Granted Patent B2

US 12,744,775 · App. 18/590,562 · Granted Sep 22, 2026

Inventors: Steven Michael Holl (Sarasota, FL); Matthew Robert Engle (Plano, TX); Jason A. Kuhne (Hopkinton, MA); Jason Michael Coleman (Hendersonville, NC)

Assignee: CISCO TECHNOLOGY, INC.

H04L63/0861H04L63/083

Abstract

Claims (77)

1 . A method comprising:

at an identity provider, upon receiving a request for authentication of a user to a target application that is hosted on a user device and into which the user has logged-in:

storing a list of application services having trust relationships with the identity provider and that are mapped to biometric sensors provided by each application service;

identifying one or more biometric tests to be applied to the user to satisfy the request;

searching the list of application services based on the one or more biometric tests;

identifying, based on results of searching, an application service which has an active session with the user and supports the one or more biometric tests;

requesting the application service to perform multifactor authentication that includes the one or more biometric tests;

receiving, from the application service, biometric test results that indicate whether each of the one or more biometric tests passed or failed; and

determining that the authentication has passed or failed based on the biometric test results.

2 . The method of claim 1 , wherein:

determining that the authentication has passed or failed includes determining that the authentication has passed when the biometric test results indicate that each biometric test has passed; and

the method further comprises: when the authentication has passed, sending an authentication token to the user device.

3 . The method of claim 2 , further comprising:

verifying that the identity provider has a trust relationship with the target application,

wherein determining that the authentication has passed further includes determining that the authentication has passed when the application service and the target application have the trust relationship and the trust relationships with the identity provider and each biometric test has passed.

4 . The method of claim 2 , wherein:

determining that the authentication has passed or failed includes determining that the authentication has failed when the biometric test results indicate that the one or more biometric tests have failed; and

the method further comprises: when the authentication has failed, sending to the user device a device request to perform the multifactor authentication of the user that is to be satisfied through the user device.

5 . The method of claim 1 , wherein:

receiving the request includes receiving the request to include a user identity of the user; and

identifying the one or more biometric tests includes searching multifactor authentication user profiles that include mappings of biometric tests to user identities based on the user identity.

6 . The method of claim 1 , wherein:

identifying the one or more biometric tests includes identifying, as the one or more biometric tests, facial recognition that includes capturing video of the user and comparing the video to a faceprint of the user, voice recognition that includes capturing voice of the user and comparing the voice to a voiceprint of the user, or fingerprint recognition that includes capturing a fingerprint reading from the user and comparing the fingerprint reading to a known fingerprint of the user; and

requesting includes requesting the application service to perform the facial recognition, the voice recognition, or the fingerprint recognition.

7 . The method of claim 1 , wherein:

the request includes a first timestamp;

the biometric test results include a second timestamp; and

the method further comprises: upon determining that the first timestamp and the second timestamp both fall within a predetermined time period, performing determining that the authentication has passed or failed.

8 . The method of claim 7 , further comprising:

upon determining that the first timestamp and the second timestamp do not both fall within the predetermined time period, not performing determining that the authentication has passed or failed.

9 . The method of claim 1 , wherein:

the biometric test results further include digital signatures appended by the application service.

10 . The method of claim 1 , wherein:

each biometric test result that indicates that a biometric test has passed further includes a confidence that the biometric test has passed; and

determining that the authentication has passed or failed includes determining that the authentication has passed when each confidence exceeds a predetermined confidence threshold.

11 . The method of claim 1 , further comprising, by the identity provider:

establishing the trust relationships with the application service; and

establishing a trust relationship with the target application.

12 . The method of claim 1 , wherein:

the application service includes a collaboration service supported by a meeting server and an endpoint device that operates under control of the meeting server and supports the one or more biometric tests.

13 . An apparatus comprising:

a network interface to communicate with a network; and

a processor of an identity provider, wherein the processor is coupled to the network interface and is configured to perform, upon receiving a request for authentication of a user to a target application that is hosted on a user device and into which the user has logged-in:

storing a list of application services having trust relationships with the identity provider and that are mapped to biometric sensors provided by each application service;

identifying one or more biometric tests to be applied to the user to satisfy the request;

searching the list of application services based on the one or more biometric tests;

identifying, based on results of searching, an application service which has an active session with the user and supports the one or more biometric tests;

requesting the application service to perform multifactor authentication that includes the one or more biometric tests;

receiving, from the application service, biometric test results that indicate whether each of the one or more biometric tests passed or failed; and

determining that the authentication has passed or failed based on the biometric test results.

14 . The apparatus of claim 13 , wherein:

the processor is configured to perform determining that the authentication has passed or failed by determining that the authentication has passed when the biometric test results indicate that each biometric test has passed; and

the processor is further configured to perform: when the authentication has passed, sending an authentication token to the user device.

15 . The apparatus of claim 14 , wherein the processor is further configured to perform:

verifying that the identity provider has a trust relationship with the target application,

wherein the processor is configured to perform determining that the authentication has passed by determining that the authentication has passed when the application service and the target application have the trust relationship and the trust relationships with the identity provider and each biometric test has passed.

16 . The apparatus of claim 14 , wherein:

the processor is configured to perform determining that the authentication has passed or failed by determining that the authentication has failed when the biometric test results indicate that the one or more biometric tests have failed; and

the apparatus further comprises: when the authentication has failed, sending to the user device a device request to perform the multifactor authentication of the user that is to be satisfied through the user device.

17 . The apparatus of claim 13 , wherein:

the processor is configured to perform receiving the request by receiving the request to include a user identity of the user; and

the processor is configured to perform identifying the one or more biometric tests by searching multifactor authentication user profiles that include mappings of biometric tests to user identities based on the user identity.

18 . A non-transitory computer readable medium encoded with instructions that, when executed by a processor of an identity provider, cause the processor to perform:

upon receiving a request for authentication of a user to a target application that is hosted on a user device and into which the user has logged-in:

storing a list of application services having trust relationships with the identity provider and that are mapped to biometric sensors provided by each application service;

identifying one or more biometric tests to be applied to the user to satisfy the request;

searching the list of application services based on the one or more biometric tests;

identifying, based on results of searching, an application service which has an active session with the user and supports the one or more biometric tests;

requesting the application service to perform multifactor authentication that includes the one or more biometric tests;

receiving, from the application service, biometric test results that indicate whether each of the one or more biometric tests passed or failed; and

determining that the authentication has passed or failed based on the biometric test results.

19 . The non-transitory computer readable medium of claim 18 , wherein:

the instructions to cause the processor to perform determining that the authentication has passed or failed include instructions to cause the processor to perform determining that the authentication has passed when the biometric test results indicate that each biometric test has passed; and

the instructions further comprise instructions to cause the processor to perform: when the authentication has passed, sending an authentication token to the user device.

20 . The non-transitory computer readable medium of claim 19 , further comprising instructions to cause the processor to perform:

verifying that the identity provider has a trust relationship with the target application,

wherein the instructions to cause the processor to perform determining that the authentication has passed further include instructions to cause the processor to perform determining that the authentication has passed when the application service and the target application have the trust relationship and the trust relationships with the identity provider and each biometric test has passed.

Assignments (1)

Continuity (1)

References Cited (97)