# US 9,882,914 B1 · Security group authentication > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,882,914 B1 - Document ID: US9882914B1 - Status: Granted - Kind: B1 - Application number: 14/631,644 - Filed: 2015-02-25 - Granted: 2018-01-30 - Earliest claimed: 2015-02-25 - Assignees: Workday, Inc. - Applicants: Workday, Inc. - Inventors: Christopher W. Co - Web page: https://patentgrep.com/patent/US9882914B1 ## CPC - H04L 63/105: {Multiple levels of security} - G06F 21/40: by quorum, i.e. whereby two or more security principals are required - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/104: {Grouping of entities} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - G06F 2221/2113: Multi-level security, e.g. mandatory access control - H04L 2463/082: applying multi-factor authentication - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system for security group authentication comprises an interface, an authentication level determiner, and an authenticator. The interface is for receiving a request from a user to perform an action. The authentication level determiner is for determining that a current authentication level for the user is not adequate for the action. The authenticator is for providing a request to authenticate a new authentication level to the user. The current authentication level and the new authentication level are associated with the user using a security group. ## Claims ### Claim 1 A system for security group authentication comprising: an interface for receiving a request from a user to perform an action; a hardware processor configured for: determining that a current authentication level for the user is not adequate to perform the action based at least in part on a current authentication type associated with the user, comprising: determining whether the action is permitted under a first set of access restrictions associated with the current authentication type associated with a security group associated with the user, wherein the first set of access restrictions is associated with a first security group, wherein a second set of access restrictions is associated with a second security group, wherein each factor associated with the first security group is the same or is more restrictive than each corresponding factor of the second security group, wherein a factor associated with the first security group is more restrictive than a corresponding factor of the second security group, and wherein the security group is determined based on the following factors: whether the user is an administrative user or a basic user, the basic user being more restrictive than the administrative user; a network associated with a login of the user from a login request, the network being a corporate network or a home network, the home network being more restrictive than the corporate network; and an allowed authentication type, the allowed authentication types including at least two of the following in order of most restrictive to least restrictive: username and password, single sign-on authentication, certificate authentication, or required two-factor authentication; and in response to a determination that the action is not permitted under the first set of access restrictions, determining that the current authentication level for the user is not adequate to perform the action, comprising: determining that the action is not permitted in response to a determination that the network is the home network and the user is logged in with the current authentication type; determining that a new authentication level for the user is adequate to perform the action, wherein the new authentication level for the user is associated with a different authentication type, wherein allowed authentication types associated with the security group include the current authentication type and a new authentication type, and wherein the determining that the new authentication level for the user is adequate to perform the action comprises: determining whether the action is permitted under the second set of access restrictions associated with the different authentication type associated with the security group associated with the user; and in response to a determination that the action is permitted under the second set of access restrictions, determining that the new authentication level for the user is adequate to perform the action, comprising: performing one or more of the following: logging onto the corporate network using the current authentication type to obtain the new authentication level to perform the action using the corporate network; or upgrading, via the home network, the current authentication type to a more restrictive authentication type by performing the new authentication type to obtain the new authentication level to perform the action using the home network; providing a request to authenticate the new authentication level to the user, wherein the current authentication level and the new authentication level are associated with the security group; and in response to a determination that authentication information is valid for the different authentication type, permitting the user to perform the action. ### Claim 2 (depends on 1) The system of claim 1, wherein determining that the current authentication level for the user is not adequate for the action is based at least in part on the network associated with the user. ### Claim 3 (depends on 1) The system of claim 1, wherein the security group comprises a set of authentication levels. ### Claim 4 (depends on 1) The system of claim 1, wherein the hardware processor is further configured for receiving the authentication information. ### Claim 5 (depends on 4) The system of claim 4, wherein the hardware processor is further configured for determining whether the authentication information is valid for the new authentication level. ### Claim 6 (depends on 5) The system of claim 5, wherein the processor is further configured for in response to a determination that the authentication information is not valid for the new authentication level, indicating that the new authentication level is not accessible. ### Claim 7 (depends on 5) The system of claim 5, wherein the processor is further configured for in response to a determination that the authentication information is valid for the new authentication level, indicating that the new authentication level is accessible. ### Claim 8 (depends on 7) The system of claim 7, wherein the processor is further configured for in response to a determination that the authentication information is valid for the new authentication level, upgrading a user authentication to the new authentication level. ### Claim 9 (depends on 8) The system of claim 8, wherein the processor is further configured for in response to a determination that the authentication information is valid for the new authentication level, providing an indication that the new authentication level is adequate for the action. ### Claim 10 (depends on 1) The system of claim 1, wherein the determining that a new authentication level for the user is adequate for the action is based at least in part on a set of access restrictions. ### Claim 11 A method for security group authentication, comprising: receiving a request from a user to perform an action; determining, using a hardware processor, that a current authentication level for the user is not adequate to perform the action based at least in part on a current authentication type associated with the user, comprising: determining whether the action is permitted under a first set of access restrictions associated with the current authentication type associated with a security group associated with the user, wherein the first set of access restrictions is associated with a first security group, wherein a second set of access restrictions is associated with a second security group, wherein each factor associated with the first security group is the same or is more restrictive than each corresponding factor of the second security group, wherein a factor associated with the first security group is more restrictive than a corresponding factor of the second security group, and wherein the security group is determined based on the following factors: whether the user is an administrative user or a basic user, the basic user being more restrictive than the administrative user; a network associated with a login of the user from a login request, the network being a corporate network or a home network, the home network being more restrictive than the corporate network; and an allowed authentication type, the allowed authentication types including at least two of the following in order of most restrictive to least restrictive: username and password, single sign-on authentication, certificate authentication, or required two-factor authentication; and in response to a determination that the action is not permitted under the first set of access restrictions, determining that the current authentication level for the user is not adequate to perform the action, comprising: determining that the action is not permitted in response to a determination that the network is the home network and the user is logged in with the current authentication type; determining that a new authentication level for the user is adequate to perform the action, wherein the new authentication level for the user is associated with a different authentication type, wherein allowed authentication types associated with the security group include the current authentication type and a new authentication type, and wherein the determining that the new authentication level for the user is adequate to perform the action comprises: determining whether the action is permitted under the second set of access restrictions associated with the different authentication type associated with the security group associated with the user; and in response to a determination that the action is permitted under the second set of access restrictions, determining that the new authentication level for the user is adequate to perform the action, comprising: performing one or more of the following: logging onto the corporate network using the current authentication type to obtain the new authentication level to perform the action using the corporate network; or upgrading, via the home network, the current authentication type to a more restrictive authentication type by performing the new authentication type to obtain the new authentication level to perform the action using the home network; providing a request to authenticate the new authentication level to the user, wherein the current authentication level and the new authentication level are associated with the security group; and in response to a determination that authentication information is valid for the different authentication type, permitting the user to perform the action. ### Claim 12 A computer program product for security group authentication, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for: receiving a request from a user to perform an action; determining, using a hardware processor, that a current authentication level for the user is not adequate to perform the action based at least in part on a current authentication type associated with the user, comprising: determining whether the action is permitted under a first set of access restrictions associated with the current authentication type associated with a security group associated with the user, wherein the first set of access restrictions is associated with a first security group, wherein a second set of access restrictions is associated with a second security group, wherein each factor associated with the first security group is the same or is more restrictive than each corresponding factor of the second security group, wherein a factor associated with the first security group is more restrictive than a corresponding factor of the second security group, and wherein the security group is determined based on the following factors: whether the user is an administrative user or a basic user, the basic user being more restrictive than the administrative user; a network associated with a login of the user from a login request, the network being a corporate network or a home network, the home network being more restrictive than the corporate network; and an allowed authentication type, the allowed authentication types including at least two of the following in order of most restrictive to least restrictive: username and password, single sign-on authentication, certificate authentication, or required two-factor authentication; and in response to a determination that the action is not permitted under the first set of access restrictions, determining that the current authentication level for the user is not adequate to perform the action, comprising: determining that the action is not permitted in response to a determination that the network is the home network and the user is logged in with the current authentication type; determining that a new authentication level for the user is adequate to perform the action, wherein the new authentication level for the user is associated with a different authentication type, wherein allowed authentication types associated with the security group include the current authentication type and a new authentication type, and wherein the determining that the new authentication level for the user is adequate to perform the action comprises: determining whether the action is permitted under the second set of access restrictions associated with the different authentication type associated with the security group associated with the user; and in response to a determination that the action is permitted under the second set of access restrictions, determining that the new authentication level for the user is adequate to perform the action, comprising: performing one or more of the following: logging onto the corporate network using the current authentication type to obtain the new authentication level to perform the action using the corporate network; or upgrading, via the home network, the current authentication type to a more restrictive authentication type by performing the new authentication type to obtain the new authentication level to perform the action using the home network; providing a request to authenticate the new authentication level to the user, wherein the current authentication level and the new authentication level are associated with the security group; and in response to a determination that authentication information is valid for the different authentication type, permitting the user to perform the action.