System and method for controlling access

• US 10,154,035 B2
• Filed: 07/07/2016
• Issued: 12/11/2018
• Est. Priority Date: 07/02/2013
• Status: Active Grant

• Current Assignee: Ip Ot Sub Ulc
• Original Assignee: Open Text Sa Ulc (Open Text Corporation)
• Inventors: Copsey, Simon Dominic
• Primary Examiner(s): Rahim, Monjour
• Application Number:
  US15/203,883
• Publication Number:
  US 20160315940A1
• Time in Patent Office: 887 Days
• Field of Search: 726 7
• CPC Class Codes: H04L 47/803 Application aware
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

Systems and methods for controlling access to multiple applications on a computing device are provided. One embodiment of a system includes an access device configured to: receive a request to access a first application and a device identifier; authenticate the user using a user credential associated with the user and store the device identifier in association with a login identifier in response to authentication of the user. The access device can be further configured to receive a request to access a second application and the device identifier. The access device can allow access to the second application based on the previous authentication of the user.

Claims

1. A method for controlling access to a target system, comprising:

an access device receiving a first access request for a first application from a user device over a network in a first session with the first application;

the access device receiving a device identifier uniquely identifying the user device in the first session in association with the first access request;

the access device controlling access to the first application by authenticating a user of the user device using a user credential associated with the user;

the access device storing the device identifier in association with a login identifier in response to authentication of the user;

the access device receiving a second access request for a second application from the user device over the network in a second session with the second application;

the access device receiving the device identifier uniquely identifying the user device in the second session in association with the second access request for the second application from the user device;

the access device determining that the user has previously authenticated based on a match between the device identifier received in association with the second request for the second application in the second communication session with the second application and the device identifier stored in association with the login identifier; and

the access device allowing the second application to access to a platform based on the determination that the user previously authenticated, without requiring a separate user credential verification for the second application, wherein the platform applies security controls or data policies in association with the first application or the second application based on an indication of an association between the user and the login identifier.

2. The method of claim 1, wherein the device identifier is stored or determined at the user device.

3. The method of claim 1, wherein the access device is a proxy system for the platform.

4. The method of claim 3, wherein the access device logs the user into the platform for the first application or second application using the user credentials.

5. The method of claim 1, wherein the first access request includes the device identifier.

6. The method of claim 1, wherein the access device requests the device identifier from the user device in response to the first access request or second access request and receives the device identifier in response the request for the device identifier.

7. A system for controlling access to a target system, comprising:

an access device in communication with a platform, the access device including a processor and adapted to;

receive a first access request for a first application from a user device over a network in a first session with the first application;

receive a device identifier uniquely identifying the user device in the first session in association with the first access request;

control access to the first application by authenticating a user of the user device using a user credential associated with the user;

store the device identifier in association with a login identifier in response to authentication of the user;

receive a second access request for a second application from the user device over the network in a second session with the second application;

receive the device identifier uniquely identifying the user device in the second session with the second application in association with the second access request for the second application from the user device; and

compare the device identifier stored in association with the login identifier and the device identifier received in the second communication session with the second application and, in response to determining a match exists, allow access to the platform on behalf of the second application in the second communication session without a separate credential verification for the second application, wherein the platform applies security controls or data policies in association with the first application or the second application based on an indication of an association between the user and the login identifier.

8. The system of claim 7, wherein the device identifier is stored or determined at the user device.

9. The system of claim 7, wherein the access device is a proxy system for the platform.

10. The system of claim 9, wherein the access device logs the user into the platform for the first application or second application using the user credentials.

11. The system of claim 7, wherein the first access request includes the device identifier.

12. The system of claim 7, wherein the access device requests the device identifier from the user device in response to the first access request or second access request and receives the device identifier in response to the request for the device identifier.

13. A non-transitory computer readable medium storing a set of computer instructions executable by a processor to perform the steps of:

receive a first access request for a first application from a user device over a network in a first session with the first application;

receive a device identifier uniquely identifying the user device in the first session in association with the first access request;

control access to the first application by authenticating a user of the user device using a user credential associated with the user;

store the device identifier in association with a login identifier in response to authentication of the user;

receive a second access request for a second application from the user device over the network in a second session with the second application;

receive the device identifier uniquely identifying the user device in the second session with the second application in association with the second access request for the second application from the user device;

determine that the user has previously authenticated based on a match between the device identifier received in the second request for the second application in the second communication session and the device identifier stored in association with the login identifier; and

allow the second application to access a platform based on the determination that the user previously authenticated, without requiring a separate user credential verification for the second application, wherein the platform applies security controls or data policies in association with the first application or the second application based on an indication of an association between the user and the login identifier.

14. The non-transitory computer readable medium of claim 13, wherein the device identifier is stored or determined at the user device.

15. The system of claim 13, wherein the access device is a proxy system for the platform.

16. The non-transitory computer readable medium of claim 15, wherein the access device logs the user into the platform for the first application or second application using the user credentials.

17. The non-transitory computer readable medium of claim 13, wherein the first access request includes the device identifier.

18. The non-transitory computer readable medium of claim 13, wherein the access device requests the device identifier from the user device in response to the first access request or second access request and receives the device identifier in response the request for the device identifier.