Systems and methods for extensible, modular, and hierarchical step-up authentication
Systems and methods for a hierarchical step-up authentication mechanism include monitoring access to one or more private applications; responsive to a request to access the one or more private applications, determining an Authentication Level (AL) of a user associated with the request, wherein determining the AL of the user comprises referencing one or more AL trees; and responsive to determining an AL of the user, performing one or more actions based thereon, wherein the one or more actions comprises one of allowing access to the one or more private applications and denying access to the one or more private applications.
1 . A method comprising steps of:
monitoring access to one or more private applications;
responsive to a request to access the one or more private applications, determining an Authentication Level (AL) of a user associated with the request, wherein determining the AL of the user comprises referencing one or more AL trees, each of the one or more AL trees comprising a plurality of ALs arranged in a parent-child hierarchy, each AL of the plurality of ALs representing an authentication strength tier for authentication of the user, wherein a parent AL in the parent-child hierarchy represents a higher authentication strength tier than any child AL descending therefrom, and wherein the user having authenticated to a given AL is granted access commensurate with the given AL and each child AL descending from the given AL; and
responsive to determining an AL of the user, performing one or more actions based thereon, wherein the one or more actions comprises one of allowing access to the one or more private applications and denying access to the one or more private applications.
2 . The method of claim 1 , wherein referencing one or more AL trees is based on any of a geographic location of the user and an application segment associated with the one or more private applications.
3 . The method of claim 1 , wherein access to each of the one or more private applications is based on an AL required by each of the one or more private applications.
4 . The method of claim 3 , wherein responsive to determining the AL of the user is a lower AL than that required by the one or more private applications, the one or more actions comprise prompting the user to authenticate to a required AL based on the one or more private applications.
5 . The method of claim 1 , wherein each of the one or more AL trees comprises one or more parent ALs and one or more child ALs.
6 . The method of claim 5 , wherein each of the one or more parent ALs and one or more child ALs has a timeout period associated therewith, and wherein the timeout period of each parent AL is shorter than the timeout period of each child AL descending therefrom.
7 . The method of claim 6 , wherein the steps comprise:
responsive to the timeout period of the AL of the user expiring, automatically demoting the AL of the user to a child AL of the AL of the user.
8 . The method of claim 6 , wherein the determining comprises determining the AL of the user is a higher AL than an AL required by the one or more private applications, and wherein the steps comprise allowing access to the one or more private applications based thereon.
9 . The method of claim 8 , wherein responsive to a timeout period of the AL of the user expiring, continuing a session for the user based on a child AL of the AL of the user being at or above an AL required by the one or more private applications.
10 . The method of claim 1 , wherein responsive to determining the AL of the user, the one or more actions comprise allowing access to one or more applications requiring a lower AL than the AL of the user.
11 . A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors to perform steps of:
monitoring access to one or more private applications;
responsive to a request to access the one or more private applications, determining an Authentication Level (AL) of a user associated with the request, wherein determining the AL of the user comprises referencing one or more AL trees, each of the one or more AL trees comprising a plurality of ALs arranged in a parent-child hierarchy, each AL of the plurality of ALs representing an authentication strength tier for authentication of the user, wherein a parent AL in the parent-child hierarchy represents a higher authentication strength tier than any child AL descending therefrom, and wherein the user having authenticated to a given AL is granted access commensurate with the given AL and each child AL descending from the given AL; and
responsive to determining an AL of the user, performing one or more actions based thereon, wherein the one or more actions comprises one of allowing access to the one or more private applications and denying access to the one or more private applications.
12 . The non-transitory computer-readable medium of claim 11 , wherein referencing one or more AL trees is based on any of a geographic location of the user and an application segment associated with the one or more private applications.
13 . The non-transitory computer-readable medium of claim 11 , wherein access to each of the one or more private applications is based on an AL required by each of the one or more private applications.
14 . The non-transitory computer-readable medium of claim 13 , wherein responsive to determining the AL of the user is a lower AL than that required by the one or more private applications, the one or more actions comprise prompting the user to authenticate to a required AL based on the one or more private applications.
15 . The non-transitory computer-readable medium of claim 11 , wherein each of the one or more AL trees comprises one or more parent ALs and one or more child ALs.
16 . The non-transitory computer-readable medium of claim 15 , wherein each of the one or more parent ALs and one or more child ALs has a timeout period associated therewith, and wherein the timeout period of each parent AL is shorter than the timeout period of each child AL descending therefrom.
17 . The non-transitory computer-readable medium of claim 16 , wherein the steps comprise:
responsive to the timeout period of the AL of the user expiring, automatically demoting the AL of the user to a child AL of the AL of the user.
18 . The non-transitory computer-readable medium of claim 16 , wherein the determining comprises determining the AL of the user is a higher AL than an AL required by the one or more private applications, and wherein the steps comprise allowing access to the one or more private applications based thereon.
19 . The non-transitory computer-readable medium of claim 18 , wherein responsive to a timeout period of the AL of the user expiring, continuing a session for the user based on a child AL of the AL of the user being at or above an AL required by the one or more private applications.
20 . The non-transitory computer-readable medium of claim 11 , wherein responsive to determining the AL of the user, the one or more actions comprise allowing access to one or more applications requiring a lower AL than the AL of the user.