User Authentication Based on Network Context

• US 20140208382A1
• Filed: 01/22/2013
• Published: 07/24/2014
• Est. Priority Date: 01/22/2013
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP AG (SAP SE)
• Inventors: Zlatarev, Stephan
• Granted Patent: US 9,021,558 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services

Abstract

Example systems and methods of user authentication based on network context are presented. In one example, a command to authenticate a user of a computing device is received in response to a request transmitted from the computing device to access a computing solution. In response to the command, a determination is made whether a network address corresponding to the request matches at least one network address associated with a protected network. Based on the network address corresponding to the request not matching the at least one network address associated with the protected network, authentication of the user is initiated at an identity provider corresponding to the computing solution. Otherwise, based on the network address corresponding to the request matching the at least one network address associated with the protected network, authentication of the user is delegated to an identity management system located within the protected network.

Claims

1. A method, comprising:

receiving, in response to a request transmitted from a computing device to access a computing solution, a command to authenticate a user of the computing device;

determining, in response to receiving the command, whether a network address corresponding to the request matches at least one network address associated with a protected network;

initiating, in response to the network address corresponding to the request not matching the at least one network address associated with the protected network, authentication of the user at an identity provider corresponding to the computing solution; and

delegating, in response to the network address corresponding to the request matching the at least one network address associated with the protected network, the authentication of the user to an identity management system located within the protected network.

2. The method of claim 1, the at least one network address associated with the protected network comprising one of a single network address, a range of network addresses, and a list of ranges of network addresses.

3. The method of claim 1, the at least one network address associated with the protected network comprising a network address of a proxy server of the protected network.

4. The method of claim 1, at least one of the identity provider and the identity management system providing the authentication of the user using a security assertion markup language.

5. The method of claim 1, the delegating of the authentication of the user to the identity management system located within the protected network being performed using an identity provider proxy mechanism.

6. The method of claim 1, each of the identity provider and the identity management system providing at least one authentication mechanism for the authentication of the user.

7. The method of claim 6, wherein the at least one authentication mechanism provided by the identity provider is different than the at least one authentication mechanism provided by the identity management system.

8. The method of claim 6, a number of the authentication mechanisms provided by the identity management system being greater than a number of the authentication mechanisms provided by the identity provider.

9. The method of claim 8, each of the authentication mechanisms provided by the identity management system and the authentication mechanisms provided by the identity provider being defined via a stack of pluggable authentication modules.

10. The method of claim 1, the initiating of the authentication of the user via the identity provider comprising forwarding at least a portion of the authentication from the identity provider to a second identity provider.

11. A system comprising:

at least one processor; and

memory comprising modules including instructions that are to be executed by the at least one processor, the modules comprising;

a user location determination module configured to;

receive, in response to a request transmitted from a computing device to access a computing solution, a command to authenticate a user of the computing device; and

determine, in response to receiving the command, whether a network address corresponding to the request matches at least one network address associated with a protected network;

an authentication module configured to authenticate the user in response to the network address corresponding to the request not matching the at least one network address associated with the protected network; and

a delegation module configured to delegate, in response to the network address corresponding to the request matching the at least one network address associated with the protected network, the authentication of the user to an identity management system located within the protected network.

12. The system of claim 11, the system comprising an identity provider, the authentication module further configured to employ at least one additional identity provider external to the system to authenticate the user.

13. The system of claim 11, the computing solution providing a single entry point for access to the computing solution via computing devices located within the protected network and outside the protected network.

14. The system of claim 11, the at least one network address associated with the protected network comprising one of a single Internet Protocol (IP) address, a range of IP addresses, and a list of ranges of IP addresses.

15. The system of claim 11, the at least one network address associated with the protected network comprising a network address of a proxy server of the protected network.

16. The system of claim 11, the system comprising an identity provider, each of the identity provider and the identity management system providing at least one authentication mechanism for the authentication of the user.

17. The system of claim 16, wherein the at least one authentication mechanism provided by the identity provider is different than the at least one authentication mechanism provided by the identity management system.

18. The system of claim 16, a number of the authentication mechanisms provided by the identity management system being greater than a number of the authentication mechanisms provided by the identity provider.

19. The system of claim 11, the network address corresponding to the request comprising a network address of a communication device from which the request was received at the computing solution.

20. A non-transitory computer-readable storage medium including instructions that, when executed by at least one processor of a machine, cause the machine to perform operations comprising:

receiving, from a computing solution in response to a request transmitted from a computing device to access the computing solution, a command to authenticate a user of the computing device, the command including a network address of a communication device from which the request was received at the computing solution;

determining whether the network address corresponding to the request matches at least one network address associated with a protected network;

initiating, in response to the network address corresponding to the request not matching the at least one network address associated with the protected network, authentication of the user via an identity provider corresponding to the computing solution; and

in response to the network address corresponding to the request matching the at least one network address associated with the protected network, delegating the authentication of the user to an identity management system located within the protected network.