System, method and computer program product for an authentication management infrastructure

• US 8,132,226 B1
• Filed: 12/04/2007
• Issued: 03/06/2012
• Est. Priority Date: 03/09/1999
• Status: Expired due to Fees

• Current Assignee: Citibank (South Dakota) NA (Citigroup Incorporated)
• Original Assignee: Citibank (South Dakota) NA (Citigroup Incorporated)
• Inventors: Bianco, Peter Garrett, Boon, William Taylor, Rochon, Anthony C., Sherman, Marc A., Sterling, Robert Brewster, Ware, Karl Roger
• Primary Examiner(s): PYZOCHA, MICHAEL J
• Application Number:
  US11/987,775
• Time in Patent Office: 1,554 Days
• Field of Search: 713/187, 713/186, 713/155, 726/1
• US Class Current: 726/1
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A system, method and computer program product that utilizes measurements for the authentication of users to enterprise resources. The system includes an authentication server that stores the engine and collections of data required by the system to authenticate users. The collections of data include templates, policies, groups, device IDS, user IDS, computer IDS and application IDS. In the present invention, it is the policies that determine the way or method in which a user is to be authenticated by the system. The pre-defined polices include an OR policy, an AND policy, a CONTINGENT policy, a RANDOM policy and a THRESHOLD policy, a multi-user policy, a multi-location policy, a multi-template policy, a user dependent policy, a location restriction policy, and a computer/device specific policy.

Claims

1. A method for allowing a user to access enterprise resources, the method comprising the steps of:

(1) implementing a policy on an authentication server, wherein the policy sets forth a plurality of guidelines for determining whether to authenticate at least one user and allow the at least one user to gain access to the enterprise resources, wherein at least one guideline establishes at least one predetermined qualification necessary for the at least one user to attain to pass the policy;

(2) requiring the at least one user to establish authentication using at least two devices associated with the policy, wherein

(i) if the policy is an OR policy, then requiring the user to establish authentication on only one of the at least two devices;

(ii) if the policy is an AND policy, then requiring the user to establish authentication on all of the at least two devices;

(iii) if the policy is a CONTINGENT policy, then requiring the user to exceed a minimum threshold associated with a first device or, if the user exceeds a contingent threshold associated with the first device, then requiring the user to exceed a minimum threshold associated with a second device;

(iv) if the policy is a RANDOM policy, then requiring the user to establish authentication on a randomly selected device from the at least two devices;

or

(v) if the policy is a THRESHOLD policy, then requiring the user to exceed a total threshold value for the at least two devices;

(3) creating a template for each said device, wherein said template includes data unique to a user;

(4) once the at least one user attempts to attain the at least one predetermined qualification using the at least two devices, then;

(a) allowing the user to proceed in attempting to pass any remaining qualifications of the policy, or

(b) determining that the at least one user has failed the policy;

(5) once the user has attains the at least one qualification, then determining that the at least one user is authenticated; and

(6) allowing the at least one user to access the enterprise resources.

2. The method of claim 1, further comprising the steps of:

(a) determining said devices the user must be enrolled in by looking at a list of devices associated with said policy assigned to a user'"'"'s group;

(b) creating a template for each of said devices in said list of devices; and

(c) storing each of said created templates in said authentication server.

3. The method of claim 2, further comprising the steps of:

(a) receiving a login request at said authentication server, wherein said login request includes one of a computer ID and one of a user ID;

(b) determining which said group said user ID is in;

(c) determining which said policy is assigned to said group;

(d) determining whether said policy can be executed;

(e) returning that the user is not authenticated if the outcome of step

(d) is negative;

(f) executing said policy to determine if the user is authenticated; and

(g) returning that the user is authenticated if the outcome of step (f) is positive.

4. The method of claim 3, wherein step (d) comprises the steps of:

(i) determining whether a required template are stored in said authentication server;

(ii) determining whether a required device ID are assigned to said computer ID; and

(iii) returning that said policy can be executed if the outcome to both step i and step ii are positive.

5. The method of claim 1, further comprising an administration station for performing step (1).

6. The method of claim 1, further comprising the step of enrolling the user using an enrollment station.

7. The method of claim 3, wherein step (f) comprises the step of testing the user on said devices listed in said list of devices until either the user passes said policy or the user fails said policy.

8. The method of claim 1, further comprising forming said policy by selecting one or more said devices that the user must be tested on in order to gain access to the enterprise resources.

9. The method of claim 1, further comprising placing the user within a group, wherein said group defines a set of users with a common characteristic or access privileges.

10. The method of claim 1, wherein step (1) comprises the steps of:

(a) determining initial collections of data stored in said authentication server; and

(b) customizing said collections of data stored in said authentication server.

11. The method of claim 10, further comprising the steps of:

(iv) assigning a unique computer ID to each computer in the enterprise;

(v) assigning a unique device ID to each said device in the enterprise;

(vi) determining which of said devices will be attached to which of said computers by assigning said device IDs to each of said computer IDs;

(vii) forming groups;

(viii) creating policies;

(ix) assigning one of said policies to each of said groups;

(x) assigning a unique user ID to each user who needs to be authenticated;

(xi) putting each of said user IDs into one of said groups; and

(xii) storing said policies, said groups, said device IDs, said user IDs and said computer IDs in said authentication server.

12. A method for allowing a user to access enterprise resources, the method comprising the steps of:

(1) implementing a policy on an authentication server, wherein the policy sets forth a plurality of guidelines for determining whether to authenticate at least one user and allow the at least one user to gain access to the enterprise resources, wherein at least one guideline establishes at least one predetermined qualification necessary for the at least one user to attain to pass the policy, and wherein the policy is formed by selecting one or more said devices that the user must be tested on in order to gain access to the enterprise resources;

(2) requiring the at least one user to establish authentication using at least two devices associated with the policy, wherein

(i) if the policy is an OR policy, then requiring the user to establish authentication on only one of the at least two devices;

(ii) if the policy is an AND policy, then requiring the user to establish authentication on all of the at least two devices;

(iii) if the policy is a CONTINGENT policy, then requiring the user to exceed a minimum threshold associated with a first device or, if the user exceeds a contingent threshold associated with the first device, then requiring the user to exceed a minimum threshold associated with a second device;

(iv) if the policy is a RANDOM policy, then requiring the user to establish authentication on a randomly selected device from the at least two devices;

or

(v) if the policy is a THRESHOLD policy, then requiring the user to exceed a total threshold value for the at least two devices;

(3) once the at least one user attempts to attain the at least one predetermined qualification using the at least two devices, then;

(a) allowing the user to proceed in attempting to pass any remaining qualifications of the policy, or

(b) determining that the at least one user has failed the policy;

(4) once the user has attains the at least one qualification, then determining that the at least one user is authenticated; and

(5) allowing the at least one user to access the enterprise resources.

13. The method of claim 12, further comprising placing the user within a group, wherein said group defines a set of users with a common characteristic or access privileges.

14. The method of claim 12, wherein step (1) comprises the steps of:

(a) determining initial collections of data stored in said authentication server; and

(b) customizing said collections of data stored in said authentication server.

15. The method of claim 14, wherein step (a) comprises the steps of:

(i) assigning a unique computer ID to each computer in the enterprise;

(ii) assigning a unique device ID to each said device in the enterprise;

(iii) determining which of said devices will be attached to which of said computers by assigning said device IDs to each of said computer IDs;

(iv) forming groups;

(v) creating policies;

(vi) assigning one of said policies to each of said groups;

(vii) assigning a unique user ID to each user who needs to be authenticated;

(viii) putting each of said user IDs into one of said groups; and

(ix) storing said policies, said groups, said device IDs, said user IDs and said computer IDs in said authentication server.