System and method for authenticating users in a computer network

• US 8,171,288 B2
• Filed: 08/08/2005
• Issued: 05/01/2012
• Est. Priority Date: 07/06/1998
• Status: Active Grant

• Current Assignee: Imprivata Incorporated, SAFLINK Corp.
• Original Assignee: Imprivata Incorporated
• Inventors: Brown, Timothy J., Jensen, Gregory C., Rivers, Rodney, Nelson, Dan
• Primary Examiner(s): MOORTHY, ARAVIND K
• Application Number:
  US11/199,432
• Publication Number:
  US 20050273866A1
• Time in Patent Office: 2,458 Days
• Field of Search: 726/1, 726 4- 6, 726/17, 726/26, 713/166, 713/168, 713/170, 713/182, 713/186
• US Class Current: 713/168
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06Q 20/3672 initialising or reloading thereof
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231

Abstract

A rule based biometric user authentication method and system in a computer network environment is provided. Multiple authentication rules can exist in the computer network. For example, there may be a default system-wide rule, and a rule associated with a particular user trying to log in. There may be other rules such as one associated with a remote computer from which the user is logging in, one associated with a group to which the user belongs, or one associated with a system resource to which the user requires access such as an application program or a database of confidential information. An order of precedence among the rules is then established which is used to authenticate the user.

Claims

1. A computer-implemented method of controlling access to a computer resource in a computer environment, comprising:

assigning by an authentication server a first order of precedence as between at least first and second authentication rules for a first set of conditions pertaining to a user desiring access the resource;

assigning by the authentication server a second order of precedence as between at least the first and second authentication rules for a second set of conditions pertaining to the user desiring access the resource;

based on the presence of the first or second set of conditions, assigning-one of the first order of precedence and second order of precedence to the first authentication rule and assigning the other of the first order of precedence and second order of precedence to the second authentication rule; and

enabling the user to attempt authentication to the authentication server in accordance with at least one of the authentication rules applied in the assigned orders of precedence, and accordingly access to the resource if the conditions of at least one of the authentication rules is satisfied.

2. The method of claim 1, further comprising identifying at least the first and second set of conditions.

3. The method of claim 1, further comprising determining by which of the at least first and second authentication rules the user should be authenticated.

4. The method of claim 1, further comprising setting at least the first order of precedence as between the first and second authentication rules.

5. A computer-implemented method of controlling access to a computer resource in a computer environment, comprising:

assigning by an authentication server a first order of precedence as between a first plurality of authentication rules for a first set of conditions pertaining to a user desiring access the resource;

assigning by the authentication server a second order of precedence as between a second plurality of authentication rules for a second set of conditions pertaining to the user desiring access to the resource;

based on the presence of the first or second set of conditions, assigning one of the first order of precedence and second order of precedence to the first plurality of authentication rules and assigning the other of the first order of precedence and second order of precedence to the second plurality of authentication rules; and

enabling the user to attempt authentication to the authentication server in accordance with at least one of the pluralities of authentication rules applied in the assigned orders of precedence, and accordingly access to the resource if the conditions of at least one of the pluralities of authentication rules is satisfied.

6. The method of claim 5, wherein enabling the user to attempt access further comprises enabling the attempt wherein the first and second pluralities include different numbers of authentication rules.

7. The method of claim 5, wherein enabling the user to attempt access further comprises enabling the attempt wherein the first and second pluralities include the same number of authentication rules.

8. The method of claim 5, wherein enabling the user to attempt access further comprises enabling the attempt wherein the first and second pluralities include dissimilar authentication rules.