Authentication management

A method of managing authentication during a user session comprises the steps of operating a user session for a specific user, maintaining a user authentication level for the user session, monitoring one or more factors relating to the user's activity, applying one or more rules to the monitored factors, detecting that a rule has indicated the user's current authentication level is too high, and lowering the user's authentication level, without ending the user's session.

CROSS-REFERENCE TO RELATED APPLICATION(S)

This application claims the benefit of priority to United Kingdom Patent Application No. GB 1415067.6, filed Aug. 26, 2014, the entire contents of which are incorporated herein by reference.

FIELD OF THE INVENTION

This invention relates to a method of, and system for, managing authentication during a user session.

BACKGROUND

In many different applications, users have to be authenticated. For example, when a user accesses online banking services, they will need to perform some form of authentication using a password and possibly other authentication processes to access the online banking service. In providing access to data storage systems, it is also common to authenticate users who which to access and/or change information that is stored by the storage system. It is also common to have different levels of authentication, with so-called step-up authentication being used if the user wishes to undertake a specific task during their user session. For example, in the case of an online banking service, the transfer of money above a certain level may well require the user to entire further secure information to authenticate the particular transaction. In the case of the data storage system, the ability to delete files may require a higher level of authorization for the current user session.

This concept of step-up authentication is applied to situations where elevated authority is required during a user session, perhaps for a limited period of time. For example, a user may elevate their session privilege from the command line by authenticating with sudo. The same user may then intentionally reduce the level of authority associated with their session once the elevated task has been completed. However, the decision to reduce the user's level of authority is taken by the user themselves.

BRIEF SUMMARY OF THE INVENTION

According to a first aspect of the present invention, there is provided a method of managing authentication during a user session, the method comprising the steps of operating a user session for a specific user, maintaining a user authentication level for the user session, monitoring one or more factors relating to the user's activity, applying one or more rules to the monitored factors, detecting that a rule has indicated the user's current authentication level is too high, and lowering the user's authentication level, without ending the user's session.

According to a second aspect of the present invention, there is provided a system for managing authentication during a user session, the system comprising a processor arranged to operate a user session for a specific user, maintain a user authentication level for the user session, monitor one or more factors relating to the user's activity, apply one or more rules to the monitored factors, detect that a rule has indicated the user's current authentication level is too high, and lower the user's authentication level, without ending the user's session.

According to a third aspect of the present invention, there is provided a computer program product on a computer readable medium for managing authentication during a user session, the product comprising instructions for operating a user session for a specific user, maintaining a user authentication level for the user session, monitoring one or more factors relating to the user's activity, applying one or more rules to the monitored factors, detecting that a rule has indicated the user's current authentication level is too high, and lowering the user's authentication level, without ending the user's session.

Owing to the invention, it is possible to provide a method for extending established stepped authentication schemes to enforce an automated, periodic validation of intent, leading to an automated step-down of privilege. The validation process is policy-driven and has the ability to reduce the level of privilege associated with a user's session, thereby de-authorising the user or “stepping-down” their current level of authorization. The evaluation depends on one or more factors to determine if a condition for step-down has been met. The methodology operates by utilising a system-configurable set of factors, such as current location, the user's activity history or predictive analysis that indicates that a raised authority is no longer, or is not likely to be, required.

In summary, the purpose of step-down, as with step-up, is to provide a granular mechanism for risk management. The purpose of automating the step-down process is to move the management responsibility from the user, whose priority is to perform a task as quickly and/or cheaply as possible, to an autonomous service where the priority can be managed in policy by the business or service provider. The level of the user's authentication in the current session can be automatically reduced, without the user being logged out of their current activity.

For example, a user having previously stepped-up their level of access, is now performing tasks for which a lower level would suffice. Given that their intent has changed, the system may autonomously reduce their privilege to an appropriate level. In another example, a user has elevated access but performs an activity in an unusual fashion, based on usage analysis. The method for step-down has important implications and benefits in situations where the confidence of the system that a user is who they claim to be may vary, improving and degrading, over time during a single user session. The system autonomously evaluates a condition for reducing privilege based on combined factors, without the need for, and regardless of, user involvement in the evaluation process.

A privilege level is associated with the user's current session. This level increases as the user steps-up and decreases as the user steps-down. The exact nature of the privilege level is solution-specific: a percentage may be suitable for some cases, whereas a simple 1-2-3-4 indicator may be sufficient for others. In all cases, the step-up/step-down mechanism has a differentiating effect on the privilege level on a given session. The methodology provides an autonomous, context-sensitive step-down authentication process that decreases the privilege level.

The automatic change in the user's authentication level with respect to the current session will happen transparently in the background as the user is performing tasks in the current session. The user is not necessarily aware of the change in their level of authentication, but it can also be outputted to the user, for example using an on-screen indication. This on-screen indication may use a numbering system or colour system, for example, to indicate to the user the user's authentication level of the current session. As the user performs actions in the current session, this may lead to the automatic step-down in authorization, and this can be shown to the user through the on-screen symbol.

In one preferable embodiment, the user's current authentication level can be detected as being too high when the authentication level of the user's current task is lower than the user's current authentication level for a predefined time period. If the user has previously raised their authentication level for a specific purpose (for example for a money transfer in an online banking system) then this raised level may no longer be needed. As the user continues with their session, they may continue with activities such as checking bank balances and interest rates and so on. These lower level tasks, in authentication terms, after a predefined time period has elapsed, will result in the system automatically lowering the user's authentication to a level that is appropriate for the current task.

DETAILED DESCRIPTION OF THE DRAWINGS

An example scenario in the context of a mobile banking session is illustrated byFIG. 1, which shows a user10with a mobile device12who is accessing an online banking application run by a server14. The user10logs into a mobile app being run by their device12. The user10checks their account balance. All user activity is captured by the server14for analysis. The user10clicks a “Make Payment” option and is required to authenticate again to step-up to an appropriate level of privilege. This user activity is captured by the server14for analysis and the user interface of the device12may visually represent the current level of privilege. The user10performs the online payment.

Once the payment has been made, the user10no longer requires elevated access to their account. If the user10continues to interact with the app, for example by performing low-risk tasks, the server14may deduce that the elevated privilege is no longer required (for example a policy could enforce a maximum number of low-risk actions before step-down must be enforced). At this point the user's privilege is reduced to a more appropriate level, based on an analysis of tasks currently being performed. This step-down is completely autonomous, initiated by the server14based upon analysis of one or more factors, such as activity history and environmental aspects, such as current location. For example, should there be a significant change in the local context such that the phone12moves beyond a boundary of a safe location such as the user's home, then this can be used as the basis for a step-down in authentication.

As a simple example implementation, the step-down algorithm run by the server14may count the number of low-risk tasks performed and once a threshold has been met would perform the step-down. Other implementations are feasible and may include additional factors, that are environmental, temporal or user-activity based. A variation of the scenario has an unauthorised user attempt to use the mobile banking app. In the event that they are able to log in (for example a family member is given the password, or the app was previously left logged in), then the server14may deduce that the user10does not interact in the same style and decide to enforce an automated step-down to contain the risk.

FIG. 2shows a flowchart that summarises the method of managing authentication during a user session. Once a user10has connected to a service or accessed a file system that requires the user10to identify themselves, then a user session has been started. The user may also have performed some sort of authentication, for example by supplying a password, when the user session was initiated. The method comprises, firstly, step S2.1, which comprises operating the user session for the specific user10. At step S2.2, the method also comprises maintaining a user authentication level for the user session. The authentication level can be a simple numerical scale from 1 to 4, for example, where 1 is the lowest level of authentication and 4 is the highest level.

The next step in the method is step S2.3, which comprises monitoring one or more factors relating to the user's activity. These factors could be the authentication level of the user's current task and/or the current location of the user, for example. In the illustration ofFIG. 1, the server14is delivering the online banking service and is also capturing the information about the user's current session that is defined by the different factors. These factors are stored continually for the specific user10and are used to drive the decision concerning whether it is appropriate to the step-down the current authentication level of the user for the current user session.

At step S2.4, the next step of the method comprises applying one or more rules to the monitored factors. Predefined rules are applied to the monitored factors and at step S2.5if it is detected that a rule has indicated the user's current authentication level is too high, then at step S2.6the user's authentication level is lowered, without ending the user's session. For example, a rule may define the user's current authentication level as being too high when the authentication level of the user's current task is lower than the user's current authentication level for a predefined time period. Once this rule fires in relation to the relevant monitored factor, then the user's authentication level will be reduced.

FIG. 3shows a different arrangement, whereby the user10is accessing a file management system that is stored by multiple databases16. Access to the databases16is mediated by the server14, which is controlled by a computer program product on a computer readable medium18, which is a CD-ROM18. The server14has a processor which is operated by instructions of the computer program product that is stored by the CD-ROM18. The user connects to the server14via a terminal20, which is a conventional desktop computing system that is connected to the server14via a local network such as an Ethernet network.

The user's authentication level can be defined as a simple numerical scale from 1 to 4, where 1 is the lowest level of authentication and 4 is the highest level. In this example, level 1 could equate to read-only access to unrestricted files, level 2 could equate to read-only access to all files, level 3 could equate to read-only access to all files plus read/write access to unrestricted files and level 4 could equate to read/write access to all files. This hierarchy of authorization levels is mediated by the server14which is operating the user's session with respect to the access to the file system stored by the databases16.

When the user10first logs-in to create a new user session, the server14will set the user's authorization level to a default level, which could be level 1. If the user10wishes to step-up their level of authorization, for example because they wish to amend a file, then they will need to perform the necessary step-up authorization, such as supplying a password, or using a smartcard with a smartcard reader connected to their terminal20. The server14is constantly monitoring the user's interaction and will automatically step-down the user's authorization after any step-up if the relevant criteria are met which will dictate the automatic reduction in the user's authentication level for the current user session.

FIG. 4shows the user10with their mobile device12inside their home22. The user10is accessing an online banking service via their mobile device12. The mobile device12is connected via a local wireless network (such as WiFi) to a local wireless router24, which has a wired connection to an external network such as the Internet. The user's mobile device12also has wide area wireless connectivity such as that provided by the wireless 3G network. The mobile device12will default to using the local wireless network provided by the wireless router24. If the local wireless connection is unavailable, then the connection will switch to the 3G service.

As the user10accesses their online banking service, then they create a user session, which will have an authentication level maintained for that user session, which will be stepped-up as needed, depending on the tasks undertaken by the user10during the user session. Various factors of the user are monitored during the user session which relate to the user's activity. A monitored factor can comprise the current location of the user10, which can be inferred from the location of the mobile device12. Most mobile devices with wireless connectivity can have their location identified reasonably accurately, either by using GPS information from the device12or through knowledge of the current mobile phone cell.

As discussed above, various rules are used to determine if the user's current authentication level is too high and should be automatically reduced. A rule can define the user's current authentication level as being too high when the user's current location is outside of a predefined safe territory. This safe territory may be defined as the user's home22, for example and in this case, should the mobile device12be detected as being no longer in the user's home, then an automatic step-down of the user's authentication can be performed. The provider of the online banking service can monitor the user's location during their user session and react to changes in that location, according to the rules relating to the topic.

FIG. 5shows a further view of the terminal20, used in the example ofFIG. 3, where the user10is accessing a file management system. The terminal20includes a display device26, which provides a graphical user interface to the file management system. The user interacts with the file management system through the graphical user interface and logs-in to create their user session via the graphical user interface. To create a user session, the user must log-in with their username and password, which will set the user's authentication level to the lowest possible level, level 1. If the user wishes to the perform actions that require a higher authentication level, then they will need to later step-up their authentication level.

The graphical user interface includes within it an indication28, which is an indication of the user's current authentication level. Although in this example, the authentication level is defined as being on a numerical scale from 1 to 4, other indications28could be used, for example using colour or English language terms, such as “low”, “medium” and “high”. The indication28is provided to inform the user10of the current level of authentication that the user has during the current user session. As the user10steps-up their authentication level, for example by entering an administrator's password to delete files within the file management system, then this will be reflected by change to the indication28.

Similarly, if there is any step-down in the user's authentication level then the indication28will change in response to the lowering of the user's authentication level. The user10is provided with immediate visual feedback of the change in the authentication level of the user10for the current user session. As discussed above, the monitoring process that may change the user's authentication level occurs transparently in the background and the user10may otherwise be unaware of the change in their current authorization level. The use of the indication28ensures that visual feedback is provided to the user10, in relation to their current authentication level for the current user session.

FIG. 6illustrates schematically the calculation of an authentication level32, from the point of view of the server14, which includes a processor30that is responsible for the maintaining of the user's current authorization level32. The processor30is shown as a standalone component within the server14, but is essentially a software function that is being executed by a suitable hardware component that is performing other processing tasks in parallel. As detailed above, an appropriate computer program product comprised of a set of instructions controls the operation of the automatic process that sets the authentication level32. Any changes to the authentication level are determined by the processor30.

The user10initiates a user session34, which is run by the server14, and the processor30monitors the user session34with respect to the defined factors36, which define those factors36that relate to the user's activity that are to be monitored during the user session34. As discussed above, the factors36could relate to a wide range of different aspects of the user's activity. For example, the tasks being undertaken by the user10can be monitored and classified according to the type of task undertaken, for example with a view to understanding the authentication level32required by those tasks.

Also available to the processor30are the rules38that define how the monitored factors36are to be interpreted in order to result in a change to the authorization level32. Any automatic step-down in the authentication level32is defined by the rules38which contain clauses relative to the monitored factors36. The processor30will continually check the rules38against the monitored factors36to see if any defined circumstance has arisen that will lead to the automatic stepping-down of the current authentication level32for the current user session34. In this way a seamless and transparent process is run that will lower the user's authentication level32if it is determined that the level32is too high.