US 11,962,596 B2Granted

Integrated multifactor authentication for network access control

AssigneeBank of America Corporation

InventorsShardul Vasudev Joshi, Abhishek Palahalli Manjunath

Life of this patent

Estimating the term…

Loading patent…

Abstract

A device configured to receive a connection request that includes device authentication credentials and to determine the user device passes authentication in response to identifying a device profile associated with the device authentication credentials. The device is further configured to receive user credentials for a first user and identify a first user identity that corresponds with the user credentials. The device is further configured to establish a first network connection with the user device, to send a token request to the user device, and to receive a token via the first network connection. The device is further configured to identify a second user identity based on the token, to determine the first user identifier matches the second user identifier, and to establish a second network connection for the user device, wherein the network connection enables the user device to access the network.

Claims14

Dependent claims

An access control device, comprising:

a memory operable to store:
device profiles identifying approved user devices for accessing a network, wherein each user device is associated with device authentication credentials;
and
user profiles identifying approved users for accessing the network, wherein each user is associated with user credentials;
and
a processor operably coupled to the memory, configured to:
receive a connection request from a user device, wherein the connection request comprises device authentication credentials for the user device;
identify a device profile for the user device that corresponds with the device authentication credentials;
determine that the user device passes authentication in response to identifying the device profile;
receive user credentials for a first user of the user device;
identify a first user identity of the first user using the user credentials for the first user;
establish a first network connection with the user device, wherein the first network restricts access to network resources;
send a token request to the user device via the first network connection, wherein the token request is sent by executing code to redirect a browser on the user device to a webpage;
receive a token from the webpage and via the first network connection in response to sending the token request to the user device, wherein the token is a unique value that is associated with the first user;
identify a second user identity of the first user obtained using the token;
determine that the first user identity of the first user matches the second user identity of the first user;
and
establish a second network connection for the user device, wherein the second network connection enables the user device to access the network resources that were restricted by the first network connection, wherein identifying the second user identity of the first user obtained using the token includes:
sending the token to an identity provider device that is configured to validate the token;
and
receiving the second user identity from the identity provider device after validating the token.

18 more elements

An integrated multifactor authentication method, comprising:

receiving a connection request from a user device, wherein the connection request comprises device authentication credentials for the user device;
identifying a device profile for the user device that corresponds with the device authentication credentials;
determining that the user device passes authentication in response to identifying the device profile;
receiving user credentials for a first user of the user device;
identifying a first user identity of the first user based on the user credentials for the first user;
establishing a first network connection with the user device, wherein the first network restricts access to network resources;
sending a token request to the user device via the first network connection, wherein sending the token request comprises executing code to redirect a browser on the user device to a webpage;
receiving a token from the webpage and via the first network connection in response to sending the token request to the user device, wherein the token is a unique value that is associated with the first user;
identifying a second user identity of the first user obtained using the token;
determining that the first user identity of the first user matches the second user identity of the first user;
and
establishing a second network connection for the user device, wherein the second network connection enables the user device to access the network resources that were restricted by the first network connection, wherein identifying the second user identity of the first user obtained using the token comprises:
sending the token to an identity provider device that is configured to validate the token;
and
receiving the second user identity from the identity provider device after validating the token.

12 more elements

A non-transitory computer-readable medium storing instructions that when executed by a processor cause the processor to:

receive a connection request from a user device, wherein the connection request comprises device authentication credentials for the user device;
identify a device profile for the user device that corresponds with the device authentication credentials;
determine that the user device passes authentication in response to identifying the device profile;
receive user credentials for a first user of the user device;
identify a first user identity of the first user based on the user credentials for the first user;
establish a first network connection with the user device, wherein the first network restricts access to network resources;
send a token request to the user device via the first network connection, wherein the token request is sent by executing code to redirect a browser on the user device to a webpage;
receive a token from the webpage and via the first network connection in response to sending the token request to the user device, wherein the token is a unique value that is associated with the first user;
identify a second user identity of the first user obtained using the token;
determine that the first user identity of the first user matches the second user identity of the first user;
and
establish a second network connection for the user device, wherein the second network connection enables the user device to access the network resources that were restricted by the first network connection, wherein identifying the second user identity of the first user obtained using the token comprises:
sending the token to an identity provider device that is configured to validate the token;
and
receiving the second user identity from the identity provider device after validating the token.

12 more elements

Dependencies are inferred from the claim text.