Authenticator centralization and protection including selection of authenticator type based on authentication policy

A method for an authentication server to authenticate a user, comprising:

• storing, in at least one memory of the authentication server, a first plurality of user credentials obtained by the authentication server from a user device associated with the user, wherein the first plurality of user credentials;
• comprise one or more biometric-type parameters, one or more possession-type parameters, or one or more knowledge base-type parameters, or any combination thereof, and
• do not comprise an identification of the user;
• utilizing a processor coupled to the at least one memory:
• receiving, by the authentication server from an enterprise server, a request to authenticate the user, wherein the request:
• does not identify the user, and
• does not include an identification of which at least one of the first plurality of user credentials is to be used to authenticate the user;
• obtaining, by the authentication server from the user device, an authentication parameter, wherein:
• the authentication parameter is based, at least in part, on an enterprise policy on the enterprise server,
• the authentication parameter is derived, at least in part, from a device ID,
• the device ID is bound to hardware of the user device, and
• the device ID comprises a parameter that uniquely identifies the user device;
• and
• responsive to selecting, by the authentication server, for comparison a one or more of the first plurality of user credentials based, at least in part, on the enterprise policy, authenticating, by the authentication server, the user, at least in part, via a comparison of the obtained authentication parameter with the one or more of the first plurality of user credentials.

An article comprising:

• a non-transitory storage medium, having instructions encoded thereon, which, when executed by an authentication server having at least one processor coupled to at least one memory device, are to:
• store, via the at least one memory device, a first plurality of user credentials received from a user device associated with a user, wherein the first plurality of user credentials:
• comprise one or more biometric-type parameters, one or more possession-type parameters, or one or more knowledge base-type parameters, or any combination thereof, and
• do not comprise identity related information of the user;
• receive, by the authentication server from the enterprise server, a request to authenticate the user, wherein the request:
• does not identify the user, and
• does not include an identification of which at least one of the first plurality of user credentials is to be used to authenticate the user;
• obtain, by the authentication server from the user device, an authentication parameter, wherein:
• the authentication parameter is based, at least in part, on an enterprise policy on the enterprises server,
• the authentication parameter is derived, at least in part, from a device ID,
• the device ID is bound to hardware of the user device, and the device ID comprises a parameter that uniquely identifies the user device;
• and to
• responsive to selecting, by the authentication server, for comparison a one or more of the first plurality of user credentials based, at least in part, on the enterprise policy, authenticate, by the authentication server, the user at least in part via a comparison of the obtained authentication parameter with the one or more of the first plurality of user credentials.