Abstract:
A customer server receives a client request to access protected resources over the Internet. First factor authentication is performed and if it is successful a vendor authentication engine is invoked to undertake second factor authentication. The results of the second factor authentication are returned to the customer server, which grants access only if both first and second factor authentication succeeds.

Description:
RELATED APPLICATIONS 
       [0001]    This application is a continuation-in-part of and claims priority from co-pending U.S. patent application Ser. No. 11/824,694, filed Jul. 2, 2007, which is a continuation-in-part of U.S. patent application Ser. No. . 11/257,421, filed Oct. 24, 2005, which is a continuation-in-part of U.S. patent application Ser. No. 11/077,948, flied Mar. 11, 2005, which in turn is a CIP of Ser. No. 10/892,584, filed Jul. 15, 2004, all of which arc incorporated herein by reference and from all of which is priority claimed. 
     
    
     I. FIELD OF THE INVENTION 
       [0002]    The present invention relates generally to providing secure access to a website with sensitive data. 
       II. BACKGROUND OF THE INVENTION 
       [0003]    The parent applications referenced above recognize the importance of providing more than simple user name/password protection for sensitive online data, and accordingly provide minimally intrusive second factor authentication systems and methods. As understood herein, some customers may prefer to handle first factor authentication (user name and password) themselves and use a vendor second-factor authentication in conjunction therewith. 
       SUMMARY OF THE INVENTION 
       [0004]    A method for selectively granting a user access to data includes, at a first authentication server provided by a first vendor, receiving a request for access from a user computer. The method also includes using signals from the user computer to provide first factor authentication of the user. Only if first factor authentication is successful, a second factor authentication engine provided by a second vendor different from the first vendor is used to provide second factor authentication of the user. The user is granted access to the data only if second factor authentication is successful. 
         [0005]    The first factor authentication may be executed by the first authentication server and may include testing for correct user name and password. The second factor authentication may include determining whether a previously submitted one-time pass code is valid. The pass code is generated as soon as the first factor authentication is successful and is delivered out-of-band by email, cell phone (SMS text message), or voice (interactive voice response (IVR)). The pass code is for one-time use and may have a time expiration associated with it. 
         [0006]    In another aspect, a second factor authentication engine is disclosed on a tangible computer readable medium executable by a processor to execute logic. The logic includes receiving from a customer&#39;s system an indication that a user name of a user and an associated password have been verified, and undertaking second factor authentication of the user on behalf of the customer. The logic also includes returning to the customer system an indication of results of second factor authentication. 
         [0007]    In another aspect, a server has a processor and a tangible computer readable medium accessible by the processor and bearing instructions embodying logic. The logic includes receiving a user request to access information and in response to the request, causing a user name and password received from the user to be authenticated. If the user name and password are not authenticated, the logic denies the user access to the information. Only if the user name and password are authenticated, a vendor authentication engine undertakes a second factor authentication and generates a result and the logic receives the result from the engine. If the result indicates that second factor authentication fails, the logic denies the user access to the information, but otherwise grants the user access to the information. 
         [0008]    The details of the present invention, both as to its structure and operation, can best be understood in reference to the accompanying drawings, in which like reference numerals refer to like parts, and in which: 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0009]      FIG. 1  is a block diagram of an exemplary system for implementing the present invention; 
           [0010]      FIG. 2  is a flow chart of the customer server logic; and 
           [0011]      FIG. 3  is a flow chart of the vendor server logic. 
       
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT 
       [0012]    Referring initially to  FIG. 1 , a system is shown, generally designated  10 , which supports resource requests by client computers  12  executing, in one implementation, Java 2 platform, enterprise edition (J2EE) applications  14 . The requests are sent to a customer server  16  having one or more server processors  18  accessing one or more tangible computer readable media  20  bearing instructions including portions of the logic discussed below. The media  20  may be, without limitation, solid state memory, disk-based memory, or other memory or combination thereof. 
         [0013]    As set forth further below, the customer server  16  executes first factor authentication of the user of the client computer  12 , and if first factor authentication is successful, accesses a vendor-provided second factor authentication server  22  that may include one or more processors  24  accessing one or more tangible computer readable media  26  bearing instructions including portions of the logic discussed below. The media  26  may be, without limitation, solid state memory, disk-based memory, or other memory or combination thereof. Only if both first- and second-factor authentication is successful is the client computer  12  permitted to access a protected information database  28  associated with the customer server  16 . In some embodiments the second factor authentication server  22  may execute both first- and second-factor authentication. 
         [0014]    In one example embodiment the customer server  16  may execute a Java Identity Management Suite including a Java System Identity Manager (IDM)  30  and a Java System Access Manager (AM)  32  from, e.g., Sun Microsystems, to provide integrated user provisioning, de-provisioning, and identities management as discussed below. The AM  32 , in an example embodiment, can be used to handle the first factor authentication process, which can be, e.g., requesting entry of a user name and password by the client computer  12  and then determining whether the user name and password match an approved user name and password in a user database  33  accessible to the customer server  16 . On the other hand, the IDM  30  can be used to provision and de-provision users for second factor authentication by communicating user data to a synchronization utility  34  in the second factor authentication server  22 . In non-limiting embodiments the user data sent from the IDM  30  to the utility  34  may include, e.g., user name, user email address, user home/office phone number, user mobile phone number and carrier, user&#39;s actual first and last names, user&#39;s address, and user&#39;s authentication profile as discussed further below. The user data may be stored in a database  35  accessible to the second factor authentication server  22 . 
         [0015]    Thus, the user data in the database  35  is collected not by the second factor authentication server  22  but by the customer server  16 . The user data is uploaded to the database  35 , with a synchronous connection being maintained between the customer server  16  and second factor authentication server  22  during operations. User self-registration may also be provided in which each user enters his two-factor data directly into the second factor authentication server  22 . 
         [0016]    Additionally, as shown in  FIG. 1  the customer server  16  may include an IDM Resource Adapter  36 , which functions as an interface to external subsystems and applications, translating and converting data between the systems into the proper format needed by each system. 
         [0017]    Furthermore, the customer server  16  may include a vendor-provided login module  38 , typically provided by the same vendor providing the second factor authentication programming of the second factor authentication server  22 . In example non-limiting implementation the login module  38  is a Java Authentication and Authorization Service (JAAS)-compliant module that is used to facilitate providing second factor authentication services to the AM  32  by communicating with a second factor authentication engine  40  in the second factor authentication server  22  when first factor authentication executed by the AM  32  is successful. In some embodiments the second factor authentication server  22  may return, pursuant to execution of second factor authentication, HTML snippets that are transformed by the login module  38  into a format suitable for use via AM  32  callback routines. The login module  38  also transforms values from the customer server  16  into a format suitable for use with the second factor authentication engine  40 . 
         [0018]      FIG. 2  shows logic that may be executed by the customer server  16  in one implementation. Commencing at block  42 , a user request for access to protected information in the database  28  is received from the client computer  12  by the customer server  16 , typically over the Internet. At block  44  the customer server  16  presents a login screen to the client computer  12  prompting the user to enter a user name and password, and assuming the user enters a user name and password, this information is received by the customer server  16  at block  46 . 
         [0019]    At decision diamond  48  it is determined whether both the username and password are correct, i.e., whether they match a paired entry in a user database. The decision at diamond  48  maybe executed by the customer server  16  using, e.g., the AM  32 , or the login module  38  of the customer server  16  may pass the user name and password to the second factor authentication server  22 , which makes the determination at diamond  48 . If either the user name or password is incorrect (in some embodiments, after a predetermined number of retries), an error is returned at state  50 . 
         [0020]    Otherwise, first factor authentication of the user is successful and the logic flows to block  52  to send a request for second factor authentication of the user to the second factor authentication server  22 . Details of this second factor test are discussed further below in reference to  FIG. 3 . If the second factor authentication test fails, the user is denied access to the requested information at block  56 , but only if both first- and second-factor authentication are successful is the user granted access to the requested resources at state  58 . 
         [0021]    Turning to second factor authentication and  FIG. 3 , at block  60  the request for second factor authentication pursuant to a successful first factor authentication is received at the second factor authentication server  22 . At block  64  a challenge is issued. The challenge may include, but is not limited to: pass code challenge with various delivery options, e.g., phone text message, email message, interactive voice response (IVR), etc.; security question challenges; challenges based on geographic location; mutual authentication; etc. Which challenge to use is defined by the customer server  16  as part of the user profile given to the second factor authentication server  22 . 
         [0022]    For instance, an email or wireless telephone short message service (SMS) message or outbound telephone call using Interactive Voice Response (IVR) principles can be sent to the user, containing a randomly generated single-use only pass code which is supplied by the second factor authentication server  22 . This pass code can then be sent by the user to the second factor authentication server  22  using the client computer  12 , to prove that the user is authorized access. Or, a biometric information test may also be used to trigger this challenge or indeed after reception of the pass code to further verify user authenticity. Details of non-limiting biometric and geographic second factor authentication are set forth in one or more of the above-referenced patent applications. 
         [0023]    If a correct response to the challenge is not received at decision diamond  66  (e.g., within a predetermined response period), an error is returned at state  68 , and the user is denied access to the requested resources at block  56  of  FIG. 3 . The error result alternatively may entail directing the user back to the first factor authentication process described above. On the other hand, a positive result at diamond  66  moves the logic to block  70 , wherein a “pass” is returned indicating that second factor authentication is successful. The user is granted access to the requested resources. 
         [0024]    While the particular SYSTEM AND METHOD FOR SECOND FACTOR AUTHENTICATION SERVICES is herein shown and described in detail, it is to be understood that the subject matter which is encompassed by the present invention is limited only by the claims.