Advanced application security utilizing an application key

Embodiments of the invention provide a method, system and computer program product for advanced application authentication utilizing an application key. In a method of the invention, an end user provides in a single user interface screen for authenticating into an application, each of a user identification, password and an application key. Thereafter, the application key is validated in connection with the user identification. If the application key validates in connection with the user identification, one or more application parameters for the application necessary to complete a log-in process are retrieved and the end user is authenticated into the application utilizing each of the user identification, password and application parameters so as to complete the log in process for the end user and the application and the end user is granted the ability to utilize the application.

BACKGROUND OF THE INVENTION

Field of the Invention

The present invention relates to application authentication.

Description of the Related Art

Authentication refers to the testing of an identity of an end user of an application to ensure proper authorization of the end user to access the application. Traditional methods of performing application authentication include general password authentication in which an end user submits in response to a prompt a predetermined password in order to gain access to the device. More advanced forms of password authentication involve the submission of any combination of a user identifier, private key or passphrase in addition to one or more answers to one or more corresponding challenge questions. Even more advanced modes of application authentication involve biometric analysis in which the fingerprint, voice print or iris scan of an end user can be compared to a pre-stored print in order to assure the authorized access of a submitting end user.

The integrity of the authentication process is largely dependent upon the ability of the end user to maintain the confidentiality of the identification and password of the end user. The loss of a password in many cases permits an unauthorized individual to successfully authenticate into an application. In consideration of the possibility of a breach of a simplistic authentication scheme, modern authentication schemes provide additional layers of protection. Those additional layers include requiring additional information from the end user, sensing when an authentication attempt occurs from an unfamiliar device and requiring the additional information, or requiring the provision of specific parameters requisite to the proper authentication of an end user into the application including the network addressing of a particular server, or the specification of a port or domain through which the end user accesses the application.

Requiring an enhanced authentication scheme, though, is not without its drawbacks. In particular, requiring the end user to remember multiple different parameters, passwords and identifiers is burdensome upon the end user and the end user often is at risk of simply forgetting critical information necessary to successfully authenticate into the application. As well, providing a multiplicity of prompts to the end user during authentication can be an irritant to the end user and can dissuade the end user from using the application in the first instance. Thus, an enhanced albeit non-burdensome authentication scheme would be desirable.

BRIEF SUMMARY OF THE INVENTION

Embodiments of the present invention address deficiencies of the art in respect to application authentication and provide a novel and non-obvious method, system and computer program product for advanced application authentication utilizing an application key. In an embodiment of the invention, a method for advanced application authentication utilizing an application key includes receiving from an end user of an application executing in memory of a computer in a single authentication user interface for the application, each of a user identification, a password and a separate application key and validating the application key in respect to the end user. Thereafter, in response to the validation of the application key in respect to the user identification, in connection with the application key one or more application parameters necessary to complete a log-in process for the application and to grant use of the application by the end user are retrieved, and the end user is authenticated into the application utilizing the user identification, password and the application parameters so as to complete the log-in process thereby granting use of the application by the end user.

In one aspect of the embodiment, the log-in parameters include at least a server address at which the application is accessed. In another aspect of the embodiment, the log-in parameters additionally include a port at which the application is accessed. In yet another aspect of the embodiment, the log-in parameters include a state configuration value for an initial state of the application presented when the end user is granted use of the application. Optionally, the application key is a numerical set of digits; however, in the alternative the application may be a token disposed in a file in an end user computing device of the end user.

In another embodiment of the invention, a data processing system is configured for advanced application authentication utilizing an application key. The system includes a host computing platform including one or more computers each with memory and at least one processor. An application is disposed in fixed storage of the host computing platform and an advanced application authentication module that includes program code executing in the memory of the host computing platform is provided. The program code is enabled to receive from an end user of the application in a single authentication user interface for the application, each of a user identification, a password and a separate application key, to validate the application key in respect to the end user, and to respond to the validation of the application key in respect to the user identification by retrieving in connection with the application key one or more application parameters necessary to complete a log-in process for the application and to grant use of the application by the end user, and authenticating the end user into the application utilizing the user identification, password and the retrieved application parameters so as to complete the log-in process for the application thereby granting use of the application by the end user.

DETAILED DESCRIPTION OF THE INVENTION

Embodiments of the invention provide for advanced application authentication utilizing an application key. In accordance with an embodiment of the invention an end user provides in a single user interface screen for authenticating into an application, each of a user identification, password and an application key. Thereafter, the application key is validated in connection with the user identification. If the application key validates in connection with the user identification, one or more application parameters for the application necessary to complete a log-in process are retrieved and the end user is authenticated into the application utilizing each of the user identification, password and application parameters so as to complete the log in process for the end user and the application and the end user is granted the ability to utilize the application. In this way, a more secure mode of authentication is provided without requiring the end user to maintain an awareness of the complex parameters necessary to successfully authenticate and utilize the application.

In further illustration,FIG. 1pictorially shows a process for advanced application authentication utilizing an application key. As shown inFIG. 1, an end user through client device110, such as a personal computer, mobile computing device or smart phone, requests a log-in to an application190executing in the memory of a host computing platform and accessible at a particular network address. In response, an authentication server160, which may be supported by, or separate from the host computing platform180, presents a single log-in user interface120to the end user in the client device110through which both log-in credentials140including a user identification and a password, and also a passkey130are received. The application passkey130, by way of two examples, may be a sequence of digits as in a personal identification number (PIN), or the application passkey130may be token stored as a file in the client device110.

Advanced application authentication logic100also executing in either the host computing platform180or in the authentication server160processes the application passkey130in order to validate the application passkey130in connection with the user identification in a mapping of passkeys to user identifications150. If valid, the advanced application authentication logic100retrieves log-in parameters for the end user corresponding to the application passkey130in the mapping150. Subsequently, the log-in credentials140along with the retrieved log-in parameters are included in a log-in attempt170to the application190. Upon successful completion of the log-in attempt170, the end user is then permitted to utilize the application190through the client device110.

The process described in connection withFIG. 1is implemented in a data processing system. In yet further illustration,FIG. 2schematic shows a data processing system configured for advanced application authentication utilizing an application key. The system includes a host computing platform230with one or more computers each with memory and at least one processor (only a single computing device shown for ease of illustration). A client device210is coupled to the host computing platform230over computer communications network270. The client device210presents a user interface220through which an end user interacts with an instance260of an application260executing in a corresponding server250.

Of note, an advanced application authentication module300is supported by the host computing platform230and is coupled to an authentication data store240storing user identification and password combinations as well as application passcode keys and corresponding log-in parameters. The advanced application authentication module300includes program code enabled upon execution in the memory of the host computing system230to receive through end user through user interface220each of a user identification and password combination for the end user along with an application passkey. The advanced application authentication module300validates the application passkey in connection with the user identification, and if valid retrieves one or more log-in parameters stored in association with the application pass key, including by way of example, a network address of a specified one of the instances260of the application in a respective one of the servers250.

Thereafter, the program code of the advanced application authentication module300submits for authentication to the specified one of the instances260of the application in the respective one of the servers250, the user identification and password, as well as the log-in parameters. As such, upon successful completion of the log-in process, the end user is then permitted to utilize the specified one of the instances260of the application.

In even yet further illustration of the operation of the advanced application authentication module300,FIG. 3is a flow chart illustrating a process for advanced application authentication utilizing an application key. Beginning in block310, a log in request for an application is received and in block320, in response to the request, a prompt is presented for a user identification and password combination and also an application passkey. Subsequently, in block330, the application passkey is matched with the user identification and in decision block350, it is determined if the application passkey is valid. If not, the log in process is deemed to have failed in block340. Otherwise, the process continues through block360.

In block360, one or more log in parameters are retrieved for the application passkey, including, for instance, a network address of a specified instance of the application and a desired initial state or view of the application. Thereafter, in block380a log in attempt is initiated in the specified instance of the application utilizing the received user identification and password combination as well as the retrieved log in parameters. Once the log in attempt has completed successfully, the end user is then permitted to utilize the specified instance of the application.

The present invention may be embodied within a system, a method, a computer program product or any combination thereof. The computer program product may include a computer readable storage medium or media having computer readable program instructions thereon for causing a processor to carry out aspects of the present invention. The computer readable storage medium can be a tangible device that can retain and store instructions for use by an instruction execution device. The computer readable storage medium may be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing.

Computer readable program instructions described herein can be downloaded to respective computing/processing devices from a computer readable storage medium or to an external computer or external storage device via a network. The computer readable program instructions may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. Aspects of the present invention are described herein with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer readable program instructions.