Using service request ticket for multi-factor authentication

• US 9,088,562 B2
• Filed: 09/09/2013
• Issued: 07/21/2015
• Est. Priority Date: 09/09/2013
• Status: Expired due to Fees

• Current Assignee: GlobalFoundries, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Driscoll, Paul, Hernandez, Milton H., Jennings, Paul, Low, Chee Meng, Ruan, Yaoping, Shwartz, Larisa
• Primary Examiner(s): MOORTHY, ARAVIND K
• Application Number:
  US14/021,921
• Publication Number:
  US 20150074784A1
• Time in Patent Office: 680 Days
• Field of Search: 726/9, 726/5, 726/26, 713/168, 713/170
• US Class Current: 1/1
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

In an environment wherein a front end system receives a service request, and a back end system responds to the request, a user of a target endpoint must be authenticated. A ticket ID is assigned to the service request, and responsive to an initiating action of the user, a virtual token is generated that has a specified relationship with the ticket ID. The virtual token is delivered to the user, and the user is prompted to present the token to a validating component associated with one of the front end or back end systems, wherein the validating component is configured to verify the token validity. If the token is found to be valid, the user is authenticated to access the specified target endpoint.

Claims

1. In a service environment wherein a front end computer system receives a service request, a back end computer system responds to the service request, and a user must be authenticated to access a specified target endpoint to take action in response to the service request, a computer program product comprising computer executable instructions stored on a non-transitory computer recordable storage medium for execution by a computer, the computer executable instructions comprising:

instructions for assigning a specified identification code to the service request received by the front end computer system for use by the back end computer system, wherein the specified identification code is unique;

instructions responsive to a prespecified initiating action of the user pertaining to one of the front end computer system and the back end computer system, selectively, for generating a virtual token using the specified identification code wherein the virtual token has a specified relationship with the specified identification code including one of being derived from the specified identification code or comprises the specified identification code, wherein a ticket record associated with the specified identification code is updated to include the virtual token and wherein the virtual token generated is unique;

instructions for delivering the virtual token to the user, wherein the user accumulates one or more of the unique virtual tokens generated using the specified identification code;

instructions for prompting a dialog with the user to present the delivered virtual token to a validating component associated with at least one of the front end computer system and the back end computer system, wherein the validating component is configured to verify the validity of the delivered virtual token; and

instructions responsive to the validity of the delivered virtual token being verified, for authenticating the user to access the specified target endpoint.

2. The computer program product of claim 1, wherein:

the front end system comprises a service ticket system that creates a ticket for the service request, the specified identification code comprises a ticket identifier (ID) assigned to the ticket, and the generated virtual token includes one of being derived from the ticket ID, or is the ticket ID, selectively and wherein the generated virtual token further comprising selectively, a unique identifier of the user who will receive the generated virtual token and a specific time the generated virtual token is valid.

3. The computer program product of claim 1, wherein:

the front end system comprises a service ticket system, and the initiating action of the user comprises the user action of logging onto the service ticket system.

4. The computer program product of claim 3, wherein:

responsive to the user logging on to the service ticket system, the service ticket system automatically requests a second authentication factor server to generate the virtual token.

5. The computer program product of claim 3, wherein:

responsive to the user logging on to the service ticket system, a component of the service ticket system generates the virtual token, and delivers the virtual token to the user.

6. The computer program product of claim 1, wherein:

the back end computer system comprises a system for creating an instance of a workflow agent, and the initiating action of the user comprises using the workflow instance in an effort to access the specified target endpoint.

7. In a service environment wherein a front end computer system receives a service request, a back end computer system responds to the service request, and a user must be authenticated to access a specified target endpoint in order to take action in response to the service request, a data processing system comprising:

a bus;

a memory connected to the bus, wherein computer executable program code is stored on the memory; and

a processor unit connected to the bus, wherein the processor unit executes the computer executable program code;

to assign a specified identification code to the service request received by the front end computer system for use by the back end computer system, wherein the specified identification code is unique;

responsive to a prespecified initiating action of the user pertaining to one of the front end computer system and the back end computer system, selectively, to generate a virtual token using the specified identification code wherein the virtual token has a specified relationship with the specified identification code including one of being derived from the specified identification code or comprises the specified identification code, and wherein a ticket record associated with the specified identification code is updated to include the virtual token and wherein the virtual token generated is unique;

to deliver the virtual token to the user, wherein the user accumulates one or more of the unique virtual tokens generated using the specified identification code;

to prompt a dialog with the user to present the delivered virtual token to a validating component associated with at least one of the front end computer system and the back end computer system, wherein the validating component is configured to verify the validity of the delivered virtual token; and

responsive to the validity of the delivered virtual token being verified, to authenticate the user to access the specified target endpoint.