Cumulative authentication for step-up increased authentication factors
Techniques are disclosed for providing an authentication service that performs authentication of users on behalf of a relying party. The authentication service receives authentication requirements from the relying party and compares those requirements with authentication capabilities of the user and user equipment. If the authentication requirements are met, the authentication service may perform authentication using the corresponding authentication factors. If the available authentication factors are insufficient or the user fails authentication using the authentication factors used by the authentication service, the relying party may be notified that authentication failed. Upon successful authentication, the authentication service notifies the requiring party that the user has been authenticated.
1. A system for authenticating a user to a relying party, comprising:
one or more processors; and
memory in communication with the one or more processors, the memory having instructions which, when executed, cause the one or more processors to at least:
access a set of authentication requirements received from the relying party, the set of authentication requirements including a threshold authentication score;
determine a filtered set of available authentication factors for a user device, the filtered set of available authentication factors to include only authentication factors that are user preferred authentication factors, and respective ones of the available authentication factors having respective authentication values;
attempt to select a subset of the filtered set of available authentication factors, the subset of the filtered set having a combined authentication value that meets the threshold authentication score, the attempt to select to include:
identifying respective subsets of the filtered set of available authentication factors;
generating respective, combined authentication values for the respective subsets; and
determining whether any of the respective, combined authentication values of the respective, subsets of the filtered set of available authentication factors meets the threshold authentication score;
when none of the respective subsets of the filtered set of authentication factors has a combined authentication value that meets the threshold authentication score, cause the authentication to fail, without attempting authentication using any of the set of candidate authentication factors;
when at least one of the respective subsets of the filtered set of authentication factors has a combined authentication value that meets the threshold authentication score, use a selected one of the at least one of the respective subsets of the filtered set of authentication factors to attempt authentication of the user on the user device; and
indicate success or failure of the authentication.
2. The system of claim 1 , wherein the set of authentication requirements further includes a set of permitted authentication factors, and the set of candidate authentication factors is limited by the set of permitted authentication factors.
3. The system of claim 1 , wherein the instructions further cause the one or more processors to:
determine whether a previously performed authentication can be reused; and
reuse the previously performed authentication, responsive to the determination, without requesting credentials from the user.
4. The system of claim 3 , wherein the instructions cause the one or more processors to determine whether the previously performed authentication can be reused by:
evaluating whether an expiration timeframe associated with a first authentication factor of the selected subset of the filtered authentication factors has expired; and
determining the previously performed authentication can be reused responsive to an evaluation that the expiration timeframe has not expired.
5. A non-transitory machine readable medium, comprising instructions which, when executed by a machine, cause the machine to at least:
access authentication requirements received from a relying party, the authentication requirements including a threshold authentication score;
determine a filtered set of available authentication factors for a user device, respective ones of the filtered set of available authentication factors associated with respective authentication values, and the filtered set of available authentication factors to exclude authentication factors that are not user preferred authentication factors;
attempt to select a subset of the filtered set of available authentication factors having a combined authentication value that meets the threshold authentication score;
when the attempt to select the subset of the filtered set of available authentication factors having a combined authentication value that meets the threshold authentication score fails, cause the authentication to fail, without requesting that a user of the user device supply any authenticating inputs;
when the attempt to select the subset of the filtered set of available authentication factors having a combined authentication value that meets the threshold authentication score succeeds, attempt to authenticate the user on the user device using the selected subset of the filtered set of available authentication factors; and
indicate success or failure of the attempt to authenticate.
6. The machine readable medium of claim 5 , wherein the set of authentication requirements further includes a set of permitted authentication factors, and the filtered set of available authentication factors is limited by the set of permitted authentication factors.
7. The machine readable medium of claim 5 , wherein the instructions further cause the machine to:
determine whether a previously successful authentication can be reused; and
reuse the previously successful authentication, responsive to the determination, without requesting credentials from the user.
8. The machine readable medium of claim 7 , wherein the instructions cause the machine to determine whether the previously successful authentication can be reused by:
evaluating whether an expiration timeframe associated with a first one of the selected subset of the filtered set of available authentication factors has expired; and
determining the previously successful authentication can be reused responsive to an evaluation that the expiration timeframe has not expired.
9. The machine readable medium of claim 5 , wherein the filtered set of available authentication factors includes an out of band authentication factor.
10. A method for authenticating a user to a relying party, the method comprising:
receiving a set of authentication requirements from the relying party, the set of authentication requirements including a threshold authentication score;
determining a set of available authentication factors for a user device, the set of available authentication factors filtered to exclude available authentication factors that are not user preferred, and respective ones of the set of available authentication factors having respective authentication values, the respective authentication values representing a level of confidence in the respective authentication factors;
attempting to select a subset of the set of available authentication factors, the subset of the set of available authentication factors having a combined authentication value that meets the threshold authentication score;
when the attempt to select the subset of the set of available authentication factors having a combined authentication value that meets the threshold authentication score fails, causing the authentication to fail without attempting to authenticate the user of the user device;
when the attempt to select the subset of the set of available authentication factors having a combined authentication value that meets the threshold authentication score succeeds, attempt to authenticate the user on the user device using the selected subset of the set of available authentication factors; and
indicating success or failure of the attempt to authenticate the user.
11. The method of claim 10 , wherein the set of authentication requirements further includes a set of permitted authentication factors, and the set of available authentication factors is further filtered based on the set of permitted authentication factors.
12. The method of claim 10 , further including:
determining whether an authentication previously performed using a first available authentication factor of the set of available authentication factors can be reused; and
reusing the authentication, responsive to the determination, without requesting credentials from the user for the first available authentication factor.
13. The method of claim 12 , wherein the determining of whether the authentication previously performed using the first available authentication factor can be reused includes:
evaluating whether an expiration timeframe associated with the first available authentication factor has expired; and
determining the authentication previously performed can be reused responsive to an evaluation that the expiration timeframe has not expired.
14. The method of claim 10 , wherein the set of available authentication factors includes an out-of-band authentication factor.