IP Library › Granted Patent US 10,360,356
Granted Patent B2
US 10,360,356 · App. 15/784,282 · Granted Jul 23, 2019

Authenticating users requesting access to computing resources

Inventors: Armen Moloian (Thousand Oaks, CA); John H. Kling (Bellevue, KY)
Assignee: Bank of America Corporation
G06F21/31G06F21/40G06F21/62G06F21/6218H04L63/101H04L63/102H04L63/083H04L63/108H04L63/1425
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 10,360,356
App. No.
15/784,282
Granted
Jul 23, 2019
Kind
B2
Abstract

Systems and methods are provided for monitoring access of computing resources. Usage rules may be created and stored that define a usage constraint based on actions available to be performed at the computing resources. An authenticator may verify login credentials received from a user and authorize the user to access a computing resource. A request to perform an action at the computing resource may be received, and a usage monitor may apply a usage rule to the requested action. If the requested action violates the usage constraint of the usage rule, the usage monitor may halt performance of the requested action and notify another user of the usage constraint violation. The authenticator may receive and verify another set of login credentials from that other user. In response to successful verification of the additional set of login credentials, the usage monitor may resume performance of the requested action.

Claims (63)

1. A computer-implemented method of user authentication comprising:

storing, at a data store of a first computing device, an authentication rule used to authenticate a user, the authentication rule indicating a plurality of sets of first identity elements, each set of first identity elements comprising a plurality of first identity elements used for authentication of the user, wherein the plurality of sets of first identity elements comprises (i) a first set of first identity elements associated with a first user type, and (ii) a second set of first identity elements associated with a second user type different from the first user type;

receiving, at the first computing device from a second computing device operated by the user, a request that a computing resource perform an action;

receiving, at the first computing device from the second computing device, a set of second identity elements comprising one or more second identity elements usable for authentication of the user, wherein the second computing device and the user are unaware of which first identity elements need to be submitted for the first computing device to grant the request;

selecting, by the first computing device and from among the plurality of sets of first identity elements, a set of first identity elements to use for authentication of the user;

performing, by the first computing device, an authentication attempt by verifying, for each first identity element of the set of first identity elements selected, a second identity element, of the set of second identity elements received, which corresponds to that first identity element; and

based on unsuccessful authentication of the user, indicating, by the first computing device, that at least one additional identity element is needed in order to grant the request, but without identifying the at least one additional identity element to the second computing device or the user.

2. The computer-implemented method of claim 1 , wherein:

the first computing device selects the set of first identity elements at random from the plurality of sets of first identity elements.

3. The computer-implemented method of claim 1 , wherein:

the first computing device selects one of the first or second sets of first identity elements as the set of first identity elements based on a user type of the user.

4. The computer-implemented method of claim 1 , wherein:

the plurality of sets of first identity elements comprises (i) a first set of second identity elements associated with a first action type, and (ii) a second set of second identity elements associated with a second action type different from the first action type; and

the first computing device selects one of the first or second sets of second identity elements as the set of first identity elements based on an action type of the action requested.

5. The computer-implemented method of claim 1 , wherein:

the plurality of sets of first identity elements comprises (i) a first set of second identity elements associated with a first timeframe, and (ii) a second set of second identity elements associated with a second timeframe different from the first timeframe; and

the first computing device selects one of the first or second sets of second identity elements as the set of first identity elements based on a timeframe during which the request was received.

6. The computer-implemented method of claim 5 , wherein:

the first and second timeframes each comprise at least one of a day-of-the-week or a time-of-day.

7. The computer-implemented method of claim 5 , wherein:

the first timeframe comprises a previous timeframe within which the user previously requested one or more computing resources perform one or more actions.

8. The computer-implemented method of claim 1 , wherein:

the plurality of sets of first identity elements comprises (i) a first set of second identity elements associated with a first geographic location, and (ii) a second set of second identity elements associated with a second geographic location different from the first geographic location; and

the first computing device selects one of the first or second sets of second identity elements as the set of first identity elements based on a geographic location of the user.

9. The computer-implemented method of claim 1 , wherein:

the plurality of sets of first identity elements comprises (i) a first set of second identity elements associated with a first device location, and (ii) a second set of second identity elements associated with a second device location different from the first device location; and

the first computing device selects one of the first or second sets of second identity elements as the set of first identity elements based on a location of the second computing device operated by the user.

10. The computer-implemented method of claim 9 , wherein:

the first device location is internal to a network within which the first computing device resides; and

the second device location is external to that network.

11. A computing device comprising:

one or more processors;

a data store storing an authentication rule used to authenticate a user, the authentication rule indicating a plurality of sets of first identity elements, each set of first identity elements comprising a plurality of first identity elements used for authentication of the user, wherein the plurality of sets of first identity elements comprises (i) a first set of first identity elements associated with a first user type, and (ii) a second set of first identity elements associated with a second user type different from the first user type; and

memory storing executable instructions that, when executed by the one or more processors, cause the computing device to:

receive, from a second computing device operated by a user, a request that a computing resource perform an action;

receive, from the second computing device, a set of second identity elements comprising one or more second identity elements usable for authentication of the user, wherein the second computing device and the user are unaware of which first identity elements need to be submitted for the computing device to grant the request;

select, from among the plurality of sets of first identity elements, a set of first identity elements;

perform, an authentication attempt by verifying, for each first identity element of the set of first identity elements selected, a second identity element, of the set of second identity elements received, which corresponds to that first identity element;

based on successful authentication of the user, grant the request; and

based on unsuccessful authentication of the user, indicate, that at least one additional identity element is needed in order to grant the request, but without identifying the at least one additional identity element to the second computing device or the user.

12. The computing device of claim 11 , wherein:

the computing device selects the set of first identity elements at random from the plurality of sets of first identity elements.

13. The computing device of claim 11 , wherein:

the computing device selects one of the first or second sets of first identity elements as the set of first identity elements based on a user type of the user.

14. The computing device of claim 11 , wherein:

the plurality of sets of first identity elements comprises (i) a first set of second identity elements associated with a first action type, and (ii) a second set of second identity elements associated with a second action type different from the first action type; and

the computing device selects one of the first or second sets of second identity elements as the set of first identity elements based on an action type of the action requested.

15. The computing device of claim 11 , wherein:

the plurality of sets of first identity elements comprises (i) a first set of second identity elements associated with a first timeframe, and (ii) a second set of second identity elements associated with a second timeframe different from the first timeframe; and

the computing device selects one of the first or second sets of second identity elements as the set of first identity elements based on a timeframe during which the request was received.

16. The computing device of claim 15 , wherein:

the first and second timeframes each comprise at least one of a day-of-the-week or a time-of-day.

17. The computing device of claim 15 , wherein:

the first timeframe comprises a previous timeframe within which the user previously requested one or more computing resources perform one or more actions.

18. The computing device of claim 11 , wherein:

the plurality of sets of first identity elements comprises (i) a first set of second identity elements associated with a first geographic location, and (ii) a second set of second identity elements associated with a second geographic location different from the first geographic location; and

the computing device selects one of the first or second sets of second identity elements as the set of first identity elements based on a geographic location of the user.

19. The computing device of claim 11 , wherein:

the plurality of sets of first identity elements comprises (i) a first set of second identity elements associated with a first device location, and (ii) a second set of second identity elements associated with a second device location different from the first device location; and

the computing device selects one of the first or second sets of second identity elements as the set of first identity elements based on a location of the second computing device operated by the user.

20. The computing device of claim 19 , wherein:

the first device location is internal to a network within which the computing device resides; and

the second device location is external to that network.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Oct 16, 2017
From: MOLOIAN, ARMEN; KLING, JOHN H.
To: BANK OF AMERICA CORPORATION
Reel/Frame 043870/0067 →
Continuity (3)
Continuation 15048283 · Feb 19, 2016
Continuation 14483589 · Sep 11, 2014
Related Publication 20180039764A1 · Feb 8, 2018