Identity and access management framework

• US 20080028453A1
• Filed: 03/29/2007
• Published: 01/31/2008
• Est. Priority Date: 03/30/2006
• Status: Abandoned Application

• Current Assignee: DEXA Systems Incorporated
• Original Assignee: DEXA Systems Incorporated
• Inventors: Cuttill, Shaun, Mahdavi, Mehrzad, Nguyen, Timothy, Nguyen, Thinh
• Application Number:
  US11/731,011
• Publication Number:
  US 20080028453A1
• Time in Patent Office: Days
• US Class Current: 726/9
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A method for authenticating a user involves receiving a request from the user to access a resource, where the resource is associated with at least one authentication requirement, determining a trust level associated with access to the resource, obtaining user credentials based on the trust level associated with the resource, selecting an authentication method for authenticating the user based on the trust level associated with the resource, generating user authentication information based on the trust level associated with the resource and the user credentials obtained, where user authentication information relates to the user'"'"'s environment while accessing the resource, sending the user authentication information to the resource, and granting access to the resource, if the user authentication information meets the at least one authentication requirement of the resource.

Claims

1. A method for authenticating a user, comprising:

receiving a request from the user to access a resource, wherein the resource is associated with at least one authentication requirement;

determining a trust level associated with access to the resource;

obtaining user credentials based on the trust level associated with the resource;

selecting an authentication method for authenticating the user based on the trust level associated with the resource;

generating user authentication information based on the trust level associated with the resource and the user credentials obtained, wherein user authentication information relates to the user'"'"'s environment while accessing the resource;

sending the user authentication information to the resource; and

granting access to the resource, if the user authentication information meets the at least one authentication requirement of the resource.

2. The method of claim 1, wherein generating user authentication information comprises authenticating the user using the selected authentication method.

3. The method of claim 1, wherein the trust level is determined using a plurality of trust rules.

4. The method of claim 1, further comprising:

modifying the resource to support the authentication method selected to meet the requirements of the trust level associated with the resource.

5. The method of claim 1, wherein the trust level associated with the resource is one selected from a group consisting of no trust level, a low trust level, a medium trust level, and a high trust level.

6. The method of claim 1, wherein user authentication information comprises at least one selected from a group consisting of an identity of the user, a user credential type, a location of the user, and a type of the requested resource.

7. The method of claim 6, wherein the user credential type comprises one selected from a group consisting of smart card credentials, a user identification and password, a one-time password, and PKI credentials.

8. The method of claim 1, wherein the resource comprises one selected from a group consisting of a web application, a legacy application, a system application, a financial data application, and an operating system application.

9. The method of claim 1, wherein the authentication method comprises one selected from a group consisting of a PKI authentication, a two-factor authorization authentication, a user identification and password authentication, and a one-time password authentication.

10. The method of claim 1, wherein sending the user authentication information to the resource comprises translating the user authentication information to an assertion protocol supported by the requested resource.

11. The method of claim 10, wherein the assertion protocol is one selected from a group consisting of Kerberos, Security Assertion Markup Language (SAML), SiteMinder, Windows Integrated Authentication, and Security Extension Architecture (SEA).

12. The method of claim 10, wherein a mapping of the resource and the supported assertion protocol is stored in a resource manager.

13. A system for identity and access control management, comprising:

a resource manager configured to determine at least one authentication requirement of a resource;

a trust engine configured to determine a trust level associated with access to the resource based on a plurality of trust rules;

an authentication server configured to obtain user credentials based on the trust level associated with the resource and generate user authentication information, wherein user authentication information comprises information related to a user'"'"'s environment while accessing the resource; and

an access policy engine operatively connected to the resource manager and to the trust engine, configured to determine whether the user authentication information meets the at least one authentication requirement of the resource,

wherein access to the resource is granted if the user authentication information meets the at least one authentication requirement of the resource.

14. The system of claim 13, wherein the authentication server is further configured to apply an authentication method selected based on the trust level associated with the resource to authenticate a user and to generate user authentication information.

15. The system of claim 14, wherein the resource is modified to support the authentication method selected to meet the requirements of the trust level associated with the resource.

16. The system of claim 13, wherein the trust level associated with the resource is one selected from a group consisting of no trust level, a low trust level, a medium trust level, and a high trust level.

17. The system of claim 13, wherein user authentication information comprises at least one selected from a group consisting of an identity of the user, a credential type, a location of the user, and a type of the requested resource.

18. The system of claim 13, wherein user authentication information comprises at least one selected from a group consisting of an identity of the user, a user credential type, a location of the user, and a type of the requested resource.

19. The system of claim 18, wherein the user credential type comprises one selected from a group consisting of smart card credentials, a user identification and password, a one-time password, and PKI credentials.

20. The system of claim 13, wherein the resource comprises one selected from a group consisting of a web application, a legacy application, a system application, a financial data application, and an operating system application.

21. The system of claim 13, wherein the resource manager is further configured to send the user authentication information to the resource, wherein sending the user authentication information to the resource comprises translating the user authentication information to an assertion protocol supported by the requested resource.

22. The system of claim 21, wherein the assertion protocol is one selected from a group consisting of Kerberos, Security Assertion Markup Language (SAML), SiteMinder, Windows Integrated Authentication, and Security Extension Architecture (SEA).

23. The system of claim 21, wherein a mapping of the resource and the supported assertion protocol is stored in the resource manager.

24. A computer usable medium comprising computer readable program code embodied therein for causing a computer system to:

receive a request from the user to access a resource, wherein the resource is associated with at least one authentication requirement;

determine a trust level associated with access to the resource;

obtain user credentials based on the trust level associated with the resource;

select an authentication method for authenticating the user based on the trust level associated with the resource;

generate user authentication information based on the trust level associated with the resource and the user credentials obtained, wherein user authentication information relates to the user'"'"'s environment while accessing the resource;

send the user authentication information to the resource; and

grant access to the resource, if the user authentication information meets the at least one authentication requirement of the resource.