US 8,949,953 B1Granted

Brokering multiple authentications through a single proxy

AssigneeEMC Corporation

InventorsAnton Khitrenovich, Oleg Freylafert, Yedidya Dotan, Lawrence N. Friedman, Karl Ackerman

Life of this patent

Estimating the term…

Loading patent…

Abstract

A method includes (a) receiving, from an application server, a login message for a user, the login message including a user credential for a credential-based authentication (CBA), (b) forwarding the user credential to a CBA server for the CBA, (c) in response, receiving, an authentication decision message from the CBA server, (d) sending decision information from the authentication decision message received from the CBA server to a risk-based authentication (RBA) server, the RBA server being distinct from the CBA server, the decision information to be used by the RBA server in performing RBA authentication decisions, (e) if the authentication decision message is positive, then sending a challenge message to the application server to initiate RBA to be performed by the RBA server supplementary to the CBA, and (f) if the authentication decision message is negative, then sending a rejection message to the application server.

Claims19

Dependent claims

A method performed by a computing device, the method comprising:

receiving, by the computing device from an application server, a login message for a user attempting to gain access to a service provided by the application server, the login message including a user credential for a credential-based authentication (CBA);
forwarding the user credential by the computing device to a CBA server for the CBA;
in response to forwarding, receiving, by the computing device, an authentication decision message from the CBA server;
sending decision information from the authentication decision message received from the CBA server by the computing device to a risk-based authentication (RBA) server, the RBA server being distinct from the CBA server, the decision information to be used by the RBA server in performing RBA decisions;
if the authentication decision message is positive, then sending a challenge message by the computing device to the application server to initiate RBA to be performed by the RBA server supplementary to the CBA;
and
if the authentication decision message is negative, then sending a rejection message by the computing device to the application server,
wherein the method further includes:
receiving, by the computing device, a challenge response message from the application server in response to sending the challenge message to the application server to initiate RBA to be performed by the RBA server supplementary to the CBA;
verifying, by the computing device, independently of the application server, what the result of the RBA was;
and
if and only if the verification indicates that the RBA was successful, then providing, by the computing device, the application server with a positive authentication of the user for access to the service provided by the application server,
and wherein verifying what the result of the RBA was independently of the application server includes retrieving an RBA decision message from the RBA server after an RBA adapter has sent user-specific details to the RBA server, the user-specific details including details about the user not available to the application server.

10 more elements

An apparatus comprising:

a network interface;
memory;
and
a controller, the controller including hardware and software, the controller being configured to:
receive, via the network interface, from an application server, a login message for a user attempting to gain access to a service provided by a remote application server, the login message including a user credential for a credential-based authentication (CBA);
forward, via the network interface, the user credential to a CBA server for the CBA;
in response to forwarding, receive, via the network interface, an authentication decision message from the CBA server;
send, via the network interface, decision information from the authentication decision message received from the CBA server to a risk-based authentication (RBA) server, the RBA server being distinct from the CBA server, the decision information to be used by the RBA server in performing RBA decisions;
if the authentication decision message is positive, then send, via the network interface, a challenge message to the application server to initiate RBA to be performed by the RBA server supplementary to the CBA;
and
if the authentication decision message is negative, then send, via the network interface, a rejection message from the computing device to the application server,
wherein the controller is further configured to:
receive, via the network interface, a challenge response message from the application server in response to sending the challenge message to the application server to initiate RBA to be performed by the RBA server supplementary to the CBA;
verify, via the network interface, independently of the application server, what the result of the RBA was;
and
if and only if the verification indicates that the RBA was successful, then provide the application server with a positive authentication of the user for access to the service provided by the application server
and wherein verifying what the result of the RBA was independently of the application server includes retrieving an RBA decision message from the RBA server after an RBA adapter has sent user-specific details to the RBA server, the user-specific details including details about the user not available to the application server.

14 more elements

A system comprising:

a client computer running a login client, the client computer being configured to interact with a user;
an application server configured to:
receive a login request message from the login client running on the client computer, the login request message having a user credential provided by the user upon attempting to gain access to a service provided by the application server;
and
provide the service to the client computer upon successful authentication of the user;
an authentication broker computer configured to:
receive the user credential from the application server;
forward the user credential to a credential-based authentication (CBA) server for CBA;
in response to forwarding, receive an authentication decision message from the CBA server;
send decision information from the authentication decision message received from the CBA server to a risk-based authentication (RBA) server, the RBA server being distinct from the CBA server, the decision information to be used by the RBA server in performing RBA decisions;
if the authentication decision message is positive, then send a challenge message to the application server to initiate RBA to be performed by the RBA server supplementary to the CBA;
and
if the authentication decision message is negative, then send a rejection message to the application server;
and
an RBA adapter;
wherein the application server is configured to:
deny the service to the client computer upon receiving a rejection message from the authentication broker computer;
and
send a redirect command to the login client running on the client computer upon receiving a challenge message from the authentication broker computer to initiate RBA supplementary to the CBA;
wherein the RBA adapter is configured to:
collect user-specific details including details about the user not available to the application server upon the login client being redirected to the RBA adapter;
send the user-specific details to the RBA server;
receive a risk-based decision message from the RBA server in response to sending the user-specific details to the RBA server;
inform the authentication broker computer of the risk-based decision;
and
direct the login client running on the client computer to respond to the application server.

23 more elements

Dependencies are inferred from the claim text.