Controlling user access to protected resource based on outcome of one-time passcode authentication token and predefined access policy
View Patent ↗Techniques are provided for controlling user access to a protected resource based on an outcome of a one-time passcode authentication token and one or more predefined access policies. An exemplary method comprises the steps of: providing an authentication passcode generated by a token associated with a user to at least one authentication processing device, wherein the user is attempting to access a protected resource; receiving an authentication outcome from the at least one authentication processing device, the authentication outcome comprising an acceptance outcome of the received authentication passcode and at least one of an acceptance outcome with respect to one or more different signals, such as a silent alarm and an acceptance outcome with respect to a drifting key; and providing access of the user to the protected resource based on the authentication outcome and a predefined access policy. Predefined access policies that are specific to silent alarm alerts and drifting key alerts are also provided.
1. A method, comprising:
providing an authentication passcode derived from a secret seed and generated by a token associated with a user to at least one authentication processing device, wherein said user is attempting to access a protected resource;
receiving an authentication outcome from said at least one authentication processing device, said authentication outcome comprising an acceptance outcome of the received authentication passcode and at least one of an acceptance outcome with respect to one or more of two different signals, wherein said at least one authentication processing device detects a loss of privacy of said secret seed by extracting and processing a silent alarm signal embedded in said received authentication passcode from said received authentication passcode, and wherein said silent alarm signal indicates an anomalous event detected by said token; and
controlling access of said user to said protected resource based on said authentication outcome and a predefined access policy invoked when said silent alarm signal has a predefined state indicating said detection of said anomalous event.
2. The method of claim 1 , wherein said received authentication passcode further comprises a drifting key signal.
3. The method of claim 1 , wherein said authentication outcome comprises one or more of an allowance of access, a denial of access, a silent alarm alert indicating a potential compromise of said token, a drifting key inconsistency between said received authentication passcode and one or more previously received authentication passcodes and a severe danger alert indicating at least two independent indications of a cloning of said token.
4. The method of claim 1 , wherein said predefined access policy comprises one or more of the following actions: allowing said user full access to said protected resource; allowing said user restricted access to said protected resource; denying said user access to said protected resource; denying said user access to said protected resource and applying an additional secondary step-up authentication mechanism; and allowing said user restricted access to said protected resource in a non-functional manner such that said user is not notified that a potential attack has been detected.
5. The method of claim 1 , wherein said access of said user is provided to said protected resource further based on an event type.
6. The method of claim 1 , wherein said acceptance outcome with respect to said silent alarm signal comprises a silent alarm alert and wherein said predefined access policy comprises one or more of the following actions: allowing said user full access to said protected resource; allowing said user restricted access to said protected resource; and denying said user access to said protected resource.
7. The method of claim 1 , wherein said acceptance outcome with respect to said silent alarm signal comprises a silent alarm alert and wherein said method further comprises a step of logging a silent alarm state.
8. The method of claim 1 , wherein said acceptance outcome with respect to said silent alarm signal comprises a silent alarm alert and wherein said method further comprises one or more of the following steps: disabling said token, monitoring one or more actions of said user and sending a notification of said silent alarm alert to an administrator.
9. The method of claim 2 , wherein said acceptance outcome with respect to said drifting key signal comprises a drifting key alert and wherein said predefined access policy comprises one or more of the following actions: allowing said user restricted access to said protected resource; and denying said user access to said protected resource.
10. The method of claim 2 , wherein said acceptance outcome with respect to said drifting key signal comprises said drifting key alert and wherein said method further comprises a step of logging a drifting key state.
11. The method of claim 2 , wherein said acceptance outcome with respect to said drifting key signal comprises said drifting key alert and wherein said method further comprises one or more of the following steps: disabling said token, disabling said token after a predefined number of failed attempts, monitoring one or more actions of said user and sending a notification of said drifting key alert to an administrator.
12. An apparatus, the apparatus comprising:
a memory; and
at least one hardware device, coupled to the memory, operative to:
provide an authentication passcode derived from a secret seed and generated by a token associated with a user to at least one authentication processing device, wherein said user is attempting to access a protected resource;
receive an authentication outcome from said at least one authentication processing device, said authentication outcome comprising an acceptance outcome of the received authentication passcode and at least one of an acceptance outcome with respect to one or more of two different signals, wherein said at least one authentication processing device detects a loss of privacy of said secret seed by extracting and processing a silent alarm signal embedded in said received authentication passcode from said received authentication passcode, and wherein said silent alarm signal indicates an anomalous event detected by said token; and
control access of said user to said protected resource based on said authentication outcome and a predefined access policy invoked when said silent alarm signal has a predefined state indicating said detection of said anomalous event.
13. The apparatus of claim 12 , wherein said received authentication passcode further comprises a drifting key signal.
14. The apparatus of claim 12 , wherein said authentication outcome comprises one or more of an allowance of access, a denial of access, a silent alarm alert indicating a potential compromise of said token, a drifting key inconsistency between said received authentication passcode and one or more previously received authentication passcodes and a severe danger alert indicating at least two independent indications of a cloning of said token.
15. The apparatus of claim 12 , wherein said predefined access policy comprises one or more of the following actions: allowing said user full access to said protected resource; allowing said user restricted access to said protected resource; denying said user access to said protected resource; denying said user access to said protected resource and applying an additional secondary step-up authentication mechanism; and allowing said user restricted access to said protected resource in a non-functional manner such that said user is not notified that a potential attack has been detected.
16. The apparatus of claim 12 , wherein said access of said user is provided to said protected resource further based on an event type.
17. The apparatus of claim 12 , wherein said acceptance outcome with respect to said silent alarm signal comprises a silent alarm alert and wherein said predefined access policy comprises one or more of the following actions: allowing said user full access to said protected resource; allowing said user restricted access to said protected resource; and denying said user access to said protected resource.
18. The apparatus of claim 12 , wherein said acceptance outcome with respect to said silent alarm signal comprises a silent alai in alert and wherein said apparatus is further configured to log a silent alarm state.
19. The apparatus of claim 12 , wherein said acceptance outcome with respect to said silent alarm signal comprises a silent alarm alert and wherein said apparatus is further configured to perform one or more of the following steps: disabling said token, monitoring one or more actions of said user and sending a notification of said silent alarm alert to an administrator.
20. The apparatus of claim 13 , wherein said acceptance outcome with respect to said drifting key signal comprises a drifting key alert and wherein said predefined access policy comprises one or more of the following actions: allowing said user restricted access to said protected resource; and denying said user access to said protected resource.
21. The apparatus of claim 13 , wherein said acceptance outcome with respect to said drifting key signal comprises a drifting key alert and wherein said apparatus is further configured to log a drifting key state.
22. The apparatus of claim 13 , wherein said acceptance outcome with respect to said drifting key signal comprises a drifting key alert and wherein said apparatus is further configured to perform one or more of the following steps: disabling said token, disabling said token after a predefined number of failed attempts, monitoring one or more actions of said user and sending a notification of said drifting key alert to an administrator.
23. An article of manufacture, comprising a non-transitory machine readable recordable medium containing one or more programs which, when executed, implement the steps of:
providing an authentication passcode derived from a secret seed and generated by a token associated with a user to at least one authentication processing device, wherein said user is attempting to access a protected resource;
receiving an authentication outcome from said at least one authentication processing device, said authentication outcome comprising an acceptance outcome of the received authentication passcode and at least one of an acceptance outcome with respect to one or more of two different signals, wherein said at least one authentication processing device detects a loss of privacy of said secret seed by extracting and processing a silent alarm signal embedded in said received authentication passcode from said received authentication passcode, and wherein said silent alarm signal indicates an anomalous event detected by said token; and
controlling access of said user to said protected resource based on said authentication outcome and a predefined access policy invoked when said silent alarm signal has a predefined state indicating said detection of said anomalous event.