Policy-based authentication

• US 8,978,100 B2
• Filed: 03/14/2011
• Issued: 03/10/2015
• Est. Priority Date: 03/14/2011
• Status: Active Grant

• Current Assignee: Workday Incorporated
• Original Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Inventors: Counterman, Raymond C.
• Primary Examiner(s): LANIER, BENJAMIN E
• Application Number:
  US13/046,950
• Publication Number:
  US 20120240211A1
• Time in Patent Office: 1,457 Days
• Field of Search: None
• US Class Current: 726/3
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

A device receives a request to authenticate an end user of a user device based on a requested use of an application by the user device, and communicates with an authentication client, provided in the user device, to perform an authentication requested by the request. The device also generates a response to the request based on the communication with the authentication client, where the response indicates that the end user is or is not authenticated to use the application. The device further provides the response to an application server device hosting the application.

Claims

1. A method implemented by a computing device, the method comprising:

receiving, by the computing device, a request to authenticate an end user of a user device based on a requested use of an application by the user device, wherein the request is received from an application server device that hosts the application, wherein the request includes an application identifier for the application and an end user identifier for the end user;

evaluating, by the computing device, policies for the end user identifier to determine what type of authentication is required for the end user identifier;

evaluating, by the computing device, policies for the application identifier to determine what type of authentication is required for the application identifier;

providing, by the computing device, an authentication request to an authentication enabler device, wherein the authentication request includes an authentication context specifying a required type of authentication determined based on the evaluations;

forwarding, by the computing device, the request to another enabler device requested by the request;

receiving, by the computing device and from the other enabler device, results of performance of functions performed by the other enabler device;

receiving, by the computing device and from the authentication enabler device, a response indicating that the end user is or is not authenticated to use the application; and

providing, by the computing device, the response to the application server device hosting the application.

2. The method of claim 1, wherein the request includes at least one of:

a request to authenticate the end user of the user device using a generic bootstrapping architecture (GBA),

a request to authenticate the end user with a user name and password that are not known by the application, or

a request that includes a type of authentication and a level of authentication assurance.

9. The method of claim 1, wherein the type of authentication required for the end user identifier includes:

a user name and password that are not known by the application,

a password,

a one-time password,

a public key cryptography, or

biometrics.

10. The method of claim 1, where the request includes a level of authentication assurance.

11. The method of claim 1, wherein receiving, from the other enabler device, results of performance of functions performed by the other enabler device includes:

receiving information identifying the location of the user device.

12. The method of claim 1, wherein the type of authentication required for the end user identifier includes a two-factor authentication.

13. The method of claim 1, wherein the authentication context includes an Extensible Markup Language (XML) schema.

14. The method of claim 13, wherein the XML schema includes at least one of:

a user identification mechanism;

a mechanism to minimize compromising of credentials;

a mechanism for storing and protecting credentials;

or

an authentication mechanism.

3. A method implemented by a computing device, the method comprising:

receiving, by the computing device, a request to authenticate an end user of a user device based on a requested use of an application by the user device, wherein the request is received from an application server device that hosts the application, and wherein the request includes an application identifier and an end user identifier;

evaluating, by the computing device, policies for the end user identifier to determine what type of authentication is required for the end user identifier;

evaluating, by the computing device, policies for the application identifier to determine what type of authentication is required for the application identifier;

retrieving, by the computing a token associated with the application and end user identifiers;

determining, by the computing device, whether the token is present and valid;

providing, by the computing device and to the application server device hosting the application, when the token is present and valid, a response indicating that the end user is or is not authenticated to use the application;

providing, by the computing device and when the token is not present or is invalid, an authentication request to an authentication enabler device, wherein the authentication request includes an authentication context specifying a required type of authentication determined based on the evaluations;

receiving, by the computing device and from the authentication enabler device, a response indicating whether the end user is authenticated to use the application; and

providing, by the computing device, the response to the application server device.

4. The method of claim 3, further comprising:

receiving an authentication query from the application server device, wherein the authentication query requests an authentication state associated with the application and the end user identifier;

evaluating the authentication query to determine compliance with governing policies for the application and the end user identifier;

generating, based on the evaluation, an authentication response that includes the authentication state associated with the application and the end user identifier; and

providing the authentication response to the application server device.

5. The method of claim 3, where the request includes a request to authenticate the end user with one of:

a generic bootstrapping architecture (GBA),

a user name and password that are not known by the application,

a password,

a one-time password,

a public key cryptography, or

biometrics.

6. A method implemented by a computing device, the method comprising:

receiving, by the computing device and from an application server device hosting an application being used by a user device, a request for a service provided by the application for the user device, wherein the request includes an application identifier;

determining, by the computing device, that the request does not include an identifier of the end user;

providing, by the computing device and to the application server device, an error message indicating that the identifier of the end user is missing;

receiving, by the computing device and from the application server device, based on the error message, the identifier of the end user and a request for authenticating the end user;

evaluating, by the computing device, policies for the identifier of the end user to determine what type of authentication is required for the identifier of the end user;

evaluating, by the computing device, policies for the application identifier to determine what type of authentication is required for the application identifier;

providing, by the computing device, an authentication request to an authentication enabler, wherein the authentication request includes an authentication context specifying a required type of authentication determined based on the evaluations, wherein the authentication enabler;

receives the request for authenticating the end user,

determines whether a token associated with the end user is present in a database, validates the token when the token is present in the database,

generates the valid authentication response when the token is present in the database, and

provides the valid authentication response to the computing device; and

receiving, by the computing device and based on the authentication request, a valid authentication response from the authentication enabler.

7. The method of claim 6, further comprising:

sending, after receiving the valid authentication response, the service request to a service providing device;

receiving a particular service from the service providing device; and

providing the particular service to the application server device.

8. The method of claim 6, where the service includes determining a location of a target user.

15. The method of claim 6, wherein the type of authentication required for the identifier for the end user includes:

a user name and password that are not known by the application,

a password,

a one-time password,

a public key cryptography, or

biometrics.

16. The method of claim 6, where the request includes a level of authentication assurance.

17. The method of claim 6, wherein the type of authentication required for the end user identifier includes a two-factor authentication.

18. The method of claim 6, wherein the authentication context includes an Extensible Markup Language (XML) schema.

19. The method of claim 18, wherein the XML schema includes at least one of:

a user identification mechanism;

a mechanism to minimize compromising of credentials;

a mechanism for storing and protecting credentials;

or

an authentication mechanism.