Query system and method to determine authentication capabilities
A system, apparatus, method, and machine readable medium are described for determining the authentication capabilities. For example, one embodiment of a method comprises: receiving a policy identifying a set of acceptable authentication capabilities; determining a set of client authentication capabilities; and filtering the set of acceptable authentication capabilities based on the determined set of client authentication capabilities to arrive at a filtered set of one or more authentication capabilities for authenticating a user of the client.
1. A method comprising:
receiving a policy identifying a set of acceptable authentication capabilities;
determining a set of client authentication capabilities of a client by identifying, by the client based on a secure storage of the client, a set of authentication devices on the client corresponding to the set of client authentication capabilities;
filtering, by the client, the set of acceptable authentication capabilities based on a privacy preference level of a user of the client and the determined set of client authentication capabilities to arrive at a filtered set of one or more authentication capabilities for authenticating the user; and
using the filtered set of one or more authentication capabilities to authenticate the user over a network.
2. The method as in claim 1 wherein the policy comprises a set of authentication device types and/or classes deemed acceptable by a network server.
3. The method as in claim 1 further comprising:
displaying one or more of the filtered set of authentication capabilities in a graphical user interface (GUI);
querying the user to select or prioritize one or more of authentication capabilities from the GUI; and
generating a filtered, user specified list of authentication capabilities based on user input to the query.
4. The method as in claim 1 wherein the authentication capabilities include a fingerprint sensor.
5. The method as in claim 1 wherein the authentication capabilities include voice authentication capabilities.
6. The method as in claim 1 wherein the authentication capabilities include a smartcard.
7. The method as in claim 1 wherein the authentication capabilities include a trusted platform module (TPM).
8. The method of claim 1 , wherein the filtering of the set of acceptable authentication capabilities is further based on an authentication capability priority.
9. The method of claim 1 , wherein using the filtered set of the one or more authentication capabilities including generating and sending a set of keys for each of the filtered set of the one or more authentication capabilities to the server.
10. A system comprising:
a client to receive a policy identifying a set of acceptable authentication capabilities and to determine a set of client authentication capabilities, the client comprising a secure storage with which the client identifies a set of authentication devices on the client corresponding to the set of client authentication capabilities, the client further comprising a policy filter to filter the set of acceptable authentication capabilities based on a privacy preference level of a user of the client and the determined set of client authentication capabilities to arrive at a filtered set of one or more authentication capabilities for authenticating a user of the client; and
the client to use the filtered set of one or more authentication capabilities to authenticate the user over a network.
11. The system as in claim 10 wherein the policy comprises a set of authentication device types and/or classes deemed acceptable by a network server.
12. The system as in claim 11 further comprising:
the client displaying one or more of the filtered set of authentication capabilities in a graphical user interface (GUI);
querying the user to select or prioritize one or more of authentication capabilities from the GUI; and
generating a filtered, user specified list of authentication capabilities based on user input to the query.
13. The system as in claim 10 wherein the authentication capabilities include a fingerprint sensor.
14. The system as in claim 10 wherein the authentication capabilities include voice authentication capabilities.
15. The system as in claim 10 wherein the authentication capabilities include a smartcard.
16. The system as in claim 10 wherein the authentication capabilities include a trusted platform module (TPM).
17. A non-transitory machine: readable medium having program code stored thereon which, when executed by a machine, causes the machine to perform operations of:
receiving a policy identifying a set of acceptable authentication capabilities;
determining a set of client authentication capabilities of a client by identifying, by the client based on a secure storage of the client, a set of authentication devices on the client corresponding to the set of client authentication capabilities;
filtering, by the client, the set of acceptable authentication capabilities based on a privacy preference level of a user of the client and the determined set of client authentication capabilities to arrive at a filtered set of one or more authentication capabilities for authenticating a user of the client; and
using the filtered set of one or more authentication capabilities to authenticate the user over a network.
18. The non-transitory machine readable medium as in claim 17 wherein the policy comprises a set of authentication device types and/or classes deemed acceptable by a network server.
19. The non-transitory machine readable medium as in claim 17 comprising additional program code to cause the machine to perform operations of:
displaying one or more of the filtered set of authentication capabilities in a graphical user interface (GUI);
querying the user to select or prioritize one or more of authentication capabilities from the GUI; and
generating a filtered, user specified list of authentication capabilities based on user input to the query.