System, method and computer program product for access authentication

• US 9,542,545 B2
• Filed: 03/21/2011
• Issued: 01/10/2017
• Est. Priority Date: 03/21/2011
• Status: Active Grant

• Current Assignee: Applied Systems Incorporated
• Original Assignee: Webcetera L.P. (Applied Systems Incorporated)
• Inventors: Shepler, Brian E., Holloway, Charles J., Rao, Nagaraj V.
• Primary Examiner(s): Korsak, Oleg
• Application Number:
  US13/052,701
• Publication Number:
  US 20120246702A1
• Time in Patent Office: 2,122 Days
• Field of Search: 726/3, 726/4
• US Class Current: 1/1
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: H04L 2463/121 Timestamp cryptographic mechanisms or cryptographic arrangements involving time stamps H04L9/3297
• CPC Class Codes: H04L 51/10 Multimedia information
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215

Abstract

A method and technique for access authentication includes: responsive to receiving an access request from a user for a secure resource, logging an Internet Protocol (IP) address of the access request; transmitting a uniform resource locator (URL) to the user via an electronic mail message; responsive to receiving a request for the URL, logging an IP address corresponding to the URL request; and responsive to validating the IP address corresponding to the URL request with the IP address of the access request, providing access to the secure resource.

Claims

1. A method comprising:

responsive to receiving an access request from a user for a secure resource in a first access session, logging an Internet Protocol (IP) address of the access request and transmitting a uniform resource locator (URL) to the user via an electronic mail message;

responsive to receiving a request for the URL in a second access session, logging an IP address corresponding to the URL request;

comparing the IP address logged from the first access session with the IP address logged from the second access session; and

responsive to verifying that the IP address corresponding to the first access session matches the IP address of the second access session, providing access to the secure resource.

2. The method of claim 1, further comprising:

responsive to receiving the access request, querying the user for an electronic mail address; and

responsive to receiving an electronic mail address from the user, verifying the electronic mail address received from the user with a stored electronic mail address corresponding to the user.

3. The method of claim 1, further comprising:

responsive to transmitting the URL to the user, logging a timestamp for the URL transmission;

responsive to receiving the request for the URL, logging a timestamp for the URL request; and

responsive to verifying that a difference between the timestamp for the URL transmission and the timestamp for the URL request is within a predetermined time period, providing access to the secure resource.

4. The method of claim 1, further comprising:

randomly generating a token; and

combining the token with a character string to form the URL.

5. The method of claim 1, further comprising:

generating a query to the user based on data received from a third party corresponding to the user; and

responsive to validating a response to the query received from the user, providing access to the secure resource.

6. The method of claim 1, further comprising:

responsive to transmitting the URL to the user, logging a timestamp for the URL transmission;

responsive to receiving the request for the URL, logging a timestamp for the URL request;

verifying that a difference between the timestamp for the URL transmission and the timestamp for the URL request is within a predetermined time period;

generating a query to the user based on data received from a third party corresponding to the user; and

verifying that a response to the query received from the user corresponds to the data received from the third party.

7. The method of claim 6, further comprising:

responsive to receiving the access request, querying the user for an electronic mail address; and

responsive to receiving an electronic mail address from the user, verifying the electronic mail address received from the user with a stored electronic mail address corresponding to the user.

8. A system comprising:

a processing unit having access to a secure resource; and

an authentication module configured to;

responsive to receiving an access request from a user for the secure resource in a first access session, log an Internet Protocol (IP) address of the access request and transmit a uniform resource locator (URL) to the user via an electronic mail message;

responsive to receiving a request for the URL in a second access session, log an IP address corresponding to the URL request;

compare the IP address logged from the first access session with the IP address logged from the second access session; and

responsive to verifying that the IP address corresponding to the first access session matches the IP address of the second access session, authorize access to the secure resource.

9. The system of claim 8, wherein the authentication module is configured to:

responsive to receiving the access request, query the user for an electronic mail address; and

responsive to receiving an electronic mail address from the user, verify the electronic mail address received from the user with a stored electronic mail address corresponding to the user.

10. The system of claim 8, wherein the authentication module is configured to

responsive to transmitting the URL to the user, log a timestamp for the URL transmission;

responsive to receiving the request for the URL, log a timestamp for the URL request; and

verify that a difference between the timestamp for the URL transmission and the timestamp for the URL request is within a predetermined time period.

11. The system of claim 8, wherein the authentication module is configured to:

randomly generating a token; and

combine the token with a character string to form the URL.

12. The system of claim 8, wherein the authentication module is configured to:

generate a query to the user based on data received from a third party corresponding to the user; and

verify that a response to the query received from the user corresponds to the data received from the third party.

13. The system of claim 8, wherein the authentication module is configured to:

responsive to transmitting the URL to the user, log a timestamp for the URL transmission;

responsive to receiving the request for the URL, log a timestamp for the URL request;

verify that a difference between the timestamp for the URL transmission and the timestamp for the URL request is within a predetermined time period;

generate a query to the user based on data received from a third party corresponding to the user; and

verify that a response to the query received from the user corresponds to the data received from the third party.

14. The system of claim 13, wherein the authentication module is configured to:

responsive to receiving the access request, query the user for an electronic mail address; and

responsive to receiving an electronic mail address from the user, verify the electronic mail address received from the user with a stored electronic mail address corresponding to the user.

15. A computer program product for having a computer program embodied on a computer-readable storage medium, the computer program executable to:

responsive to receiving an access request from a user for the secure resource in a first access session, log an Internet Protocol (IP) address of the access request and transmit a uniform resource locator (URL) to the user via an electronic mail message;

responsive to receiving a request for the URL in a second access session, log an IP address corresponding to the URL request;

compare the IP address logged from the first access session with the IP address logged from the second access session; and

responsive to verifying that the IP address corresponding to the first access session matches the IP address of the second access session, authorize access to the secure resource.

16. The computer program product of claim 15, wherein the computer readable program is configured to:

responsive to transmitting the URL to the user, log a timestamp for the URL transmission;

responsive to receiving the request for the URL, log a timestamp for the URL request; and

verify that a difference between the timestamp for the URL transmission and the timestamp for the URL request is within a predetermined time period.

17. The computer program product of claim 15, wherein the computer readable program is configured to:

generate a query to the user based on data received from a third party corresponding to the user; and

verify that a response to the query received from the user corresponds to the data received from the third party.

18. The computer program product of claim 15, wherein the computer readable program is configured to:

randomly generating a token; and

combine the token with a character string to form the URL.

19. The computer program product of claim 15, wherein the computer readable program is configured to:

responsive to transmitting the URL to the user, log a timestamp for the URL transmission;

responsive to receiving the request for the URL, log a timestamp for the URL request;

verify that a difference between the timestamp for the URL transmission and the timestamp for the URL request is within a predetermined time period;

generate a query to the user based on data received from a third party corresponding to the user; and

verify that a response to the query received from the user corresponds to the data received from the third party.

20. The computer program product of claim 19, wherein the computer readable program is configured to:

responsive to receiving the access request, query the user for an electronic mail address; and

responsive to receiving an electronic mail address from the user, verify the electronic mail address received from the user with a stored electronic mail address corresponding to the user.