Patent Application
20080282331
The present invention relates to network connectivity. More particularly, the present invention relates to a user authentication process in a network.
An ever increasing number of computer users demand connectivity to the Internet, or to some private or public domain network. With the ubiquitous nature of portable computers, laptops and PDAs or other networked computing devices, wired or wireless connectivity with a network is desirable. Furthermore, more and more computer or electronic applications are becoming available on-line, or are required to be accessed via a computer network. These two key trends present a new class of problems in many industries and situations.
Usually, users require some form of authentication or authorization process to allow the network to verify a user's identity and determine what network resources can be accessed, or if the connectivity itself is allowed. Even in open networks where access is essentially free, it may be useful to monitor or control the access to resources and network connectivity. In one exemplary deployed configuration, essentially anyone may access the network but with limitations, such as a time limitation wherein the user is limited to, for example, 15 minutes and must try to connect again after an expiry time.
Generally, users may be assigned one or more identities to differentiate them from other users. The differentiating identities may include a userid or a token key that is unique, and a password or piece of information that would allow the system to assume that the owner of the userid/token and password is the particular user that it purports to be. Sometimes, “physical” possession of a token, analogous to the physical possession of a key for a lock, is sufficient to gain access to the network or access to information and/or an application. Sometimes, a combination of more than one type of userid or token used together (e.g., multiple factor authentication) may be desired for stricter security requirements.
Additionally, connectivity conditions exist where the network must provide connectivity to new users whose identities are not known beforehand, in addition to those users (if any) who are known or already registered to the network system. A mechanism or method for allowing the system to identify each specific unknown or known user, and to control and access to network resources and connectivity is important for security reason, and also to ensure that some computer applications and network resources are used properly.
Conventional login mechanisms using userid and password suffer from operational overhead of user account maintenance and expiry. An extension to conventional login mechanisms includes a two-factor authentication which ensures userid and password stealing does not compromise security. All these authentication enhancements incur increasing overheads in order to increase security. This increases both the capital expenses and operational expenses. All these technological advances also increase the end user burden to login and access a service. Furthermore, support costs of assisting these end users also increases the operational cost with the increase in security basically sacrificing the end user ease of login.
Clearly, in scenarios where a login process or system is used to access paid services, security is of concern to avoid fraudulent usage. Additionally, balancing the end user experience and ease of use while maintaining adequate security is also of particular concern. Therefore, in a reconfigurable network, ease of use is important to ensure the customer can always get access to the paid service. Conversely, an unsatisfactory customer experience will incur higher support cost and might result in customer loss.
A user provisioning with multi-factor authentication is provided. In one embodiment of the present invention, a method for authenticating a user in a network is provided. A network software client of a computing device requests network software service through a service gateway. A call between a user phone and an Interactive Voice Response (IVR) phone login system is initiated in response to the user phone and the computing device being within a coverage area of the service gateway. A user associated with a location within the coverage area is identified. A first information is received by the network software service from the computing device before asynchronously collecting a second information received from the IVR phone login system and correlating the first and second information. When the first and second information match, access by the computing device to services of the service gateway is allowed.
In another embodiment of the present invention, an authentication system is provided. The authentication system includes a computing device including a network software client configured to request network software services. The system further includes a gateway configured to host the network services and redirect the request for the network software services. The system also includes a user phone and an IVR phone login system configured to support a call with the user phone when the user phone and the computing device are located within a coverage area of the service gateway as uniquely assigned to the computing device. The service gateway and the IVR phone login system are further configured to correlate a first information received in the network software services from the computing device and a second information received from the IVR phone login system and when the first and second information match, access is allowed by the computing device to services of the service gateway.
A computer-readable medium including computer-executable instructions thereon is also provided for performing the steps of the method for authenticating a user in a network.
In the drawings, which illustrate what is currently considered to be the best mode for carrying out the invention:
In one form of a two-factor login process, a single authentication mechanism such as userid or password is sufficient to authenticate the user independently. In the one or more multi-factor login process embodiments of the present invention, the authentication mechanisms are interdependent. For example, in a two-factor login described in accordance with one or more embodiments of the present invention, the first and second login mechanisms are interdependent to form a single login mechanism, i.e. they are unable to operate independently. Specifically, the login process in one-factor must be completed before the credentials (e.g. password) or user association (e.g. userid) is passed to the other and vice versa. Additionally, the network access medium employed by one of the authentication factors is normally the network access medium used by the authenticated user to access the resources available after login. Furthermore, as used herein, when additional factors are introduced to provide resource access control, the login mechanism is termed a multi-factor authentication.
While the various embodiments of the present invention find application in various types of systems, one specific application, namely the hospitality industry, is described herein for exemplary and illustrative purposes. Such a specific example is not to be considered as limiting. It should be noted that beyond the general basis, the various embodiments of the present invention covers various specific business applications for a login system, where a user calls an Interactive Voice Response (IVR) system and the IVR system is used as a user provisioning system to create an access code, userid and password or any other authentication credential(s), and the IVR system operator is able to identify the user from the call for billing purposes. The use of an IVR system to provide login credential(s) without requiring prior authentication is considered within the scope of the present invention.
In accordance with the various embodiments of the present invention, the various embodiments provide an authentication process which provides benefits such as:
The various embodiments of the present invention utilize portions of a telephone or communication system for a two-factor authentication to uniquely identify a location (telephone+extension number) and/or a user (mobile phone). For network elements such as portable computers that may freely roam in and out of a network, user account provisioning and maintenance is a major operational challenge due to the constantly changing user base over a relatively short duration. For example, the typical approach of assigning userid and passwords to hotel guests may become an operational complexity.
While it is possible to use the wired network point to identify the user, the popularity of wireless network access is diminishing the benefit both in cost and convenience of installing wired points in such business environments (i.e., one wireless access point can service, for example, multiple rooms with the cabling charges being essentially eliminated).
In accordance with the one or more embodiments of the present invention, an IVR system may be incorporated to provide a two-factor authentication process under the assumption the physical access to the mobile or fixed-wired phone is secured. In accordance with accepted security policies, this assumption is generally acceptable.
In accordance with the various embodiments and with an illustrative example specific to the hospitality example, the hotel operator is considered the trusted party, and the hotel guest accepts the bill generated by the hotel from third parties as well (e.g., restaurant, ISP etc). Extending this trust relationship, the IVR system deployed by the hotel is considered a trusted resource (e.g., you can request room service, laundry etc. from the IVR). Note, although the above example uses the hotel industry as an example, it does not preclude the use of the same approach for other industries, e.g., service apartments, wireless hotspots where the same solution statement concerns are valid.
Network 10 further includes one or more access points 26 configured to facilitate an access service (e.g., Internet), for providing an Internet connection to one or more users. Access point 26 may be configured as a wireless access point configured to radiate and receive electromagnetic waves 27 over a coverage area 11. Alternatively, access point 26 may be configured as a wired access point configured to transmit and receive signals across a wired access point interface 29 over a coverage area 11. A single access point 26 may provide coverage to multiple rooms 18-22 or even public areas. If the access service is restricted to guests or paying customers, a service gateway 28 or similar equipment(s) may be used to provide the web login system 30 and service access controls to, for example, the Internet 32. It should be noted that the login factor may be alternatively provided through a delivery mechanism other than a conventional web login system. Such alternative delivery mechanisms include any network software client that may provide a user credential such as an IEEE 802.1x supplicant or Microsoft Windows Login client. If such an alternative network software client also provides a password or piece of information to confirm the user credential provided, the latter may be ignored in the implementation of this invention. For purposes of convenience in notation, such alternative authentication mechanisms are herein included within the scope of the current definition of the term “web-login system” as used herein. Since an access point 26 may cover multiple areas such as rooms 18-22, it is not reliable for the service gateway 28 to identify or associate a user's room 18-22 number by the servicing access point 26 providing communication with the associated computing device.
Network 10 further includes an IVR phone login system 34 coupled to the central PABX 24 to provide the additional login factor. The IVR phone login system 34 is configured to identify the user's room 18, 20 or 22 based on the unique phone extension number of each room 18-22. The IVR phone login system 34 communicates with the wireless service gateway 28 to provide an integrated two-factor authentication login system. It should also be noted that the additional login factor may be alternatively provided through a delivery mechanism other than a conventional IVR system. One such alternative delivery mechanism includes an electronic data delivery mechanism such as email or text messaging. For purposes of convenience in notation, such alternative delivery mechanisms are herein included within the scope of the current definition of an IVR system as used herein.
In accordance with the various embodiments of the present invention, a two-factor authentication process may be performed according to various processes. According to the architecture of network 10 of
In accordance with the flow diagram of
In accordance with the flow diagram of network 10″ of
Continuing, the user calls 214 the IVR extension number. The IVR system identifies the room number of the incoming call and depending on the login process specified:
Depending on the login process specified above, the user completes the second-factor authentication process by:
Depending on the login process specified immediately above, the service gateway will verify the second-factor login request by:
If the second-factor authentication process is successful, the service gateway 28″ will open up Internet access for the user's computing device 204.
Additional embodiments of the present invention may include an IVR system configured to provide more detailed services, e.g., QoS, or usage duration for the computing device. Additionally, through transaction tracking, each web login request may be uniquely associated to an IVR login confirmation. For example, duplicate web login requests from the same computing device should be discarded while there is a pending IVR login confirmation active. Similarly, outstanding web login requests that have “timed-out” should be discarded, e.g., user does not answer the phone call. Additionally, to outsource billing and payment collection, the inbound IVR system could be a registered 190x paid phone service. An established telecommunication service provider could then handle the billing and payment collection.
The user can then use the access code or cookie from locations other than the specific room, or use, for example, an NIC (network interface card) on the computing device where the phone to billing relationship or MAC (media access control) address to billing relationship etc cannot be established. Note if the cookie stored on the computing device is used as the only login credential for subsequent authentication, the end user does not need to remember any other login credentials; while if the access code is used for subsequent authentication, the user is not restricted to just using the same computing device.
Continuing with respect to
In accordance with the flow diagram of
Returning to
If end user DoS is a major concern, the process of
Additionally, if the authentication process of
It should be noted that while inbound IVR systems can handle DoS better than outbound IVR systems, at high load conditions, the reverse is true. When there is a high number of concurrent logins, with the same number of telephone lines to the IVR system, if all the telephone lines are occupied, an outbound IVR system can queue the outstanding phone calls to the users while an inbound IVR system will starting dropping phone calls from users.
Similar to the above situation, with the popularity of the wireless medium or network computing, there exist situations when access to restricted resources is on a temporary basis via an unregulated user's computing device, and when accessing such resources, due to confidentially or security reason etc, access to other independent resources normally available to the user must be denied. For example, when the resource to be access is a secured resource where security is a concern, besides preventing the user from accessing other unsecured resources (e.g. Internet) concurrently, there is a need to prevent third parties from using the user's computing device to a relay attack on the secure resource or compromise the resource confidentially. Alternatively, there could be multiple groups of users, such that while one group needs to access a particular restricted resource, other groups are not allowed to access the latter resource. There may be a need to prevent (potentially deliberate) user identity fraud when two different group exchange login credentials.
Integrating two-factor authentication with the additional factors provides a multi-factor authentication process that applies the original login solution for access control to restricted resources. In multi-factor authentication—unlike two-factor authentication—the user identifier (e.g. userid, room number) and the user verification credential (e.g. password, access code) could both be provided by one of the two factors, although this is not required.
Additional security factors may be incorporated including: (a) Providing the login credentials to the authorized user only at the specific time the user requires access to the restricted resource. Each login credential uniquely identifies the user and can only be used to login once; (b) Using a limited permissible login time window to ensure all authorized users will login immediately on receiving the login credential; (c) Automatically logging out the user if the computing device disconnects from the network access medium or the permitted usage time period has expired; and (d) Not allowing the user to login again using the same login credential provided in Step (a) even if the permitted usage time has not expired. Steps (a) and (b) above when combined prevent or at least minimize the opportunity for the authorized user to exchange or expose the login credential to another unauthorized user group or users within the authorized group.
By way of example, first-factor authentication can be an authentication mechanism (e.g. web-based userid and password login) used to login to the network. This first-factor login credential identifies:
Note in concept, only the userid (or any other user identifying attribute) is required if it is not provided for in the second-factor authentication. The password (or any other login verification credential) is not required and may be ignored. The current authentication mechanism of network 10″′ is retained so that other users—who do not need access to the restricted resources 360—can continue to login and gain access to the Internet or unrestricted resources 362. If the user identity is known and the user is required to access the restricted resources 360 at that time, the user may be denied Internet access and can only initiate the second-factor authentication process.
In the current examination example, the invigilator could be the second-factor authentication “device”. Prior to the examination, the invigilator could distribute the unique login credentials created for each examinee. These login credentials would minimally provide a unique one-time password. This list of passwords can be randomly generated by the service gateway and their valid time window can be configured in the service gateway 28′. The service gateway 28′ can then perform the userid to password validity checks based on the additional factors.
Each examinee uses the login credentials provided to login and access the restricted examination questions. Single sign-on solutions could be integrated to the network login system such that the examinee identity will also be known to the examination server. Each examinee can then only complete and submit under their identity, i.e. they cannot switch identities. Furthermore, during the examination period, while the user can gain access to the questions posted on the network, they cannot access the Internet to help them find answers, or allow communications with external parties or between authorized users. After the examination period, the students can gain normal access to the Internet or other unrestricted network resources 362. Another applicable use of such multi-factor authentication process could be in computerized contests.
Continuing the present examination example, Location B 372 could be the examination hall with the coverage area extending to Location A 370 and Location C 374. A service gateway 28′ implements the login system and access controls to both the Internet (unrestricted resources 362) and the restricted resources 360 (e.g. examination server). The service gateway 28′ provides the only connection to the restricted resources 360, i.e. all traffic to and from the restricted resource 360 must pass through the service gateway 28′. In a normal usage scenario, end users in Location A and C could be accessing the Internet while users in Location B can only access the restricted resources.
Although the foregoing description contains many specifics, these are not to be construed as limiting the scope of the present invention, but merely as providing certain exemplary embodiments. Similarly, other embodiments of the invention may be devised which do not depart from the spirit or scope of the present invention. The scope of the invention is, therefore, indicated and limited only by the appended claims and their legal equivalents, rather than by the foregoing description. All additions, deletions, and modifications to the invention, as disclosed herein, which fall within the meaning and scope of the claims are encompassed by the present invention.
| Filing Document | Filing Date | Country | Kind | 371c Date |
|---|---|---|---|---|
| PCT/SG04/00328 | 10/8/2004 | WO | 00 | 4/4/2007 |
