Method and system for authentication by defining a demanded level of security

• US 9,083,750 B2
• Filed: 07/15/2013
• Issued: 07/14/2015
• Est. Priority Date: 12/11/2006
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP SE
• Inventors: Gomez, Laurent Y., Scherfenberg, Ivonne
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): WRIGHT, BRYAN F
• Application Number:
  US13/941,882
• Publication Number:
  US 20130305312A1
• Time in Patent Office: 729 Days
• Field of Search: 726/1
• US Class Current: 1/1
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A computer-implemented method for authentication involves defining a level of trust required for access to a resource independently of any particular authentication mechanism or instance, determining levels of trust associated with a plurality of authentication instances, and selecting and combining two or more of the authentication instances to meet or exceed the required level of trust.

Claims

1. A computer-implemented method for authentication of a client device to a server, the method comprising:

using one or more computer processors to perform the operations of;

determining a demanded level of security for a resource on the server, wherein the demanded level of security is independent of any particular authentication instance and defines level of trust necessary to allow access to the resource on the server;

determining, for each of a plurality of authentication instances, an associated server level of trust;

determining which of the plurality of authentication instances are available on the client device;

selecting at least two authentication instances from the plurality of authentication instances determined to be available on the client device based upon a determination that the combined level of trust associated with the at least two selected authentication instances meets or exceeds the determined demanded level of security for access to the resource on the server, wherein one or more combining operators are utilized to combine authentication instances; and

sending a request to the server to utilize the resource, the request comprising information verifying that the computer-implemented client has successfully authenticated utilizing the selected combination of authentication instances,

wherein the authentication instances are associated to a reputation which evolves based on a collection of previous experiences associated with determining the server level of trust in the authentication instances.

5. The method of claim 1, wherein the one or more combining operators are operators of subjective logic.

6. The method of claim 1, comprising authenticating using one of the selected authentication instances with an authentication server, the authentication server being different than the server.

7. The method of claim 1, wherein one of the selected authentication instances comprises a username and password.

21. The method of claim 1, wherein the at least two selected authentication instances comprise at least three authentication instances selected from the plurality of authentication instances.

2. The method of 1, wherein the server level of trust for one of the authentication instances selected by the client is at least in part based on a trust opinion.

3. The method of claim 2, wherein the trust opinion comprises an objective criteria and a subjective criteria.

4. The method of claim 2, wherein the trust opinion is expressed in subjective logic.

8. A non-transitory computer-readable medium that stores instructions which, when performed by a machine, cause the machine to perform operations comprising:

using one or more computer processors to perform the operations of;

determining a demanded level of security for a resource on the server, wherein the demanded level of security is independent of any particular authentication instance and defines level of trust necessary to allow access to the resource on the server;

determining, for each of a plurality of authentication instances, an associated server level of trust;

determining which of the plurality of authentication instances are available on a client device;

selecting at least two authentication instances from the plurality of authentication instances determined to be available on the client device based upon a determination that the combined level of trust associated with the at least two selected authentication instances meets or exceeds the determined demanded level of security for access to the resource on the server, wherein one or more combining operators are utilized to combine authentication instances; and

sending a request to the server to utilize the resource, the request comprising information verifying that the computer-implemented client has successfully authenticated utilizing the selected combination of authentication instances,

wherein the authentication instances are associated to a reputation which evolves based on a collection of previous experiences associated with determining the server level of trust in the authentication instances.

9. The computer-readable medium of claim 8, wherein the server level of trust for one of the selected authentication instances selected by the client is at least in part based on a trust opinion.

10. The computer-readable medium of claim 9, wherein the trust opinion comprises an objective criteria and a subjective criteria.

11. The computer-readable medium of claim 9, wherein the trust opinion is expressed in subjective logic.

12. The computer-readable medium of claim 8, wherein the one or more combining operators are operators of subjective logic.

13. The computer-readable medium of claim 8, wherein the instructions comprise instructions, which when performed by the machine cause the machine to perform the operations comprising authenticating using one of the selected authentication instances with an authentication server, the authentication server being different than the server.

22. The computer-readable medium of claim 8, wherein the at least two selected authentication instances comprise at least three authentication instances selected from the plurality of authentication instances.

14. A client system for authentication comprising:

a memory to store;

a demanded level of security for a resource on a server, wherein the demanded level of security is independent of any particular authentication instance and defines a level of trust necessary to allow access to the resource on the server, and

for each of a plurality of authentication instances, an associated server level of trust; and

a computer processor programmed to execute instructions operable to;

determine the demanded level of security for the server;

determine the server levels of trust for the plurality of authentication instances;

determine which of the plurality of authentication instances are available on a client device;

select at least two authentication instances from the plurality of authentication instances determined to be available on the client device based upon a determination that the combined level of trust associated with the at least two selected authentication instances meets or exceeds the determined demanded level of security for access to the resource on the server, wherein one or more combining operators are utilized to combine authentication instances; and

send a request to the server to utilize the resource, the request comprising information verifying that the computer-implemented client has successfully authenticated using utilizing the selected combination of authentication instances,

wherein the authentication instances are associated to a reputation which evolves based on a collection of previous experiences associated with determining the server level of trust in the authentication instances.

15. The system of claim 14, wherein the server level of trust for one of the selected authentication instances is at least in part based on a trust opinion.

16. The system of claim 15, wherein the trust opinion comprises an objective criteria and a subjective criteria.

17. The system of claim 15, wherein the trust opinion is expressed in subjective logic.

18. The system of claim 14, wherein the one or more combining operators are operators of subjective logic.

19. The system of claim 14, wherein the processor is programmed to authenticate using one of the selected authentication instances with an authentication server, the authentication server being different than the server.

20. The system of claim 14, wherein one of the three authentication instances comprises a biometric authentication.

23. The system of claim 14, wherein the at least two selected authentication instances comprise at least three authentication instances selected from the plurality of authentication instances.