METHOD AND SYSTEM FOR PROVIDING A FEDERATED AUTHENTICATION SERVICE WITH GRADUAL EXPIRATION OF CREDENTIALS

• US 20100122333A1
• Filed: 11/13/2008
• Published: 05/13/2010
• Est. Priority Date: 11/13/2008
• Status: Active Grant

• Current Assignee: Onespan North America Incorporated (OneSpan, Inc.)
• Original Assignee: Vasco Data Security Incorporated (OneSpan, Inc.)
• Inventors: Noe, Frederik
• Granted Patent: US 8,281,379 B2
• Time in Patent Office: Days
• US Class Current: 726/8
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807

Abstract

The present invention relates to the field of authentication of users of services over a computer network, more specifically within the paradigms of federated authentication or single sign-on. A known technique consists of associating different trust levels to different authentication mechanisms, wherein the respective trust levels give access to different information resources, notably to provide the possibility to protect more sensitive resources with a stronger form of authentication. The present invention provides a mechanism to allow the trust level to decrease without re-authenticating with the single sign on system, down to the level at which it is no longer sufficient to obtain access to a desired resource. Only then, the user needs to reauthenticate.

Claims

1. A method for providing a single sign-on service, comprising

receiving at an authentication server an authentication request from a user;

authenticating said user at said authentication server;

associating at least one initial trust level with said authentication;

receiving a validation request pertaining to said user and an application server, said application server enforcing a required minimum level of trust;

calculating an updated trust level to be associated with said authentication from at least a function of time;

granting said user access to said application server if said updated trust level exceeds said required minimum level.

2. The method of claim 1, further comprising generating an authentication ticket for said user.

3. The method of claim 2, wherein said validation request contains a reference to said authentication ticket.

4. The method of claim 1, wherein said function of time is a function of the time elapsed since said authenticating.

5. The method of claim 1, wherein said calculating also uses said initial trust level.

6. The method of claim 1, wherein said calculating also uses said required minimum level of trust, and wherein said calculating results in a symbolic value indicating authentication failure if said required minimum level of trust is not granted.

7. The method of claim 1, wherein said receiving of said validation request takes place at said application server.

8. The method of claim 1, wherein said receiving of said validation request takes place at said authentication server.

9. The method of claim 1, wherein said calculating comprises decreasing said updated trust level linearly with time.

10. The method of claim 1, wherein said calculating comprises decreasing said updated trust level exponentially with time.

11. The method of claim 1, wherein said calculating comprises decreasing said updated trust level as a series of step functions in the time domain.

12. The method of claim 1, wherein said calculating comprises verifying an expiry time for a plurality of trust levels initially associated with said authentication.

13. The method of claim 1, wherein said calculating takes place at said application server.

14. The method of claim 1, wherein said calculating takes place at said authentication server.

15. The method of claim 1, wherein said required minimum level of trust may vary at different application servers.

16. A system for providing a single sign-on service, comprising

a first receiving agent for receiving an authentication request from a user;

an authentication agent for authenticating said user;

an issuing agent for issuing an authentication ticket for said user, wherein at least one initial trust level is associated with said authentication ticket;

a second receiving agent for receiving a validation request pertaining to said user from an application server, said request containing a reference to said authentication ticket, and said application server enforcing a required minimum level of trust;

a processor for calculating an updated trust level to be associated with said authentication ticket from at least a function of time; and

a sending agent for sending a signal indicative of said calculating to said application server.

17. The system of claim 16, wherein said function of time is a function of the time elapsed since said authenticating.

18. The system of claim 16, wherein said calculating also uses said initial trust level.

19. The system of claim 16, wherein said calculating also uses said required minimum level of trust, and wherein said calculating results in a symbolic value indicating authentication failure if said required minimum level of trust is not granted.

20. The system of claim 16, wherein said calculating comprises decreasing said updated trust level linearly with time.

21. The system of claim 16, wherein said calculating comprises decreasing said updated trust level exponentially with time.

22. The system of claim 16, wherein said calculating comprises decreasing said updated trust level as a series of step functions in the time domain.

23. The system of claim 16, wherein said calculating comprises verifying an expiry time for each of said at least one trust levels.

24. A system for providing a single sign-on service, comprising

a receiving agent for receiving an authentication request from a user;

an authentication agent for authenticating said user; and

,

an issuing agent for issuing an authentication ticket for said user, wherein at least one initial trust level and at least one subsequent trust level are associated with said authentication ticket, said subsequent trust level having a validity period extending beyond the validity period of said initial trust level.

25. A system as recited in claim 24, further comprising a first server and a second server, each said server including a trust agent, each trust agent establishing a minimum level of trust, wherein said first server trust agent establishes a minimum level of trust which is independent of a minimum level of trust established by said second server trust agent.

26. A method for providing a single sign-on service, comprising

receiving an authentication request from a user;

authenticating said user; and

,

issuing an authentication ticket for said user, wherein at least one initial trust level and at least one subsequent trust level are associated with said authentication ticket, said subsequent trust level having a validity period extending beyond the validity period of said initial trust level.