Multi-tiered user authentication methods

A computer program product stored on a computer readable medium, which is not a propagated signal, and loadable into the internal memory of a digital computer, comprising software code portions, when said program is run on a computer, for performing a method, comprising:

• assigning, to each of a plurality of possible authentication methods in an authentication method library, a contribution value, wherein each contribution value is a weighted score that is specific to an associated authentication method;
• initiating, in response to a request by a user for access to an area of a computer system, an authentication session with the user by determining a threshold contribution value corresponding to the area to be exceeded for authentication to occur;
• constructing, in response to the request, a chain of authentication methods that is specific to the request and has a plurality of authentication methods selected from the authentication method library of available authentication methods in order to provide an aggregate contribution value from a combination of contribution values of the selected ones of the authentication methods which exceeds the threshold contribution value corresponding to the area, such that a first chain dynamically constructed in response to a first request to access the area has different authentication methods from a second chain dynamically constructed in response to a second request to access the area, wherein the first chain dynamically constructed and the second chain dynamically constructed are done at run time;
• and
• commencing execution of the chain with an aim of reaching the threshold contribution value,
• wherein the contribution value of each associated authentication method is dynamically adjusted at run time, so that the chain uses current amounts for the combined contribution values of each authentication method,
• wherein the contribution value of an associated authentication method is dynamically adjusted at run time based on authentication methods selected to form existing links in the chain.

A computer implemented system for providing user authentication to a session manager responsible for managing a user session with an application, comprising:

• a memory comprising instructions;
• a bus coupled to the memory;
• and
• a processing unit coupled to the bus that when executing the instructions causes the system to:
• assign, to each of a plurality of possible authentication methods in an authentication method library, a contribution value, wherein each contribution value is a weighted score that is specific to an associated authentication method;
• receive from the session manager an authentication request relating to a user request to carry out a task that accesses an area of a computer system within the session and to reply to the authentication request with a pass/fail result;
• determine a threshold contribution value needed to permit the user to carry out the task based on the area;
• carry out, in response to the authentication request, an authentication with the user to obtain an aggregate contribution value and to determine a pass or fail of the user authentication conditional on the aggregate contribution value respectively exceeding or not the threshold contribution value by constructing a chain of authentication methods that is specific to the request and has a plurality of authentication methods selected from the authentication method library of available authentication methods in order to provide an aggregate contribution value a combination of combined contribution values of the selected ones of the authentication methods which exceeds the threshold contribution value corresponding to the area, such that a first chain dynamically constructed in response to a first request to access the area has different authentication methods from a second chain dynamically constructed in response to a second request to access the area, wherein the first chain dynamically constructed and the second chain dynamically constructed are done at run time;
• and
• commence execution of the chain with an aim of reaching the threshold contribution value,
• wherein the contribution value of each associated authentication method is dynamically adjusted at run time, so that the chain uses current amounts for the combined contribution values of each authentication method,
• wherein the contribution value of an associated authentication method is dynamically adjusted at run time based on authentication methods selected to form existing links in the chain.