Methods and authentication server for authentication of users requesting access to a restricted data resource using authorized approvers

A method performed by an authentication server for authentication of users requesting access to a restricted data resource from a communication device, the authentication server being situated in the restricted data resource, the method comprising:

• receiving from the communication device, a username and a password received from a user of the communication device in response to a request to enter a username and password for accessing the restricted data resource;
• triggering checking whether the username received from the communication device matches a stored username of any account of the restricted data resource and whether the password received from the communication device matches a stored password for the account matching the username received from the communication device;
• sending, to the communication device and when the password received from the communication device matches the stored password for the account matching the username received from the communication device,
• a request to enter an approver ID corresponding to an approver authorized to approve the user of the communication device access to the restricted data resource;
• receiving, from the communication device, an approver ID received from the user in response to the request to enter an approver ID;
• checking whether the approver ID received from the communication device matches any of a plurality of authorized approver IDs, each of the plurality of authorized approver IDs being associated with an approver device and a corresponding approver, and the approver being a user associated with an approver device different from the user of the communication device;
• sending, to an approver device associated with the approver ID received from the communication device, an approval request whether the approver wants to approve access to the restricted data resource for the user of the communication device, the approval request comprising an ID of the user, when the approver ID received from the communication device matches any of the plurality of authorized approver IDs;
• receiving, from the approver device and in response to the approver device receiving input from the approver that the approval request is to be accepted, an accept indication that the approver has accepted the approval request;
• and
• granting, in response to receiving the accept indication, the user of the communication device access to the restricted data resource,
• wherein communication between the communication device and the authentication server passes via the access server, and the Remote Authentication Dial-In User Services (RADIUS) protocol is used at least for the communication between the authentication server and the access server, and wherein the user does not have access to the approver device.

An authentication server configured for authentication of users requesting access to a restricted data resource from a communication device, the authentication server being situated in the restricted data resource, the authentication server comprising a processing circuitry and a memory, said memory containing instructions executable by said processing circuitry, whereby the authentication server is operative for:

• receiving from the communication device, a username and a password received from a user of the communication device in response to a request to enter a username and password for accessing the restricted data resource;
• triggering checking whether the username received from the communication device matches a stored username of any account of the restricted data resource and whether the password received from the communication device matches a stored password for the account matching the username received from the communication device;
• sending, to the communication device and when the password received from the communication device matches the stored password for the account matching the username received from the communication device, a request to enter an approver ID corresponding to an approver authorized to approve the user of the communication device access to the restricted data resource;
• receiving, from the communication device, an approver ID received from the user in response to the request to enter an approver ID;
• checking whether the approver ID received from the communication device matches any of a plurality of authorized approver IDs, each of the plurality of authorized approver IDs being associated with an approver device and a corresponding approver, and the approver being a user of an approver device different from the user of the communication device;
• sending, to an approver device associated with the approver ID received from the communication device, an approval request whether the approver wants to approve access to the restricted data resource for the user of the communication device, the approval request comprising an ID of the user, when the approver ID received from the communication device matches any of the plurality of authorized approver IDs;
• receiving, from the approver device and in response to the approver device receiving input that the approval request is to be accepted, an accept indication that the approver has accepted the approval request;
• and
• granting, in response to receiving the accept indication, the user of the communication device access to the restricted data resource,
• wherein communication between the communication device and the authentication server passes via the access server, and the Remote Authentication Dial-In User Services (RADIUS) protocol is used at least for the communication between the authentication server and the access server, and wherein the user does not have access to the approver device.