US 9,544,147 B2Granted

Model based multi-tier authentication

AssigneeMicrosoft Technology Licensing, LLC

InventorsYordan I. Rouskov, Wei-Qiang Michael Guo, Orville Charles McDonald, Ramu Movva, Kyle Stapley Young, Kok Wai Chan

Life of this patent

Estimating the term…

patentgrep

Loading patent…

Abstract

Authentication is widely used to protect consumer data and computing services, such as email, document storage, and online banking. Current authentication models, such as those employed by online identity providers, may have limited options and configurations for authentication schemes. Accordingly, as provided herein, a model based authentication scheme may be configured based upon a policy and/or an authentication mechanism list. The policy may define the target resource, a user, a group the user belongs to, devices used to connect to the target resource, a service owning the target resource, etc. The authentication mechanism list may comprise predefined authentication mechanisms and/or user plug-in authentication mechanisms (e.g., user created authentication mechanism). Once the authentication scheme is configured, it may be enforced upon authentication requests from a user. Feedback may be provided to the user based upon patterns of usage of the target resource.

Claims19

Dependent claims

A method, implemented at a computer system that includes one or more processors, for configuring an authentication scheme for a client device, the method comprising:

receiving an authentication request from a client device, the authentication request requesting access by a user to a resource;
accessing an authentication mechanism list comprising a plurality of authentication mechanisms that are available for authenticating the user for access to the resource;
accessing a user access model that models a pattern of usage of the resource by the user;
accessing a mode of connection policy defining access to one or more resources via one or more modes;
based at least on accessing the authentication mechanism list, the user access model, and the mode of connection policy, configuring an authentication scheme that includes one or more of the plurality of authentication mechanisms that are configured for authenticating the user to access the resource, the configuring including updating the authentication scheme to include the one or more authentication mechanisms that are configured for authenticating the user to access the resource, based on the pattern of usage of the resource by the user;
sending a response to the client device, the response recommending the updated authentication scheme to the user;
and
enabling access to the resource based on the recommended updated authentication scheme.

5 more elements

A system for configuring an authentication scheme, the system comprising:

one or more processing units;
and
memory comprising instructions that when executed by at least some of the one or more processing units, cause the system to perform at least the following:
receive an authentication request from a client device, the authentication request requesting access by a user to a resource;
access an authentication mechanism list comprising a plurality of authentication mechanisms that are available for authenticating the user for access to the resource;
access a user access model that models a pattern of usage of the resource by the user;
access a mode of connection policy defining access to one or more resources via one or more modes;
based at least on accessing the authentication mechanism list, the user access model, and the mode of connection policy, configure an authentication scheme that includes one or more of the plurality of authentication mechanisms that are configured for authenticating the user to access the resource, the configuring including updating the authentication scheme to include the one or more authentication mechanisms that are configured for authenticating the user to access the resource, based on the pattern of usage of the resource by the user;
send a response to the client device, the response recommending the updated authentication scheme to the user;
and
enable access to the resource based on the recommended updated authentication scheme.

8 more elements

A computer-readable hardware storage device comprising computer-executable instructions, which when executed at least in part via a processing unit on a computer, causes the computer to perform at least the following:

receive an authentication request from a client device, the authentication request requesting access by a user to a resource;
access an authentication mechanism list comprising a plurality of authentication mechanisms are available for authenticating the user for access to the resource;
access a user access model that models a pattern of usage of the resource by the user;
access a mode of connection policy defining access to one or more resources via one or more modes;
based at least on accessing the authentication mechanism list, the user access model, and the mode of connection policy, configure an authentication scheme that includes one or more of the plurality of authentication mechanisms that are configured for authenticating the user to access the resource, the configuring including updating the authentication scheme to include the one or more authentication mechanisms that are configured for authenticating the user to access the resource, based on the pattern of usage of the resource by the user;
send a response to the client device, the response recommending the updated authentication scheme to the user;
and
enable access to the resource based on the recommended updated authentication scheme.

5 more elements

Dependencies are inferred from the claim text.

Facts

Application: 12/470,656Filed 22 May 2009
Published: US 2010/0299716 A125 Nov 2010
Granted: 10 Jan 2017
Term ends: Not estimatedThe source records don’t support an estimate.

Classification12 codes

H04L 9/3234
Including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity…:…
G06F 21/42
User authentication: using separate channels for security data
H04L 9/3228
Using a predetermined code, e.g. password, passphrase or PIN: one-time or temporary data, i.e. information which is sent for every authentication…
H04L 9/3271
Including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity…: using…