Automation of workloads involving applications employing multi-factor authentication

Abstract

A robotic process automation (RPA) system provides bots that interact with and provide user credentials to applications, such as for multi-factor authentication (MFA). First user credentials associated with MFA are retrieved by the bots from credential storage. Second user credentials that correspond to questions posed to a user of an application are retrieved from credential storage. Second user credentials that correspond to a one-time password are generated by the RPA system. The second user credentials may also be generated by a third-party authentication service that provides the credentials via a secondary channel such as email or SMS, which are then retrieved for presentation to the application.

Description

FIELD OF THE DISCLOSURE

This disclosure relates generally to the field of data processing systems and more particularly to robotic process automation systems.

BACKGROUND

Robotic process automation (RPA) is the application of technology that allows workers in an organization to configure computer software, known as a “robot” to capture and interpret existing applications for processing a transaction, manipulating data, triggering responses and communicating with other digital systems. The software robots in conventional RPA systems employ the software robots to interpret the user interface of third-party applications and to execute steps identically to a human user. For example, many tasks within organizations require individuals to perform the same repetitive tasks, such as entering data from invoices into an enterprise accounts payable application or entering data from a loan application into a loan processing system. RPA permits the automation of such application level repetitive tasks via software robots that are coded to repeatedly and accurately perform the repetitive task.

When automating human tasks to use applications secured by multi-factor authentication (MFA), automation tools require additional factors other than a login identification and a password for login. There are different methods of MFA. While the form of the additional required factor varies, all MFA techniques require that the additional factor involve a credential or configuration to be first exchanged between the user and the application, and then be used based on the protocol defined by the selected MFA method. This requirement has typically restricted automation from being employed with applications employing MFA.

SUMMARY

A robotic process automation (RPA) system provides bots that interact with and provide user credentials to applications, such as for multi-factor authentication (MFA). A first user credential associated with MFA is retrieved from credential storage. A second user credential that corresponds to questions posed to a user of an application is retrieved from credential storage. A second user credential that corresponds to a one-time password is generated by the RPA system from a security key stored in the credential storage. The second user credential may also be generated by a third party authentication service and is retrieved by the bot via a secondary channel such as email where the bot employs the user credential to access an email account associated with the user to retrieve the second user credential. The secondary channel may be an SMS message where the user has configured their mobile device with an application that recognizes the SMS message and provides the code in the SMS message to the RPA system which then provides the code to the bot.

These and additional aspects related to the invention will be set forth in part in the description which follows, and in part will be apparent to those skilled in the art from the description or may be learned by practice of the invention. Aspects of the invention may be realized and attained by means of the elements and combinations of various elements and aspects particularly pointed out in the following detailed description and the appended claims.

It is to be understood that both the foregoing and the following descriptions are exemplary and explanatory only and are not intended to limit the claimed invention or application thereof in any manner whatsoever.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings, which are incorporated in and constitute a part of this specification exemplify the embodiments of the present invention and, together with the description, serve to explain and illustrate principles of the inventive techniques disclosed herein. Specifically:

FIG. 1 is a high-level block diagram of an embodiment of an RPA system with multi-factor authentication support.

FIG. 2 is a flowchart illustrating operation of an embodiment of multi-factor authentication.

FIG. 3 is a flow diagram illustrating operation of second factor authentication.

FIG. 4 illustrates a block diagram of hardware that may be employed in an implementation of the RPA systems disclosed herein.

DETAILED DESCRIPTION

In the following detailed description, reference will be made to the accompanying drawings, in which identical functional elements are designated with like numerals. Elements designated with reference numbers ending in a suffix such as .1, .2, .3 are referred to collectively by employing the main reference number without the suffix. For example, 100 refers to topics 100.1, 100.2, 100.3 generally and collectively. The aforementioned accompanying drawings show by way of illustration, and not by way of limitation, specific embodiments and implementations consistent with principles of the present invention. These implementations are described in sufficient detail to enable those skilled in the art to practice the invention and it is to be understood that other implementations may be utilized and that structural changes and/or substitutions of various elements may be made without departing from the scope and spirit of present invention. The following detailed description is, therefore, not to be construed in a limited sense.

In FIG. 1, a user 101 interacts via a device 102 with an application 103, which may take a form such as a desktop-based application or a web-based application. A locally stored application 103 executes directly on device 102, which may take a form such as a personal computer, tablet, or other computing device. A web-based application 103 executes partially or entirely on a remote device and interacts with user 101 via a conventional browser. The application 103 may employ Multi-Factor Authentication (MFA) to increase information security.

MFA is an authentication method in which a computer user is granted access only after successfully presenting two or more pieces of evidence (or factors) to an authentication mechanism. The secondary (or tertiary) factors may fall into any one of three categories. First there is knowledge (something the user and only the user knows). An example of this is posing a question to the user, the answer to which only the user is likely to know. Second, is possession—something the user and only the user has. An example of this is a Time Based One-Time Password (TOTP) which is provided only to the user and which is valid for a brief period of time. The difference from knowledge is that the value sent to application is not the credential itself, but something generated from the credential. Third, is interaction where the secondary credential to be sent to an application is provided from the application via a communication method which only the user can access. An example of this is a One-Time Password (OTP) sent to a user via email.

In FIG. 1, a robotic process automation system 10 is also shown. The RPA system 10 includes data storage, seen generally at 136 which stores a plurality of sets of task processing instructions 134. Each set of task processing instructions 134 implements a software robot, also referred to as a bot (seen as Bot 1, Bot 2, . . . , Bot n) which is operable to interact at a user level with one or more designated user level application programs, such as application 103. As used herein, the term “bot” is generally synonymous with the term software robot. In certain contexts, as will be apparent to those skilled in the art in view of the present disclosure, the term “bot runner” refers to a device (virtual or physical), having the necessary software capability, on which a bot will execute or is executing, such as for example a device 102 loaded with and executing a bot 134. The data storage 136 also stores a plurality of work items 132, where each work item 132 is stored for subsequent processing by executing a corresponding set of task processing instructions 134 (also referred to as a bot which implements each set of task processing instructions). A Control Room, seen generally at 130, is operatively coupled to the data storage 136 and is configured to execute instructions that when executed cause the RPA system 10 to respond to a request from a client device 102 that is issued by a user 101 to act as a server to provide to the client device 102 the capability to perform an automation task to process a work item from the plurality of work items 132. The user 101 interacts with the Control Room 130 to schedule automation tasks to be performed on one or more devices 102 as if the user 101 were manually interacting with the necessary application program(s) and the operating system of the devices 102 to perform the tasks directly. The Control Room 130 in conjunction with credential vault 144 holds all software application license and user information. The Control Room 130 also tracks all bots that have been deployed and knows the status of all deployed bots.

Each client device 102 may take a variety of forms such as a physical machine, for example, a desktop computer, laptop computer or tablet. Each client device 102 may also be a virtual device such as provided by conventional virtualization software which permits multiple operating system sessions to be run on a single computer. Each client device 102 may have applications loaded thereon on local storage.

Some or all of the bots 134 may in certain embodiments be located remotely from the Control Room 130. Moreover, any of the devices 102 may also be located remotely from the Control Room 130. The bots 134 and the tasks 132 are shown in separate containers for purposes of illustration but they may be stored in separate or the same device(s), or across multiple devices. The Control Room 130 performs user management functions, source control of the bots 134, along with providing a dashboard that provides analytics and results of the bots 134, performs license management of software required by the bots 134 and manages overall execution and management of scripts, clients, roles, credentials, and security etc. The major functions performed by the Control Room 130 include: (i) a dashboard that provides a summary of registered/active users, tasks status, repository details, number of clients connected, number of scripts passed or failed recently, tasks that are scheduled to be executed and those that are in progress; (ii) user/role management—permits creation of different roles, such as bot creator, bot runner, admin, and custom roles, and activation, deactivation and modification of roles; (iii) repository management—to manage all scripts, tasks, workflows and reports etc.; (iv) operations management—permits checking status of tasks in progress and history of all tasks, and permits the administrator to stop/start execution of bots currently executing; (v) audit trail—logs creation of all actions performed in the Control Room; (vi) task scheduler—permits scheduling tasks which need to be executed on different clients at any particular time; (vii) credential management—permits password management; and (viii) security: management—permits rights management for all user roles. The Control Room 130 is shown generally for simplicity of explanation. Multiple instances of the Control Room 130 may be employed where large numbers of bots are deployed to provide for scalability of the RPA system 10.

The centralized credential vault (CV) 144 operates to securely store all credentials and provision them to bots on an on-demand basis. In one embodiment, the CV 144 implements National Institute of Standards and Technology (NIST) security and privacy controls IA-2 to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users). Since sensitive credentials need not be stored in bots or on bot runner systems, the CV 144 facilitates a logical separation of credentials from the bots. CV 144 variables are created from Control Room 130 and are instantly available to all the bot creators and bot runners registered with the respective Control Room 130. The CV 144 adds flexibility and dynamic character to bots since only the credential references are present in the bots and not the credentials. When bots are moved from one environment to another environment, absolutely no change is needed in bots. Bots can seamlessly pick up the credential values applicable for the new environment from the Control Room 130 of that environment. Additionally, the Control Room 130 automatically stores configuration related sensitive data into the CV 144 by default. Additional details of the credential vault 144 are described in U.S. patent application Ser. No. 15/957,917 entitled “ROBOTIC PROCESS AUTOMATION SYSTEM AND METHOD WITH SECURE CREDENTIAL VAULT” which is assigned to the assignee of the present application and which is hereby incorporated by reference in its entirety.

The disclosed embodiments permit the system 10 to deploy bots 134 that interact with applications, such as application 103, that employ MFA, to permit tasks employing MFA enabled applications to be automated with bots 134. Without the RPA system 10 disclosed herein, use of applications that employ MFA cannot be automated, or a user 101 needs to disable MFA on the target application, which leads to lower security.

Operation of the MFA feature of the system 10 is described with reference to FIGS. 1 and 2. To permit automation of an application 103 that employs MFA, the MFA feature is enabled 140 on the application 103 (202) and the user 101 has provided their credential information (204) to the application 103. The credential information will include the user 101's primary credentials, such as the login ID and password. The user 101 also interacts with the RPA system 10 to store their credentials (206) associated with application 101 to the credential vault 144 via Control Room 130. A bot 134 is developed (208) to interact with the application 103 and the MFA feature of the application 103. The MFA Factor Provider 142 may be a commercially available service that the application 103 is configured to interact with. The MFA Factor Provider 142 may provide to the application 103 a secondary (and tertiary etc.) authentication requirement, by way of token 146 which is fulfilled by a user 101 or a bot 134 acting on behalf of a user 101. For example, the MFA Factor Provider 142 may be of a type as provided by identity and access management services such as, for example, Microsoft Azure or Okta. The MFA Factor Provider 142 may require any one of a number of secondary authentications, as configured via the application 103, such as an answer to one or more questions previously provided by the user 101. Secondly, the MFA Factor provider 142 may be configured to require a one-time password. Thirdly, the MFA Factor provider 142 may be configured to require a security code provided by the MFA Factor Provider 142 to the user via a secondary channel such as to a user email account or an SMS message provided to a user's mobile device 150.

Subsequently, when the bot 134 that has been coded to respond to a request for MFA, such as Bot 1 executing on Device 1, the bot 134 operates with the credentials of a user, such as user 101, to perform operations with the user 101's credentials as if the user were performing the operations which the bot 134 has been coded to perform. The bot 134 responds to a request by the application 103 for a first set of credentials corresponding to those of user 101 (210), such as a username and password. The bot 134, which has been provided with RPA system credentials of user 101 employs the RPA system credentials of user 101 to access credential vault 144 (212) for user 101's first set of credentials corresponding to application 103 to provide such credentials to application 103 (216) which are then validated by validate module 141 of application 103. In some embodiments the foregoing described request for the user's first set of credentials may be generated by the MFA Factor Provider 142 which the application may then provide to the bot 134. Once the application has received a first set of credentials corresponding to the expected credentials for user 101, the MFA Factor Provider 142 will generate a request for second credentials for user 101 in connection with application 103 to application 103. This request will be provided by application 103 to bot 134 (218) which will then provide the second credentials for user 101 in accordance with the second credentials specified for application 103 by user 101.

The second credentials for user 101 for application 103 may be one of several types, four of which are shown in FIG. 3. The second credentials for user 101 for application 103 may be one or more questions generated by MFA Factor Provider 142 (302). The bot 134 will be encoded to recognize such second credentials and will retrieve the answers from credential vault 144 (303) and provide such second credentials to the application 103 (304). The second credentials for user 101 for application 103 may be a One-Time Password (OTP) which in one embodiment is generated by the control room 130 which retrieves a key stored in the credential vault 144 (306) and generates the OTP with the retrieved key (308). In another embodiment, the OTP is generated by the requesting bot 134 which retrieves the key stored in the credential vault 144 (306) and generates the OTP with the retrieved key (308). The control room 130 and/or the bot 134 is programmed to generate a Time-based OTP (TOTP) using a TOTP Security Key stored in the credential vault. In one embodiment this is based on an algorithm defined in RFC6238 by the Internet Engineering Task Force, which may be found at tools.ietf.org. In this case, the TOTP Security Key (usually 16 length alphabetic characters. e.g. “EGDBYDSIFLBYEKLQ”) is the credential information stored in the credential vault 144, and the secondary credential provided to the bot 134 to be sent to the application 103 would be a TOTP code (usually 6 digits, e.g. “385934”).

The second credentials may be a code generated by the MFA Factor Provider 142 and provided to an account or device associated with the user 101 such as by way of an email message to an email account of the user 101 (310) or by way of an SMS message provided to a mobile device 150 of the user 101 (314). If the second factor authentication is a code sent via email by the MFA Factor Provider 142 to an email account 151 provided by user 101, the bot 134, which receives the request via application 103, connects to the user 101's email mailbox and retrieves the one-time password sent from the MFA Factor Provider 142 (311) and provides the retrieved password to the application 103 (312). If the code is provided by the MFA Factor Provider 142 to the user's mobile device 150 via SMS, then an application 152 installed under user 101's permission to the mobile device 150 operates to recognize the received SMS by monitoring received SMS messages on the device 150 (315). The application 152 is one embodiment is provided by the RPA system 10, instead of by a third-party, to ensure security of the user's environment on the device 150 and other devices and applications with which the device 150 interacts. The application 152 provides the received OTP or code to the control room 130 (316) which provides it to the bot 134 (317) which then proceeds to provide the received OTP or code to the application 103 (318) to satisfy the second factor generated by the MFA Factor Provider 142.

FIG. 4 illustrates a block diagram of hardware that may be employed in an implementation of the RPA system as disclosed herein. FIG. 4 depicts a generalized example of a suitable general-purpose computing system 400 in which the described innovations may be implemented in order to improve the processing speed and efficiency with which the computing system 400 operates to perform the functions disclosed herein. With reference to FIG. 4 the computing system 400 includes one or more processing units 402, 404 and memory 406, 408. The processing units 402, 406 execute computer-executable instructions. A processing unit can be a general-purpose central processing unit (CPU), processor in an application-specific integrated circuit (ASIC) or any other type of processor. The tangible memory 406, 408 may be volatile memory (e.g., registers, cache, RAM), non-volatile memory (e.g., ROM, EEPROM, flash memory, etc.), or some combination of the two, accessible by the processing unit(s). The hardware components in FIG. 4 may be standard hardware components, or alternatively, some embodiments may employ specialized hardware components to further increase the operating efficiency and speed with which the system 100 operates. The various components of computing system 400 may be rearranged in various embodiments, and some embodiments may not require nor include all of the above components, while other embodiments may include additional components, such as specialized processors and additional memory.

Computing system 400 may have additional features such as for example, storage 410, one or more input devices 414, one or more output devices 412, and one or more communication connections 416. An interconnection mechanism (not shown) such as a bus, controller, or network interconnects the components of the computing system 400. Typically, operating system software (not shown) provides an operating system for other software executing in the computing system 400, and coordinates activities of the components of the computing system 400.

The tangible storage 410 may be removable or non-removable, and includes magnetic disks, magnetic tapes or cassettes, CD-ROMs, DVDs, or any other medium which can be used to store information in a non-transitory way, and which can be accessed within the computing system 400. The storage 410 stores instructions for the software implementing one or more innovations described herein.

The input device(s) 414 may be a touch input device such as a keyboard, mouse, pen, or trackball, a voice input device, a scanning device, or another device that provides input to the computing system 400. For video encoding, the input device(s) 414 may be a camera, video card, TV tuner card, or similar device that accepts video input in analog or digital form, or a CD-ROM or CD-RW that reads video samples into the computing system 400. The output device(s) 412 may be a display, printer, speaker, CD-writer, or another device that provides output from the computing system 400.

The communication connection(s) 416 enable communication over a communication medium to another computing entity. The communication medium conveys information such as computer-executable instructions, audio or video input or output, or other data in a modulated data signal. A modulated data signal is a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media can use an electrical, optical, RF, or other carrier.

The terms “system” and “computing device” are used interchangeably herein. Unless the context clearly indicates otherwise, neither term implies any limitation on a type of computing system or computing device. In general, a computing system or computing device can be local or distributed and can include any combination of special-purpose hardware and/or general-purpose hardware with software implementing the functionality described herein.

While the invention has been described in connection with a preferred embodiment, it is not intended to limit the scope of the invention to the particular form set forth, but on the contrary, it is intended to cover such alternatives, modifications, and equivalents as may be within the spirit and scope of the invention as defined by the appended claims.

Claims

1. A computer-implemented method for executing automation tasks, the method comprising: storing a first user credential, for accessing a first application, to a credential storage, the first user credential corresponding to an initial credential required for a multi-factor authentication protocol implemented by the first application for a user to access the first application;storing, for a robotic process automation system via at least one network, a bot that is configured to perform one or more programmed tasks, at least one or more of the programmed tasks including accessing the first application using the first user credential and a second user credential, and including interacting with the first application on behalf of the user;deploying the bot to a client computing device via the at least one network, wherein the bot is configured to operate on the client computing device and initiate interaction with the first application;receiving, from the bot operating on the client computing device, a first request for the first user credential;responding to the first request from the bot by retrieving the first user credential from the credential storage and providing the first user credential to the bot;subsequently receiving, from the bot operating on the client computing device, a second request for the second user credential; andresponding to the second request from the bot by obtaining the second user credential from the credential storage or a third party service, and providing the second user credential to the bot.

2. The computer-implemented method of claim 1 wherein the responding to the second request from the bot comprises retrieving the second user credential from the credential storage.

3. The computer-implemented method of claim 1 wherein the responding to the second request from the bot comprises generating a time-based one-time password from a key stored in the credential storage, wherein the time-based one-time password corresponds to the second user credential.

4. The computer-implemented method of claim 1 wherein the responding to the second request from the bot comprises retrieving the second user credential from a second application which has received the second user credential from the third party service.

5. The computer-implemented method of claim 4 wherein the method further comprises: providing the second user credential to a mobile device associated with the first user wherein the second application executes on the mobile device to receive the second user credential from the third party service.

6. The computer-implemented method of claim 1 wherein the second user credential comprises an answer to a question posed by the first application.

7. The computer-implemented method of claim 1 wherein the responding to the second request from the bot comprises obtaining a time-based one-time code, wherein the time-based one-time password corresponds to the second user credential.

8. The computer-implemented method of claim 1 wherein the responding to the second request from the bot comprises obtaining the second user credential from the third party service.

9. The computer-implemented method of claim 8 wherein the third party service is an access management service.

10. A robotic process automation system, comprising: data storage for storing at least: a set of task processing instructions operable to interact at a user level with one or more user level applications, wherein the set of task processing instructions is encoded to interact with a multi-factor authentication provider; andcredentials, wherein at least some of the credentials are used to satisfy multi-factor authentication protocols required by the one or more user level applications;a server processor operatively coupled to the data storage and configured to execute instructions that when executed cause the server processor to at least: respond to a request to deploy the set of task processing instructions by deploying the set of task processing instructions;respond to a first request from the set of task processing instructions operating on the client computing device to provide a first credential associated with a user to enable the set of task processing instructions to login to a first application, by retrieving from the data storage the first credential associated with the user that corresponds to the first application and providing the first credential to the set of task processing instructions; andafter responding to the first request, respond to a second request from the set of task processing instructions operating on the client computing device to provide a second credential associated with the user to enable the set of task processing instructions to login to the first application, by retrieving the second credential associated with the user that correspond to the first application and providing the second credential to the set of task processing instructions.

11. The robotic process automation system of claim 10 wherein the server processor responds to a second request by retrieving the second credential associated with the user that corresponds to the first application from the data storage and providing the second credential associated with the user to the set of task processing instructions.

12. The robotic process automation system of claim 10 wherein the server processor responds to a second request by retrieving the second credential from a second application which has received the second credential from a third party application and providing the second credential associated with the user to the set of task processing instructions.

13. The robotic process automation system of claim 12 wherein the server processor provides the second application to a mobile device associated with the user wherein the second application executes on the mobile device associated with the user to receive the second credential from the third party application.

14. The robotic process automation system of claim 12 wherein the retrieving the second credential from a second application comprises: retrieving a user credential from the data storage;accessing the second application with the user credential; andretrieving the second user credential from the second application.

15. The robotic process automation system of claim 14 wherein the second application comprises an e-mail application.

16. The robotic process automation system of claim 14 wherein the second user credential comprises an answer to a question posed by the first application.

17. A non-transitory tangible storage medium, having stored thereupon one or more program modules comprising computer-executable instructions for execution on a computer system, the computer-executable instructions causing the computer system to: operate a bot on a client computing device;access, via the bot, a first application on behalf of a user, the first application configured to operate on the client computing device;receive, from the bot operating on the client computing device, a first request from the first application for a first user credential of the user;respond to the first request from the first application for a first user credential of the user by requesting the first user credential of the user that corresponds to the first application to be provided from a credential storage that securely stores user credentials for a plurality of users, and then providing the first user credential to the first application;subsequently receive, from the bot operating on the client computing device, a second request from the first application for a second user credential; andrespond to second request from the first application for a second user credential of the user by requesting the second user credential of the user to be provided, and then providing the second user credential to the first application.

18. The non-transitory tangible storage medium of claim 17 wherein the second user credential is acquired by a second application, and then provided to the first application.

19. The non-transitory tangible storage medium of claim 17 wherein the first user credential and the second user credential together provide multi-factor authentication of the user to the first application.

20. The non-transitory tangible storage medium of claim 17 wherein the second credential corresponds to a one-time password.

21. The non-transitory tangible storage medium of claim 17 wherein the second user credential is acquired by a multi-factor authentication provider.

22. The non-transitory tangible storage medium of claim 21 wherein the second credential corresponds to a code transmitted via email by the multi-factor authentication provider to an email account associated with the first user, wherein the second application corresponds to an email application that operates the email account associated with the first user.

23. The non-transitory tangible storage medium of claim 21 wherein the second credential corresponds to a code transmitted via SMS by the multi-factor authentication provider to a mobile device associated with the first user, wherein the second application corresponds to a listener application executing on the mobile device associated with the user that recognizes an SMS message from the multi-factor authentication provider and extracts the second credential from the SMS message.

24. The non-transitory tangible storage medium of claim 21 wherein the multi-factor authentication provider is a network-based access management service provider.