Method and apparatus for facilitating multi-level computer system authentication

• US 20070028117A1
• Filed: 08/01/2005
• Published: 02/01/2007
• Est. Priority Date: 08/01/2005
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Wong, Daniel
• Granted Patent: US 7,814,330 B2
• Time in Patent Office: Days
• US Class Current: 713/182
• CPC Class Codes: G06F 21/31 User authentication

Abstract

One embodiment of the present invention provides a system that facilitates authenticating a user at a computer system. During operation, the system creates an authentication profile and assigns the authentication profile to a user, wherein the authentication profile specifies authentication criteria. Next, the computer system receives a login request from the user, and in responding to the login request, the computer system checks if the authentication criteria in the authentication profile are satisfied. If so, the system allows the user to login. If not, the user is prevented from logging into the computer system.

Claims

1. A method for authenticating a user at a computer system comprising:

creating an authentication profile, wherein the authentication profile includes authentication criteria;

assigning the authentication profile to the user;

receiving a login request from the user at the computer system;

in response to the login request, checking if the authentication criteria in the authentication profile are satisfied;

if so, logging the user into the computer system; and

if not, preventing the user from logging into the computer system.

2. The method of claim 1, wherein logging the user into the computer system further involves associating a set of privileges with the user, wherein the privileges are associated with an authentication profile.

3. The method of claim 1, wherein the authentication profile is assigned to more than one user.

4. The method of claim 1, wherein the authentication criteria can include:

an IP address;

a client program;

a time range;

a credential; and

any other authentication mechanism.

5. The method of claim 1, wherein multiple authentication profiles can be assigned to the user, wherein the multiple authentication profiles are prioritized.

6. The method of claim 5, wherein the computer system checks all authentication profiles assigned to the user, whereby the method further comprises:

in response to the login request, checking if authentication criteria in the highest priority authentication profile are met;

if so, logging the user into the computer system;

if not, checking if authentication criteria in the next highest priority authentication profile are met; and

if there are no remaining authentication profiles, preventing the user from logging into the computer system.

7. The method of claim 1, wherein the computer system sends a request to an authentication module to perform the authentication.

8. The method of claim 1, wherein preventing the user from logging into the computer system involves secondary actions, wherein secondary actions can include:

preventing further login attempts from the user;

preventing further login attempts from the computer system;

reporting failed login attempts;

logging further activity; and

any other action in response to a failed login attempt.

9. A computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for authenticating a user at a computer system, the method comprising:

creating an authentication profile, wherein the authentication profile includes authentication criteria;

assigning the authentication profile to the user;

receiving a login request from the user at the computer system;

in response to the login request, checking if authentication criteria in the authentication profile are satisfied;

if so, logging the user into the computer system; and

if not, preventing the user from logging into the computer system.

10. The computer-readable storage medium of claim 9, wherein logging the user into the computer system further involves associating a set of privileges with the user, wherein the privileges are associated with an authentication profile.

11. The computer-readable storage medium of claim 9, wherein the authentication profile is assigned to more than one user.

12. The computer-readable storage medium of claim 9, wherein the authentication criteria can include:

an IP address;

a client program;

a time range;

a credential; and

any other authentication mechanism.

13. The computer-readable storage medium of claim 9, wherein multiple authentication profiles can be assigned to the user.

14. The computer-readable storage medium of claim 13, wherein the multiple authentication profiles are prioritized.

15. The computer-readable storage medium of claim 14, wherein the computer system checks all authentication profiles assigned to the user.

16. The computer-readable storage medium of claim 15, wherein the method further comprises:

in response to the login request, checking if authentication criteria in the highest priority authentication profile are met;

if so, logging the user into the computer system;

if not, checking if authentication criteria in the next highest priority authentication profile are met; and

if there are no more authentication profiles, preventing the user from logging into the computer system.

17. The computer-readable storage medium of claim 9, wherein the computer system sends a request to an authentication module to perform the authentication.

18. The computer-readable storage medium of claim 9, wherein preventing the user from logging into the computer system involves secondary actions, wherein secondary actions can include:

preventing further login attempts from the user;

preventing further login attempts from the computer system;

reporting failed login attempts;

logging further activity; and

any other action in response to a failed login attempt.

19. The computer-readable storage medium of claim 9, wherein the computer system can include a database.

20. An apparatus that authenticates a user at a computer system comprising:

a profile-creation mechanism configured to create an authentication profile, wherein the authentication profile includes authentication criteria;

an assignment mechanism configured to assign the authentication profile to the user;

a receiving mechanism configured to receive a login request from the user;

a checking mechanism configured to check if the authentication criteria in the authentication profile are met;

a login mechanism configured to log the user into the computer system if the user is authenticated; and

if not, to prevent the user from logging into the computer system.