SYSTEMS AND METHODS FOR PROVIDING SECURITY TOKEN AUTHENTICATION

• US 20100050251A1
• Filed: 08/22/2008
• Published: 02/25/2010
• Est. Priority Date: 08/22/2008
• Status: Active Grant

• Current Assignee: Citibank (South Dakota) NA (Citigroup Incorporated)
• Original Assignee: Citibank (South Dakota) NA (Citigroup Incorporated)
• Inventors: Speyer, Jerry, Luo, Ricky, Nair, Sandeep
• Granted Patent: US 8,032,932 B2
• Time in Patent Office: Days
• US Class Current: 726/20
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853

Abstract

Described herein are systems and methods for centralizing and standardizing implementation of security tokens so as to provide one token per one user for accessing business applications across an enterprise, providing scalability to support authentication of as many enterprise users as desired or needed, and providing a standardized token management interface that supports both pre-binding and post-binding user registration processes and different types of security token.

Claims

1. A system for authenticating a security token provided to request access to at least one business application in an enterprise, comprising:

a plurality of token domains, each token domain operates to authenticate a type of security token;

a lookup database that stores therein a mapping of security tokens to token types and the plurality of token domains;

a user store database that operates to store a user profile that includes the provided security token, a token type of the provided security as provided by the mapping in the lookup database, and a corresponding one of the token domains as also provided by the mapping in the lookup database; and

an authentication broker that operates to receive the provided security token from the at least one business application and to look up the provided security token in the user profile stored in the user store database to identify the token type and the corresponding token domain of the provided token so as to authenticate the provided security token.

2. The system of claim 1, further comprising:

a token management interface that operates to register the provided security token by creating the user profile.

3. The system of claim 1, wherein the at least one business application includes a single sign-on (SSO) authentication application that operates to receive the provided security token and to forward the provided security token to the authentication broker.

4. The system of claim 1, wherein the provided security token is one of a hardware security token and a software security token that provide one-time password (OTP) authentication.

5. The system of claim 1, wherein the authentication broker includes a plurality of authentication plug-ins, each authentication plug-in connects to one of the plurality of token domains that authenticates a different type of security token.

6. The system of claim 1, wherein at least one of the authentication plug-ins is a remote authentication dial in user service (RADIUS) based plug-in.

7. The system of claim 1, wherein at least one of the authentication plug-ins is a plug-in that provides connection to one of the plurality of token domains for authenticating a software security token.

19. The system of claim 3, wherein the authentication broker includes a security policy server that operates to receive the provided security token and to validate the provided security token before looking up the provided security token in the user profile stored in the user store database.

20. The system of claim 19, wherein the authentication broker further includes a token-identification server that operates to receive the validated security token from the security policy server and to look up the provided security token in the user profile stored in the user store database.

21. The system of claim 20, wherein the authentication broker further includes:

a token-identification configuration file that is accessible by the token identification server to configure settings for accessing one or more authentication plug-ins; and

an authentication-scheme configuration file that is accessible by the one or more authentication plug-ins to configure settings for accessing one or more token domains external to the authentication broker that are used to authenticate different types of security tokens.

8. A method for authenticating a request to access at least one business application [204] in an enterprise, comprising [pre-binding registration]:

receiving a request for a security token for authenticating the request to access the at least one business application;

creating a unique user identification (UID) for the security-token request;

assigning and activating a security token in response to the security-token request, the security token is identified by a unique token identification;

looking up the assigned security token and its unique token identification to identify a token type of the assigned security token and an associated token domain for authenticating the assigned security token;

storing the UID, the unique token identification, the identified token type, and an identification of the associated token domain in a user profile;

receiving the request to access the at least one business application, wherein the request includes the assigned and activated security token;

responsive to the request to access, looking up the assigned and activated security token and its unique token identification in the user profile to identify the token type and the associated token domain of the assigned and activated security token;

invoking an authentication plug-in particular to the identified token type to connect to the associated token domain based on the identification of the associated token domain in the user profile; and

authenticating the assigned and activated security token with the associated token domain as connected to by the authentication plug-in.

9. The method of claim 8, further comprising:

assigning a personal identification number (PIN) to the request to access the at least one business application to establish multi-factor authentication to access the at least one business application with the PIN and the assigned and activated security token.

10. The method of claim 8, further comprising:

providing a token domain interface (TAMIN) to perform the steps of creating the UID, assigning and activating the security token, and looking up the assigned security token.

11. The method of claim 10, further comprising:

providing a plurality of application programming interfaces (APIs) in the TAMIN for the at least one business application to access the TAMIN to perform the steps of creating the UID, assigning and activating the security token, and looking up the assigned security token.

12. The method of claim 10, wherein the enterprise includes a plurality of business units, and the at least one business application comprises a plurality of business applications, each business application is managed by a different one of the plurality of business units, the method further comprising:

providing the plurality of business units with access to the TAMIN.

13. The method of claim 12, further comprising:

one of the plurality of business units accessing the TAMIN to perform the steps of creating the UID, assigning and activating the security token, and looking up the assigned security token upon a determination that the assigned and activated security token is used for authenticating access to the business application managed by the one business unit and not in a business application managed by any other of the plurality of business units.

14. The method of claim 12, further comprising:

preventing one of the plurality of business units to perform, via accessing the TAMIN, the steps of creating the UID, assigning the security token, and looking up the assigned and activated security token upon a determination that the assigned security token is used for authentication access to multiple business applications in different ones of the plurality of business units.

15. The method of claim 12, further comprising:

providing a centralized information security administration (ISA) in the enterprise to access the TAMIN and perform the steps of creating the UID, assigning the security, and looking up the assigned security token.

16. A method for authenticating a request to access at least one business application in an enterprise, comprising [post-binding registration]:

receiving a request to activate a previously-obtained security token for authenticating the request to access the at least one business application, the request includes a unique token identification of the previously-obtained security token;

activating the previously-obtained security token;

looking up the previously-obtained security token and its unique token identification to identify a token type of the previously-obtained security token and an associated token domain for authenticating the previously-obtained security token;

storing the UID, the unique token identification, the identified token type, and an identification of the associated token domain in a user profile;

receiving the request to access the at least one business application, wherein the request includes the previously-obtained security token;

responsive to the request to access, looking up the previously-obtained security token and its unique token identification in the user profile to identify the token type and the associated token domain of the previously-obtained security token;

invoking an authentication plug-in particular to the identified token type to connect to the associated token domain based on the identification of the associated token domain in the user profile; and

authenticating the previously-obtained security token with the associated token domain as connected to by the authentication plug-in.

17. The method of claim 16, further comprising:

assigning an authentication mechanism to the request to access the at least one business application to establish multi-factor authentication to access the at least one business application with the authentication mechanism and the previously-obtained security token.

18. The method of claim 17, wherein in the step of receiving the request to access the at least one business application, the request further includes the assigned authentication mechanism, and the method further comprising:

authenticating the assigned authentication mechanism; and

upon successfully authenticating the assigned authentication mechanism, proceeding to perform the step of looking up the previously-obtained security token and its unique token identification.