Authenticating a client using linked authentication credentials
View Patent ↗Techniques are provided for improving security in a single-sign-on context by providing, to a user's client system, two linked authentication credentials in separate logical communication sessions and requiring that both credentials be presented to a host system. Only after presentation of both credentials is the user authenticated and permitted to access applications on the host system.
1. A method of facilitating authentication of a client by an authentication system that comprises at least one processor connected to a storage device, the method comprising:
generating, at the authentication system, a first authentication credential that includes an identifier, and a second authentication credential;
providing, from the authentication system and to a client device in a first communication session, the first authentication credential;
providing, from the authentication system and to an application system in another communication session that is different from the first communication session, the second authentication credential;
receiving, at the authentication system and from the client device, the first authentication credential and the second authentication credential that was received by the client device from the application system, in a third communication session that is different from the first and the other communication sessions;
determining, at the authentication system and using at least one processor of the authentication system, whether the second authentication credential includes an indicator of the identifier of the first authentication credential; and
enabling, at the authentication system, the second authentication credential to be used as a mechanism in authenticating the client only when the second authentication credential includes an indicator of the identifier of the first authentication credential.
2. The method of claim 1 wherein enabling the second authentication credential comprises modifying the second authentication credential to enable its use as a mechanism for authenticating the client.
3. The method of claim 1 wherein enabling the second authentication credential comprises modifying indicia associated with the second authentication credential to enable the second authentication credential to operate as a mechanism for authenticating the client.
4. The method of claim 1 wherein the client comprises a user identity.
5. The method of claim 1 wherein the client comprises a user account.
6. The method of claim 1 wherein the client comprises the client device.
7. The method of claim 1 wherein the second authentication credential provided to the application system over the other communication session is not enabled as a mechanism to be used in authenticating the client.
8. The method of claim 1 further comprising providing, from the authentication system and to the client device in the third communication session, the second authentication credential that is enabled for use in authentication of the client.
9. The method of claim 1 wherein:
the first communication session comprises a secure communication session, and
the third communication session comprises a secure communication session.
10. The method of claim 9 wherein the other communication session comprises a communication session that differs in security from the first and third communication sessions.
11. The method of claim 1 wherein enabling the second authentication credential for use in authentication of the client comprises enabling the second authentication credential for use in authentication of the client for a predetermined amount of time.
12. The method of claim 8 further comprising:
enabling the client to access a service based on presentation of the second authentication credential.
13. The method of claim 12 wherein enabling the client to access the service based on presentation of the second authentication credential comprises providing a service authentication credential to the client device for use in accessing the service.
14. A system for facilitating authentication of a client, the system comprising:
an output configured to:
generate a first authentication credential that includes an identifier, and a second authentication credential,
provide, to a client device in a first communication session, the first authentication credential, and
provide, to an application system in another communication session that is different from the first communication session, the second authentication credential;
an input configured to receive the first authentication credential, and the second authentication credential that was received by the client device from the application system, from the client device in a third communication session that is different from the first and the other communication sessions; and
a processor configured to:
determine whether the second authentication credential includes an indicator of the identifier of the first authentication credential, and
enable the second authentication credential to be used as a mechanism in authenticating the client only when the second authentication credential includes an indicator of the identifier of the first authentication credential.
15. The system of claim 14 wherein the processor is configured to enable the second authentication credential by modifying the second authentication credential to enable its use as a mechanism for authenticating the client.
16. The system of claim 14 wherein the processor is configured to enable the second authentication credential by modifying indicia associated with the second authentication credential to enable the second authentication credential to operate as a mechanism for authenticating the client.
17. The system of claim 14 wherein the output is configured to provide, to the application system in the other communication session, the second authentication credential by providing, to the application system in the other communication session, a second authentication credential that is not enabled as a mechanism to be used in authenticating the client.
18. The system of claim 14 wherein the input is configured to receive, over the third communication session, the first authentication credential and the second authentication credential by receiving, over the third communication session, the second authentication credential that is enabled for use in authentication of the client.
19. The system of claim 14 wherein the processor is configured to enable the second authentication credential for use in authentication of the client for a predetermined amount of time.
20. The system of claim 18 wherein:
the system is configured to enable the client to access a service based on presentation of the second authentication credential.
21. The system of claim 20 wherein the system is configured to enable the client to access the service based on presentation of the second authentication credential by providing a service authentication credential to the client device for use in accessing the service.
22. A tangible computer-readable medium having a computer program embodied thereon, the computer program including instructions for facilitating authentication of a client that, when executed, cause a computer to:
generate, at an authentication system, a first authentication credential that includes an identifier, and a second authentication credential;
provide, from the authentication system and to a client device in a first communication session, the first authentication credential;
provide, from the authentication system and to an application system in another communication session that is different from the first communication session, the second authentication credential;
receive, at the authentication system and from the client device, the first authentication credential and the second authentication credential that was received by the client device from the application system, in a third communication session that is different from the first and the other communication sessions;
determine, at the authentication system, whether the second authentication credential includes an indicator of the identifier of the first authentication credential; and
enable, at the authentication system, the second authentication credential to be used as a mechanism in authenticating the client only when the second authentication credential includes an indicator of the identifier of the first authentication credential.
23. The tangible computer-readable medium of claim 22 wherein the instructions that, when executed, cause the computer to enable the second authentication credential comprise instructions that, when executed, cause the computer to modify the second authentication credential to enable its use as a mechanism for authenticating the client.
24. The tangible computer-readable medium of claim 22 wherein the instructions that, when executed, cause the computer to enable the second authentication credential comprise instructions that, when executed, cause the computer to modify indicia associated with the second authentication credential to enable the second authentication credential to operate as a mechanism for authenticating the client.
25. The tangible computer-readable medium of claim 22 wherein the instructions that, when executed, cause the computer to provide, to the application system in the other communication session, the second authentication credential comprise instructions that, when executed, cause the computer to provide, to the application system in the other communication session, a second authentication credential that is not enabled as a mechanism to be used in authenticating the client.
26. The tangible computer-readable medium of claim 22 wherein the instructions that, when executed, cause the computer to receive, over the third communication session, the first authentication credential and the second authentication credential comprise instructions that, when executed, cause the computer to receive, over the third communication session, the second authentication credential that is enabled for use in authentication of the client.
27. The tangible computer-readable medium of claim 22 wherein the instructions that, when executed, cause the computer to enable the second authentication credential comprise instructions that, when executed, cause the computer to enable the second authentication credential for use in authentication of the client for a predetermined amount of time.
28. The tangible computer-readable medium of claim 26 wherein:
the computer program further includes instructions that, when executed, cause the computer to enable the client to access a service based on presentation of the second authentication credential.
29. The tangible computer-readable medium of claim 28 wherein the instructions that, when executed, cause the computer to enable the client to access the service based on presentation of the second authentication credential include instructions that, when executed, cause the computer to provide a service authentication credential to the client device for use in accessing the service.