Authentication based on previous authentications

• US 8,726,347 B2
• Filed: 04/27/2007
• Issued: 05/13/2014
• Est. Priority Date: 04/27/2007
• Status: Expired due to Fees

• Current Assignee: Kyndryl Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Hamilton, Rick A. II, O'Connell, Brian M., Pavesi, John R., Walker, Keith R.
• Primary Examiner(s): Pham, Luu
• Assistant Examiner(s): Le, Canh
• Application Number:
  US11/741,516
• Publication Number:
  US 20080271117A1
• Time in Patent Office: 2,573 Days
• Field of Search: 726 1- 5, 726/11, 726/13, 713182-186, 713/150, 713/155, 713/166, 709227-229
• US Class Current: 726/3
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Generally speaking, systems, methods and media for authenticating a user to a server based on previous authentications to other servers are disclosed. Embodiments of a method for authenticating a user to a server may include receiving a request to authenticate the user to the server and determining whether authenticating the user requires matching an authentication plan. If a plan is required, the method may also include accessing a stored authentication plan with authentication records each having expected information relating to user access to a different server. The method may also include receiving an indication of the user'"'"'s current authentication plan from an authentication store where the plan has authorization records each having current information relating to user access. Embodiments of the method may also include comparing the stored authentication plan with the received current authentication plan to determine whether they match and, in response to a match, authenticating the user.

Claims

1. A method for authenticating a user to a target server, the method comprising the steps of:

receiving, by a computer system having at least one processor coupled to memory, a request from a user computer system to authenticate the user for access to a target server at level N of N levels, wherein N is a positive integer of at least 2, wherein N target servers are sequentially nested at respective levels of the N levels denoted as levels 1 through N sequenced from lowest level to highest level, and wherein authentication of the user for access to the target server at level N requires prior authentication of the user for access to the target server at level 1 if N is 2 or for access to the N−

1 target servers at the respective levels 1 through N−

1 if N is at least 3;

determining, by the computer system, that an authentication plan is required to authenticate the user for access to the target server at level N, wherein the authentication plan comprises one or more defined authentication steps that must be performed before the user is allowed to authenticate for access to each target server at the N levels;

in response to the step of determining that the authentication plan is required to authenticate the user for access to the target server at level N, accessing, by the computer system, a stored authentication plan associated with the user, the stored authentication plan having one or more authentication records each having expected information relating to authentication of the user for access to the N−

1 target servers at the respective levels 1 through N−

1;

receiving, by the computer system, a current authentication plan for the user from a storage device, the current authentication plan having one or more authentication records each having current information relating to authentication of the user for access to the N−

1 target servers at the respective levels 1 through N−

1;

comparing, by the computer system, the stored authentication plan with the current authentication plan to determine, based on analyzing authentication events, whether there is at least a partial match between the stored authentication plan and the current authentication plan; and

authenticating, by the computer system, the user at level N if said comparing the stored authentication plan with the current authentication plan determines that there is at least the partial match between the stored authentication plan and the current authentication plan.

2. The method of claim 1, further comprising in response to the step of determining that the authentication plan is required to authenticate the user for access to the target server at level N, transmitting a request for the current authentication plan to the user computer system.

3. The method of claim 1, further comprising determining, by the computer system, that there is a mismatch between the stored authentication plan and the current authentication plan, and in response, resolving, by the computer system, the mismatch.

4. The method of claim 3, wherein the step of resolving the mismatch comprises requiring additional authentication information.

5. The method of claim 3, wherein the step of resolving the mismatch comprises invoking a method to modify or create a new authentication plan.

6. The method of claim 1, wherein each of the one or more authentication records of the authentication plan and the current authentication plan comprise a server identifier and an authentication event fact.

11. The method of claim 1, further comprising:

before the step of receiving the current authentication plan, receiving, by the computer system, an indication of existence of the current authentication plan.

12. The method of claim 1, wherein the at least the partial match is an exact match.

13. The method of claim 1, further comprising the step of:

in response to determining that there is at least the partial match between the stored authentication plan and the current authentication plan, authenticating, by the computer system, the user to the target server at level N.

18. The method of claim 1, wherein N is at least 3.

7. A computer program product for authenticating a user to a target server, the computer program product comprising:

one or more computer readable storage devices;

program instructions, stored on at least one of the one or more storage devices, to receive a request from a user computer system to authenticate the user for access to a target server at level N of N levels, wherein N is a positive integer of at least 2, wherein N target servers are sequentially nested at respective levels of the N levels denoted as levels 1 through N sequenced from lowest level to highest level, and wherein authentication of the user for access to the target server at level N requires prior authentication of the user for access to the target server at level 1 if N is 2 or for access to the N−

1 target servers at the respective levels 1 through N−

1 if N is at least 3;

program instructions, stored on at least one of the one or more storage devices, to determine that an authentication plan is required to authenticate the user for access to the target server at level N, wherein the authentication plan comprises one or more defined authentication steps that must be performed before the user is allowed to authenticate for access to each target server at the N levels;

program instructions, stored on at least one of the one or more storage devices, to, in response to determining that the authentication plan is required to authenticate the user for access to the target server at level N, accessing a stored authentication plan associated with the user, the stored authentication plan having one or more authentication records each having expected information relating to authentication of the user for access to the N−

1 target servers at the respective levels 1 through N−

1;

program instructions, stored on at least one of the one or more storage devices, to receive, a current authentication plan for the user from a storage device, the current authentication plan having one or more authentication records each having current information relating to authentication of the user for access to the N−

1 target servers at the respective levels 1 through N−

1;

program instructions, stored on at least one of the one or more storage devices, to compare the stored authentication plan with the current authentication plan to determine, based on analyzing authentication events, whether there is at least a partial match between the stored authentication plan and the current authentication plan; and

program instructions, stored on at least one of the one or more storage devices, to authenticate the user at level N if a comparison of the stored authentication plan with the current authentication plan determines that there is at least the partial match between the stored authentication plan and the current authentication plan.

8. The computer program product of claim 7, further comprising program instructions, stored on at least one of the one or more storage devices, to, in response to determining that the authentication plan is required to authenticate the user for access to the target server at level N, transmit a request for the current authentication plan to the user computer system.

9. The computer program product of claim 7, further comprising program instructions, stored on at least one of the one or more storage devices, to, determine that there is a mismatch between the stored authentication plan and the current authentication and, in response, to resolve the mismatch.

10. The computer program product of claim 9, wherein the program instructions to resolve the mismatch require additional authentication information.

14. The computer program product of claim 7, further comprising program instructions, stored on at least one of the one or more storage devices, to, before receiving the current authentication plan, receive an indication of existence of the current authentication plan.

15. The computer program product of claim 9, wherein the program instructions to resolve the mismatch invoke a method to modify the current authentication plan or create a new authentication plan.

16. The computer program product of claim 7, wherein each of the one or more authentication records of the authentication plan and the current authentication plan comprise a server identifier and an authentication event fact.

17. The computer program product of claim 7, wherein the at least the partial match is an exact match.

19. The computer program product of claim 7, wherein N is at least 3.