# US 10,455,025 B2 · Multi-factor authentication > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,455,025 B2 - Document ID: US10455025B2 - Status: Granted - Kind: B2 - Application number: 15/226,499 - Filed: 2016-08-02 - Published: 2018-02-08 - Granted: 2019-10-22 - Earliest claimed: 2016-08-02 - Assignees: Micro Focus Software Inc. - Applicants: Micro Focus Software Inc. - Inventors: Lloyd Leon Burch; Gulshan Govind Vaswani; Sureshkumar Thangavel; Rik Peters - Web page: https://patentgrep.com/patent/US10455025B2 ## CPC - H04L 67/14: Session management (for real-time applications in data packet communications networks H04L65/1066) - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/18: {using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215)} - H04L 2463/082: applying multi-factor authentication - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An authenticated session with a remote system is established and identified through an authentication token for the session. During that session, a resource is accessed requiring additional authentication beyond what the authentication token was originally authorized for. Out-of-band processing from the existing session performs the additional authentication and permission from the authentication token are upgraded to include permissions for accessing the resource during the session. The resource is accessed during the session with the authentication token having the upgraded permissions. ## Claims ### Claim 1 A method, comprising: issuing a token to a first device operated by a principal for a session between the principal and a service by providing the token as an authentication token for the session when the principal authenticates for access to the service and linking the token to session access rights for the session; obtaining a session key to access the session between the principal and the service, and obtaining a hook to a principal service of the first device; receiving a request from the service to validate the token for principal access to a resource of the service during the session and determining that the session access rights lacks permission to access the resource during the session, wherein the service is executed on a second device; establishing an out-of-band communication channel with the principal service of the first device using the hook; verifying a credential provided over the out-of-band communication channel from the principal service of the first device; and upgrading permissions associated with the session access rights linked to the token and authorizing the principal to access the resource on the second device during the session based on verifying the credential and by using the session key and without changing the token. ### Claim 2 (depends on 1) The method of claim 1, wherein issuing further includes causing the principal service to be instantiated on the first device associated with the principal in response to issuing the token. ### Claim 3 (depends on 2) The method of claim 2, wherein obtaining further includes receiving the hook as a link to the principal service in response to issuing the token after the principal service is instantiated on the first device and receiving the link from the principal service. ### Claim 4 (depends on 1) The method of claim 1, wherein issuing further includes performing a first factor authentication on the principal for establishing the session between the principal and the service. ### Claim 5 (depends on 1) The method of claim 1, wherein establishing further includes establishing the out-of-band communication channel by pushing a notification to the principal service using the hook. ### Claim 6 (depends on 1) The method of claim 1, wherein establishing further includes establishing the out-of-band communication channel in response to a status request received from the principal service. ### Claim 7 (depends on 1) The method of claim 1, wherein establishing further includes maintaining the out-of-band communication channel while the session remains active between the principal and the service. ### Claim 8 (depends on 1) The method of claim 1, wherein establishing further includes instructing the principal service to obtain a credential type associated with the credential from the principal over the out-of-band communication channel. ### Claim 9 (depends on 8) The method of claim 8, wherein instructing further includes determining the credential type based on evaluation of a policy associated with the resource. ### Claim 10 (depends on 1) The method of claim 1, wherein verifying further includes notifying the service that the token presented is authorized to access the resource during the session. ### Claim 11 A method, comprising: receiving, on a principal device, a token as an authentication taken for an initiated session between a principal and a service that executes on a service device, wherein receiving further includes receiving the token from an identity provider device that executes an identity provider; notifying, by the principal device, the identity provider over an out-of-band communication Channel of the token and the session by providing the identity provider a session key for the session, the token, and a hook to interact with the method over the out-of-band communication channel; obtaining, by the principal device, an instruction from the identity provider over the out-of-band communication channel to obtain a credential from the principal during the session; interacting, by the principal device, with the principal for obtaining the credential; and providing, by the principal device, the credential to the identity provider over the out-of-band communication channel for the identity provider to upgrade existing permissions associated with the token during the session without changing the token based on verification of the credential by the identity provider that was processed over the out-of-band communication channel during the session. ### Claim 12 (depends on 11) The method of claim 11, wherein receiving further includes receiving the token from the identity provider when the identity provider authenticates the session using a first factor credential provided by the principal. ### Claim 13 (depends on 11) The method of claim 11, wherein obtaining further includes receiving the instruction in response to a push notification sent from the identity provider over the out-of-band communication channel. ### Claim 14 (depends on 11) The method of claim 11, wherein obtaining further includes receiving the instruction in response to a request sent to the identity provider over the out-of-band communication channel. ### Claim 15 (depends on 11) The method of claim 11, wherein obtaining further includes initiating an interface window on the principal device being operated by the principal in response to obtaining the instruction. ### Claim 16 (depends on 15) The method of claim 15, wherein initiating further includes customizing the interface window for obtaining the credential from the principal as a specific credential type identified in the instruction. ### Claim 17 (depends on 11) The method of claim 11, wherein obtaining further includes initiating a device driver on the principal device being operated by the principal in response to the instruction, wherein the device driver associated with a peripheral device that is interfaced to the principal device and the peripheral device is equipped for obtaining the credential from the principal. ### Claim 18 A device, comprising: a hardware processor; and a non-transitory computer-readable storage medium including executable instructions executable by the hardware processor to: provide a token as an authentication token for a principal that operates a principal device and a service that executes on a service device to establish a session with one another using a first set of permissions, wherein the token is linked to the first set of permissions; obtain a session key for the session and obtain a hook to a principal service that executes on the principal device; utilize a back channel of communication to the principal service using the hook to obtain a credential for the principal during the session when the principal attempts to access a resource during the session that the first set of permissions lack access rights to access for the session and upgrade the first set of permissions to a second set of permissions for the session using the session key without changing the token for the session when the credential provided over the back channel is successfully validated. ### Claim 19 (depends on 18) The device of claim 18, wherein the non-transitory computer-readable storage medium further includes instructions executable by the hardware processor to: authenticate the principal for the session as a first factor authentication and provide the token based on the first set of permissions; and authenticate the principal for the upgraded second set of permissions as a second factor authentication based on validation of the credential over the back channel.