TRANSACTION AUTHENTICATION MANAGEMENT SYSTEM WITH MULTIPLE AUTHENTICATION LEVELS

• US 20130067546A1
• Filed: 09/08/2011
• Published: 03/14/2013
• Est. Priority Date: 09/08/2011
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Thavasi, Manivannan, Togwe, Thembani
• Granted Patent: US 8,590,018 B2
• Time in Patent Office: Days
• US Class Current: 726/7
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/104 Grouping of entities

Abstract

An operating system of an information handling system (IHS) initializes a security tool to provide security management during user-to-user transactions. The security tool may determine the user'"'"'s type and invokes a user personal profile and application profile information that pertains to the transaction. The security tool may use the user personal profile and application profile information during user authentications. The security tool determines an initial authentication level and may modify that authentication level during user-to-user transaction operations. The security tool may perform substantially continuous user authentication during transaction operations by employing learned behavior, historical knowledge, and other information that the security tool maintains in a security information store.

Claims

1. An authentication method, the method comprising:

receiving from an initiating user, by a security tool, a request for a transaction;

performing, by the security tool, a first authentication of the initiating user for the transaction, the first authentication employing a first authentication level;

authorizing the transaction to proceed, by the security tool, in response to the first authentication of the initiating user; and

performing, by the security tool, a plurality of subsequent authentications of the initiating user after the first authentication of the initiating user and during the transaction;

wherein at least one of the plurality of subsequent authentications employs a different authentication level than the first authentication level.

2. The authentication method of claim 1, wherein the security tool performs the plurality of subsequent authentications substantially continuously after the first authentication.

3. The authentication method of claim 1, further comprising modifying, by the security tool, the authentication level of at least one of the subsequent authentications as a function of a relationship between the initiating user and an interacting user.

4. The authentication method of claim 1, further comprising modifying, by the security tool, the authentication level of at least one of the subsequent authentications as a function lack of confidence in the authenticity of the user.

5. The authentication method of claim 1, wherein the different authentication levels include at least one of a password test, a challenge question test, a fingerprint test, a mouse click behavior test, a keystroke behavior test and a retinal scan test.

6. The authentication method of claim 2, wherein the security tool determines and stores a learned user attribute history from the plurality of subsequent authentications, the security tool accessing the learned user attribute history to ascertain the correctness of at least one of the plurality of subsequent authentications.

7. The authentication method of claim 1, further comprising accessing, by the security tool, at least one of a personal profile information store, an application profile information store, an authentication layer information store, a verification layer information store and an analysis layer information store to perform the first authentication and subsequent authentications.

8. The authentication method of claim 1, further comprising switching, by the security tool, from a passive authentication mode to an active authentication mode in response to an authentication failure in at least one of the plurality of subsequent authentications.

9. An information handling system (IHS), comprising:

a processor;

a memory, coupled to the processor, the memory being configured with a security tool that;

receives from an initiating user a request for a transaction;

performs a first authentication of the initiating user for the transaction, the first authentication employing a first authentication level;

authorizes the transaction to commence in response to the first authentication of the initiating user; and

performs a plurality of subsequent authentications of the initiating user after the first authentication of the initiating user and during the transaction,

wherein at least one of the plurality of subsequent authentications employs a different authentication level than the first authentication level.

10. The IHS of claim 9, wherein the security tool performs the plurality of subsequent authentications substantially continuously after the first authentication.

11. The IHS of claim 9, wherein the security tool modifies the authentication level of at least one of the subsequent authentications as a function of a relationship between the initiating user and an interacting user.

12. The IHS of claim 11, wherein the security tool modifies the authentication level of at least one of the subsequent authentications as a function lack of confidence in the authenticity of the user.

13. The IHS of claim 9, wherein the different authentication levels include at least one of a password test, a challenge question test, a fingerprint test, a mouse click behavior test, a keystroke behavior test and a retinal scan test.

14. The IHS of claim 10, wherein the security tool determines and stores a learned user attribute history from the plurality of subsequent authentications, the security tool accessing the learned user attribute history to ascertain the correctness of at least one of the plurality of subsequent authentications.

15. The IHS of claim 9, wherein the security tool accesses at least one of a personal profile information store, an application profile information store, an authentication layer information store, a verification layer information store and an analysis layer information store to perform the first authentication and subsequent authentications.

16. The IHS of claim 9, wherein the security tool switches from a passive authentication mode to an active authentication mode in response to an authentication failure in at least one of the plurality of subsequent authentications.

17. A security tool computer program product, comprising:

a computer readable storage medium;

first instructions that receive a request for a transaction from an initiating user;

second instructions that perform a first authentication of the initiating user for the transaction, the first authentication employing a first authentication level of the initiating user;

third instructions that authorize the transaction to proceed in response to the first authentication of the initiating user;

fourth instructions that perform a plurality of subsequent authentications of the initiating user after the first authentication of the initiating user and during the transaction, wherein at least one of the plurality of subsequent authentications employs a different authentication level than the first authentication;

wherein the first, second, third and fourth instructions are stored on the computer readable storage medium.

18. The security tool computer program product of claim 17, further comprising:

fifth instructions that modify the authentication level of at least one of the subsequent authentications as a function of a relationship between the initiating user and an interacting user.

19. The security tool computer program product of claim 17, further comprising:

sixth instructions that determine and store a learned user attribute history from the plurality of subsequent authentications, the sixth instructions accessing the learned user attribute history to ascertain the correctness of at least one of the plurality of subsequent authentications.

20. The security tool computer program product of claim 17, further comprising:

seventh instructions that switch from a passive authentication mode to an active authentication mode in response to an authentication failure in at least one of the plurality of subsequent authentications.