claim 1, wherein the first access control is an 802.1x authentication.

8. The system of claim 1, wherein the second access control is a media access control authentication bypass structure.

9. A method for defining access to remote resources, comprising:

defining access to a remote resource based on a client credential for a first access control;

defining access to the remote resource based on a client identifier for a second access control, wherein access to the remote resource is maintained for one or more endpoints such that one or more of the endpoints has persistent access to the remote resource after a reboot for the respective endpoint;

imaging one or more of the endpoints based at least in part on the remote resource and applying firmware updates to respective endpoints based on hardware of one or more the endpoints; and

integrating the first access control and the second access control into a client environment,

wherein the defining, the imaging, or the integrating is implemented via a processor.

10. The method of claim 9, comprising allowing a client associated with the client credential and the client identifier access to the remote resource without client interaction.

11. The method of claim 10, comprising denying client access to the remote resource based on a timeframe and an expiration of the timeframe.

12. The method of claim 9, comprising defining access to the remote resource based on an exception table that includes information on at least one client that is authorized to bypass the first access control.

13. The method of claim 9, wherein the client identifier is a media access control address.

14. The method of claim 9, wherein the client credential includes a user name and password.

15. The method of claim 9, wherein the first access control is an 802.1x authentication.

16. The method of claim 9, wherein the second access control is a media access control authentication bypass structure.

17. A system for defining access to remote resources, comprising:

a processor;

a first access control defining access to a remote resource based on a client credential;

a second access control defining access to the remote resource based on a network identifier, wherein the second access control comprises an access record list associated with one or more annotations, wherein the second access control maintains access to the remote resource for one or more endpoints such that one or more of the endpoints has persistent access to the remote resource after a reboot for the respective endpoint;

an image component that images one or more of the endpoints based at least in part on the remote resource and applies firmware updates to respective endpoints based on hardware of one or more the endpoints; and

a utility component integrating the first access control and the second access control into a client environment,

wherein the first access control, the second access control, the image component, or the utility component are implemented via the processor.

18. The system of claim 17, wherein the second access control allowing a client associated with the client credential and the client identifier access to the remote resource without client interaction.

19. The system of claim 18, wherein the client access is subject to a timeframe that denies access to the remote resource via the second access control upon expiration of the timeframe.

20. The system of claim 17, wherein the second access control includes an exception table that includes information on at least one client that is authorized to bypass the first access control.