Second-Factor-Based Realm Selection for Federated Authentication

Abstract

In an approach for authenticating a username, a processor maintains a mapping of usernames and realms. The processor receives a username and a time-based one-time password code (TOTP code) for the username based on an authentication application. Upon receiving the TOTP code, the processor determines a realm from the mapping based on the received username and the received TOTP; and requests input of credentials associated with the username into the realm. Upon receiving the requested credentials, the processor authenticates the username by determining that the received credentials match expected credentials for the realm.

Description

[Technical Field]

[0001] The present invention relates generally to the field of username authentication, and more particularly to username authentication in a cloud computing environment with automatic realm selection. [Background technology]

[0002] The trend toward using cloud computing resources operated by cloud providers instead of maintaining applications in-house / on-site continues unabated. The topic of "cloud" remains one of CIOs' top three priorities. However, the continuing trend toward hybrid clouds and more complex cloud computing offerings is also becoming a burden for IT organizations and users. As cloud computing centers continue to expand and computing and storage capacity increases, access to such resources can also become more complex. This must be coupled with the complexities associated with more secure access to cloud computing resources. Two-factor authentication has become a requirement in many vertical industries, which are very often subject to government regulations.

[0003] Currently, large clouds often support federated login with customer-owned user repositories. Each such repository can be represented by an identifier, denoted as a "realm" ID. However, realm identifiers can be long and complex cryptographic IDs. It is not easy or entirely impossible for users to remember cryptographic IDs. Because usernames are not unique across all user repositories, the target scope ID usually needs to be manually selected during a search. In addition, manual realm selection can involve a large number of realms, which can make it impossible to select the correct one. From the user's perspective, this problem exists in essentially all serious cloud computing providers.

[0004] However, the alternative to the realm selection field, namely the static realm list, also shares essentially the same limitations and restrictions as just described.

[0005] From a security perspective, second-factor authentication, also referred to as two-factor authentication, is a state-of-the-art technology to prevent password attacks. Such a second factor may be implemented using a time-based one-time password or a time-based one-time password code (TOTP code). A TOTP mechanism is configured for each user per realm on the authentication server used and exported to client applications. The TOTP code generated by the client application is only valid for a certain time and must be provided after entering a username / password combination to be verified on the authentication server. This process is essentially the same for all major cloud providers. However, it is still a cumbersome process due to the requirement to type in all selected realm identifiers.

[0006] There are several known documents that explain the technical context of the solution proposed herein. U.S. Patent No. 9,419,968 B1 describes mobile push user authentication for native client-based logon, whereby an authentication server receives a password for native client-based logon to a remote server from a user interface of the native client. The method determines whether a portion of the password includes a one-time password (OTP). If the password includes an OTP, the method verifies the remaining portion of the password as a first authentication factor and the OTP as a second authentication factor.

[0007] Additionally, U.S. Patent Application Publication No. 2020 / 0153814 A1 describes a method for authentication by identity providers via a federating authentication server, where the federating authentication server has at least one interface to at least one identity provider. Each identity provider is configured to verify a user identity using a respective verification method. The method thereby comprises receiving login data via a web page, where the login data is indicative of at least the identity provider and the user.

[0008] However, there remains a known drawback in cloud computing environments, particularly the need to enter realm identities, which may be represented by complex or cryptographic identifiers. Thus, there is a need to overcome this limitation in current solutions and provide easy access to cloud computing realms in large-scale cloud computing systems. Summary of the Invention

[0009] According to one aspect of the present invention, a computer-implemented method for authenticating a username may be provided. The method may include maintaining a mapping of usernames and realms, and receiving a username and a time-based one-time password code (TOTP code) for the username based on an authentication application. The method may further include, upon receipt of the TOTP code, determining a realm from the mapping based on the received username and the received TOTP, and requesting input of credentials associated with the username into the realm. Furthermore, the method may include, upon receipt of the requested credentials, authenticating the username by determining that the received credentials match expected credentials for the realm.

[0010] According to another aspect of the present invention, there may be provided an authentication system for authenticating a username, the authentication system may include a memory communicatively coupled to a processor, the memory storing program code portions adapted to enable the processor to execute procedures for maintaining a mapping of usernames and realms, and for receiving, based on an authentication application, a username and a time-based one-time password code (TOTP code) for the username.

[0011] Additionally, the authentication system may include a procedure for, upon receipt of a TOTP code, determining a realm from the mapping based on the received username and the received TOTP, and a procedure for requesting input of credentials associated with the username into the realm.

[0012] Additionally, the method may include, upon receipt of the requested credentials, authenticating the username by determining that the received credentials match expected credentials for the realm.

[0013] The proposed method for username authentication may provide multiple benefits, technical advantages, contributions and / or improvements.

[0014] In large-scale and complex cloud computing environments, user acceptance, i.e., user friendliness, may be improved. In contrast to known techniques, login is no longer constrained and no longer requires manual selection of a realm from a long list that may contain cryptographic (realm) IDs. This may significantly improve the user experience with the selected cloud computing login process.

[0015] Also, improved security can be observed, i.e., no password attacks are possible. Since no password field is available in the user interface before a successful TOTP process, it may also help motivate users and customers to enable second factor authentication methods in their repositories in the cloud computing environment, which may also improve the security of data and applications stored and operated in the cloud computing environment.

[0016] Thus, the traditional sequence of logging into a realm, i.e., selecting a realm, providing a username, verifying the password, and verifying the TOTP code, is significantly and advantageously changed in that the sequence can now be providing a username, verifying the TOTP code, and auto-selecting a realm with a known TOTP code. Finally, the password for the realm is verified. This positively impactful change in sequence means that users no longer need to care about realm IDs.

[0017] In the following, additional embodiments of the inventive concept are described.

[0018] According to a useful embodiment, the method may also comprise receiving the username and the TOTP code in two stages, so that the user can confirm the username in a first stage, for example by pressing "Enter", and the TOTP code in a second stage, for example by pressing "Enter" again to confirm the respective passcode or by clicking on a confirmation field in a user interface.

[0019] According to another interesting embodiment, the method may also comprise a step of providing a user interface adapted for receiving a username and / or a TOTP code. Thus, the user may enter the username and the TOTP code in a single transaction. This may improve the acceptance value of the user experience of the solution proposed herein. Thus, and according to another embodiment, the method may also comprise a step of receiving the username and the TOTP code in a one-step process, thereby improving usability even further.

[0020] According to any embodiment of the method, the user interface may be a graphical user interface or a command line interface. Essentially, any type of user interface may be used. This may also have the advantage that if parts of the user interface may be implemented as an API (Application Programming Interface), the authentication may also be implemented using a separate program.

[0021] According to an advantageous embodiment of the method, the realm may be selected from the group consisting of an application in a cloud computing environment, a marketplace, a software development environment, a social media platform component, and an internet shop. Basically, any application or group of applications that require authentication of a user in a cloud computing environment where different realms may exist can be implemented and the proposed concept can be used to advantage.

[0022] According to a further preferred embodiment of the method, the step of maintaining the mapping may be performed by an authentication server, which may have the advantage that in a multi-realm computing environment, a reliable system, i.e. an authentication server, may be used for reliable mapping of the various variables required for secure and easy login.

[0023] According to an enhanced embodiment of the method, the authentication application may be a client-side TOTP code generator.

[0024] According to an enhanced embodiment of the method, the mapping may also include the TOTP code. Thus, for the most complete mapping relationship, all three elements may be present: username, realm identifier, and TOTP code. With these three elements available, easy authentication of a username to a specific realm may be successfully achieved.

[0025] According to a further embodiment of the method, the mapping may be performed using a table, a linked list, or a database. In addition, other mapping mechanisms known to those skilled in the art may also be used. However, it may be desired that the triplet containing the username, the realm, i.e., the realm identifier, and the TOTP code may be directly accessible.

[0026] According to an optional embodiment, the method may also comprise determining that the TOTP code is still valid and terminating the process underlying the method once the TOTP code is no longer valid, in which case no authentication and pre-selection of a realm is possible.

[0027] Furthermore, embodiments may take the form of an associated computer program product accessible from a computer-usable or computer-readable medium providing program code for use by or in connection with a computer or any instruction execution system. For purposes of this description, a computer-usable or computer-readable medium may be any apparatus that may include means for storing, communicating, propagating or transporting a program for use by or in connection with an instruction execution system, apparatus or device. [Brief explanation of the drawings]

[0028] [Figure 1]1 illustrates a cloud computing node according to one embodiment of the present invention.

[0029] [Figure 2] 1 illustrates a cloud computing environment according to one embodiment of the present invention.

[0030] [Figure 3] 1 illustrates an abstraction model layer according to one embodiment of the present invention.

[0031] [Figure 4] 1 is a flowchart illustrating the operational steps of an approach for username authentication according to one embodiment of the present invention.

[0032] [Figure 5] FIG. 2 is a data flow diagram of an approach for authenticating a username using multiple components, according to one embodiment of the present invention.

[0033] [Figure 6] FIG. 1 is a functional block diagram illustrating a computing environment including an authentication system, according to one embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0034] Although this disclosure includes detailed descriptions of cloud computing, it should be understood that implementation of the teachings described herein is not limited to a cloud computing environment. Rather, embodiments of the present invention can be implemented in conjunction with any other type of computing environment now known or later developed.

[0035] Cloud computing is a service delivery model that enables convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal management effort or interaction with the service provider. This cloud model may include at least five characteristics, at least three service models, and at least four deployment models.

[0036] The characteristics are as follows:

[0037] On-Demand Self-Service: Cloud consumers can unilaterally provision computing capacity, such as server time and network storage, automatically as needed, without requiring human interaction with the service provider.

[0038] Wide network access: Capabilities are available over the network and accessed through standard mechanisms that facilitate use by heterogeneous thin or thick client platforms (e.g., cell phones, laptops, and PDAs).

[0039] Resource Pooling: Provider computing resources are pooled to serve multiple consumers using a multi-tenant model, with various physical and virtual resources dynamically allocated and reallocated according to demand. Consumers generally have no control or knowledge over the exact location of the provided resources, but there is location independence in that they may be able to specify location at a higher level of abstraction (e.g., country, state, or data center).

[0040] Rapid scalability: Capacity is provisioned quickly and elastically, sometimes automatically, and can be instantly scaled out or quickly released and instantly scaled in. To the consumer, the capacity available for provisioning often appears unlimited and can be purchased in any quantity at any point in time.

[0041] Measurable Services: Cloud systems automatically control and optimize resource utilization by leveraging metering capabilities appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts) at a certain level of abstraction. Resource usage can be monitored, controlled, and reported, thereby providing transparency to both providers and consumers of the services used.

[0042] The service model is as follows:

[0043] Software as a Service (SaaS): The consumer is offered the ability to use a provider's applications running on a cloud infrastructure. The applications are accessible from a variety of client devices through a thin-client interface such as a web browser (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.

[0044] Platform as a Service (PaaS): The ability offered to consumers is to deploy applications they create or acquire, written using programming languages ​​and tools supported by the provider, onto a cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but does have control over the deployed applications and, in some cases, the application hosting environment configuration.

[0045] Infrastructure as a Service (IaaS): The ability provided to consumers is to provision processing, storage, network, and other basic computing resources onto which they can deploy and run any software, which may include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure, but does have control over the operating systems, storage, deployed applications, and in some cases, limited control over selected networking components (e.g., host firewalls).

[0046] The deployment model is as follows:

[0047] Private Cloud: Cloud infrastructure is operated solely for one organization. It may be managed by that organization or a third party and may exist on-premise or off-premise.

[0048] Community Cloud: Cloud infrastructure is shared by multiple organizations to support a specific community with common interests (e.g., mission, security requirements, policies, and regulatory compliance considerations). It may be managed by the organizations or a third party and may exist on-premises or off-premises.

[0049] Public Cloud: Cloud infrastructure is made available to the general public or large industry organizations and is owned by organizations that sell cloud services.

[0050] Hybrid Cloud: A cloud infrastructure is a combination of two or more clouds (private, community, or public) that remain unique entities but are bound together by standardized or proprietary technologies that allow data and application portability (e.g., cloud bursting for load balancing between clouds).

[0051] Cloud computing environments are service-oriented with an emphasis on statelessness, low coupling, modularity, and semantic interoperability. At the core of cloud computing is an infrastructure that includes a network of interconnected nodes.

[0052] 1, a schematic diagram of an example cloud computing node is shown. Cloud computing node 10 is merely an example of a suitable cloud computing node and is not intended to suggest any limitation as to the scope of use or functionality of the embodiments of the present invention described herein. In any event, cloud computing node 10 may implement and / or perform any of the functionality described above.

[0053] Cloud computing node 10 includes computer system / server 12, which operates in many other general-purpose or special-purpose computing system environments or configurations. Examples of well-known computing systems, environments, and / or configurations that may be suitable for use with computer system / server 12 include, but are not limited to, personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable appliances, network PCs, minicomputer systems, mainframe computer systems, and distributed cloud computing environments that include any of the above systems or devices.

[0054] The computer system / server 12 may be described in the general context of computer system-executable instructions, such as program modules, executed by a computer system. Generally, program modules may include routines, programs, objects, components, logic, data structures, etc. that perform particular tasks or implement particular abstract data types. The computer system / server 12 may be practiced in a distributed cloud computing environment where tasks are performed by remote processing devices that are linked through a communications network. In a distributed cloud computing environment, program modules may be located in both local and remote computer system storage media, including memory storage devices.

[0055] 1, computer system / server 12 in cloud computing node 10 is shown in the form of a general-purpose computing device. Components of computer system / server 12 may include, but are not limited to, one or more processors or processing units 16, system memory 28, and a bus 18 coupling various system components including system memory 28 to processor 16.

[0056] Bus 18 represents any one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures. By way of example and not limitation, such architectures include an Industry Standard Architecture (ISA) bus, a MicroChannel Architecture (MCA) bus, an Enhanced ISA (EISA) bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0057] Computer system / server 12 typically includes a variety of computer system-readable media. Such media may be any available media that can be accessed by computer system / server 12 and includes both volatile and nonvolatile media, removable and non-removable media.

[0058] System memory 28 may include computer system-readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. Computer system / server 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage system 34 may be provided for reading from and writing to non-removable, non-volatile magnetic media (not shown, commonly referred to as a "hard drive"). Although not shown, a magnetic disk drive for reading from and writing to removable, non-volatile magnetic disks (e.g., "floppy disks") and an optical disk drive for reading from and writing to removable, non-volatile optical disks, such as CD-ROMs, DVD-ROMs, or other optical media, may be provided. In such cases, each may be connected to bus 18 by one or more data media interfaces. As further shown and described below, memory 28 may include at least one program product having a set (e.g., at least one) of program modules configured to perform the functions of embodiments of the present invention.

[0059] A program / utility 40 having a set (at least one) of program modules 42 may be stored in memory 28, by way of example and not limitation, as well as an operating system, one or more application programs, other program modules, and program data. Each of the operating system, one or more application programs, other program modules, and program data, or some combination thereof, may comprise an implementation of a networking environment. The program modules 42 generally perform the functions and / or methodologies of embodiments of the present invention described herein.

[0060] The computer system / server 12 may also communicate with one or more external devices 14, such as a keyboard, pointing device, display 24, etc.; one or more devices that allow a user to interact with the computer system / server 12; and / or any device (e.g., a network card, modem, etc.) that allows the computer system / server 12 to communicate with one or more other computing devices. Such communication may occur via an input / output (I / O) interface 22. Furthermore, the computer system / server 12 may communicate with one or more networks, such as a local area network (LAN), a general wide area network (WAN), and / or a public network (e.g., the Internet), via a network adapter 20. As shown, the network adapter 20 communicates with other components of the computer system / server 12 via a bus 18. It should be understood that other hardware and / or software components, not shown, may be used in conjunction with the computer system / server 12. Examples include, but are not limited to, microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archive storage systems.

[0061] Referring now to FIG. 2 , an exemplary cloud computing environment 50 is shown. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 with which local computing devices used by cloud consumers may communicate, such as, for example, a personal digital assistant (PDA) or cellular phone 54A, a desktop computer 54B, a laptop computer 54C, and / or an automobile computer system 54N. The nodes 10 may communicate with each other. They may be physically or virtually grouped in one or more networks (not shown), such as a private cloud, a community cloud, a public cloud, or a hybrid cloud, or combinations thereof, as described hereinabove. This enables the cloud computing environment 50 to provide infrastructure, platform, and / or software as a service without the need for cloud consumers to maintain resources on their local computing devices. It will be understood that the types of computing devices 54A-N shown in FIG. 2 are intended to be illustrative only, and that computing node 10 and cloud computing environment 50 may communicate with any type of computerized device via any type of network and / or network-addressable connection (e.g., using a web browser).

[0062] Referring now to Figure 3, a set of functional abstraction layers provided by cloud computing environment 50 (Figure 2) is shown. It should be understood in advance that the components, layers, and functions shown in Figure 3 are intended to be illustrative only, and embodiments of the present invention are not limited thereto. As shown, the following layers and corresponding functions are provided:

[0063] Hardware and software layer 60 includes hardware and software components. Examples of hardware components include mainframe 61; RISC (reduced instruction set computer) architecture-based server 62; server 63; blade server 64; storage device 65; and network and networking components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0064] The virtualization layer 70 provides an abstraction layer over which the following examples of virtual entities can be provided: virtual servers 71; virtual storage 72; virtual networks, including virtual private networks 73; virtual applications and operating systems 74; and virtual clients 75.

[0065] In one example, management layer 80 may provide the functions described below. Resource provisioning 81 provides dynamic procurement of computing and other resources used to execute tasks within the cloud computing environment. Metering and pricing 82 provides cost tracking as resources are utilized within the cloud computing environment and billing or invoicing for the consumption of these resources. In one example, these resources may include application software licenses. Security provides identity verification for cloud consumers and tasks, as well as protection for data and other resources. User portal 83 provides access to the cloud computing environment for consumers and system administrators. Service level management 84 provides cloud computing resource allocation and management so that required service levels are met. Service level agreement (SLA) planning and fulfillment 85 provides proactive provisioning and procurement of cloud computing resources to anticipate future requirements according to SLAs.

[0066] The workload tier 90 provides examples of functions for which a cloud computing environment can be utilized. Examples of workloads and functions that can be provided from this tier include mapping and navigation 91; software development and lifecycle management 92; virtual classroom instruction delivery 93; data analytics processing 94; transaction processing 95; and authentication 96.

[0067] In the context of the present description, the following phrases, terms and / or expressions may be used:

[0068] The term "authentication" may refer to the process of verifying a user identifier (UID) and, based thereon, granting access to specific computing resources, such as applications, storage space, network components, etc.

[0069] The term "username" may refer to an identifier of a user account that may be used as a login identifier within a realm of a complex cloud computing environment.

[0070] The term "realm" may refer to a dynamically configurable subgroup of computing resources in a larger cloud computing environment. A realm may thus be a particular view of a limited portion of the larger cloud computing environment.

[0071] The term "time-based one-time password code," or "TOTP code" for short, may refer to a digital code that is valid only for a predetermined period of time. After the predetermined period has elapsed, the TOTP code may no longer be usable. TOTP codes for a particular user ID, i.e., username or UID, may be made available by a particular authentication application. Those skilled in the art will also be aware of alternatives to these common client-side authentication applications.

[0072] The term "authentication application" may refer to an application that is available independently of a cloud computing environment and that is installed on a client-side computing system that is adapted to generate TOTP codes.

[0073] The term "credential" may refer to a secret digital code that, together with a username, allows access to a computing resource. Once a username and credential or password is available, the username and credential combination may be compared to previously stored username / credential combinations. If there is a match, access to the requested resource may be granted.

[0074] Note that cloud software takes full advantage of the cloud paradigm by being service-oriented with an emphasis on statelessness (with exceptions), low coupling, modularity, and semantic interoperability.

[0075] In the following, a detailed description of the figures and associated embodiments is provided. All instructions in the figures are schematic. First, a block diagram of one embodiment of the inventive method for username authentication is provided. Afterwards, further embodiments as well as embodiments of an authentication system for username authentication are described.

[0076] 4 shows a block diagram of a preferred embodiment of a process 100 for username authentication. For example, successful authentication may be provided for accessing cloud applications, cloud computing resources (e.g., storage and data), or marketplaces, web applications, etc. The process comprises, in step 102, maintaining a username and realm mapping, and, in step 104, receiving, based on an authentication application that may be executed on the client side, preferably by a user interface or via an API, the username and a time-based one-time password code (TOTP code) for the username, potentially selected based on, for example, user preferences and associated with, for example, privileges. The realm management system then automatically selects the correct realm.

[0077] Process 100 also includes, upon receipt of the TOTP code, determining a realm from a mapping based on the received username and the received TOTP in step 106, and requesting entry of credentials associated with the username, e.g., a password, into the realm in step 108.

[0078] Process 100 further comprises, upon receipt of the requested credentials, authenticating the username by determining that the received credentials match the expected credentials for the realm in step 110. If the received credentials do not match the expected credentials for the realm, access shall be denied.

[0079] FIG. 5 shows a data flow diagram 200 of one practical implementation of the proposed concept, with elements such as a user 202, a browser 204, an authentication application 206, an authentication server 208, and realm_x 210, which indicates the particular realm containing the identity or identifier "x."

[0080] In a first step, the user 202 provides 212 their username to the browser 204, i.e., they enter their username. This opens a TOTP dialog 214 via the client-side authentication application 206. For this, a request for the user ID, i.e., username, "Get TOTP code for UID" is requested 216 and sent to the authentication application 206. This makes a TOTP code 218 available to the browser 204. From there, the TOTP code is verified 220 by the authentication server 208, which obtains 222 the realm for the UID. Additionally, the realm ID is verified 224 by the authentication server 208. The selected realm_x, in particular the associated identifier, is then returned 226 to the browser 204. Based on this, a possible dialog between the browser 204 and the user 202 is initiated 228.

[0081] After the user enters 230 their password associated with their username (i.e., UID), the password and UID (i.e., username) are verified 232 in realm_x 210. During such verification, a verification request is sent from browser 204 to authentication server 208, which then causes realm_x 210 to verify 234 the password. A confirmation, e.g., "OK," is returned 236 to authentication server 208. Based thereon, authentication server 208 confirms 238 the user's login to realm_x 210. Thus, the login process described herein also uses a two-factor authentication process, but in a more convenient manner during the login process in the realm of a cloud computing environment.

[0082] 6 shows a block diagram of one embodiment of an authentication server 300 proposed herein for authenticating usernames. Implementation may take place in a combination of memory 302 or processor 304 (both of which are then communicatively coupled to each other) and portions of program code stored in the memory, which may cause the processor to perform the activities. Alternatively, functionality may be implemented as part of modules and / or units. The following description reflects both options.

[0083] The program code portions are therefore adapted to enable the processor to execute, for example, by the maintaining unit 306, a procedure for maintaining a mapping of usernames and realms, and by the receiver 308, a procedure for receiving usernames and time-based one-time password codes (TOTP codes) for the usernames based on an authentication application.

[0084] The program code portions may also enable the processor to execute, upon receipt of a TOTP code, a procedure for determining, e.g., by the determination unit 310, a realm from the mapping based on the received username and the received TOTP, and a procedure for requesting, by the request module 312, input of credentials associated with the username into the realm.

[0085] Further, the program code portion may also enable the processor, upon receipt of the requested credentials, to perform a procedure to authenticate the username, for example, by the authentication module 314, by determining that the received credentials match the expected credentials for the realm.

[0086] In the case of a hardware implementation, the units and modules may be communicatively coupled for signal and data exchange. This applies in particular to the memory 302, the processor 304, the maintaining unit 306, the receiver 308, the determining unit 310, the request module 312, and the authentication module 314. They may be interconnected in a 1:1 manner, or they may be connected to an authentication system internal bus system 316 for data and signal exchange.

[0087] The present invention may be a system, method and / or computer program product at any possible level of technical detail integration. The computer program product may include a computer-readable storage medium (or multiple computer-readable storage media) having computer-readable program instructions for causing a processor to perform aspects of the present invention.

[0088] A computer-readable storage medium may be a tangible device capable of holding and storing instructions for use by an instruction execution device. The computer-readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory sticks, floppy disks, mechanically encoded devices such as punch cards or ridge structures in grooves with instructions recorded thereon, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium should not be construed as being a transitory signal per se, such as an electric wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse passing through a fiber optic cable), or an electrical signal transmitted through a wire.

[0089] The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to each computing / processing device or to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network may include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface within each computing / processing device receives the computer-readable program instructions from the network and transfers the computer-readable program instructions to a computer-readable storage medium within the respective computing / processing device for storage.

[0090] Computer-readable program instructions for carrying out the operations of the present invention may be assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, configuration data for an integrated circuit, or either source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk® or C++, and procedural programming languages ​​such as the “C” programming language or similar programming languages. The computer-readable program instructions may run entirely on the user's computer, as a standalone software package, partially on the user's computer, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be to an external computer (e.g., via the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) may execute computer readable program instructions to personalize the electronic circuitry by utilizing state information of the computer readable program instructions to perform aspects of the present invention.

[0091] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0092] These computer-readable program instructions may be provided to a processor of a computer or other programmable data processing apparatus to produce a machine, whereby the instructions, executed by the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams. These computer-readable program instructions may also be stored on a computer-readable storage medium that can instruct a computer, programmable data processing apparatus and / or other device to function in a particular manner, whereby the computer-readable storage medium having instructions stored therein has an article of manufacture including instructions that implement aspects of the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0093] The computer-readable program instructions may also be loaded into a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be executed on the computer, other programmable apparatus, or other device to generate a computer-implemented process, whereby the instructions executing on the computer, other programmable apparatus, or other device implement the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0094] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks shown in succession may actually be realized as a single step, executed concurrently, substantially concurrently, partially, or fully in an overlapping manner, or the blocks may possibly be executed in reverse order depending on the functionality involved. It should also be noted that each block of the block diagrams and / or flowchart diagrams, and combinations of blocks in the block diagrams and / or flowchart diagrams, may be implemented by a dedicated hardware-based system that performs the specified functions or operations, or executes a combination of dedicated hardware and computer instructions.

[0095] The description of various embodiments of the present invention has been presented for purposes of illustration, but is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the invention. The terminology used herein has been selected to best explain the principles of the embodiments, practical applications, or technical improvements over technologies found in the marketplace, or to enable others skilled in the art to understand the embodiments disclosed herein.

[0096] Briefly, the concept of the present invention can be summarized as follows.

[0097] 1. A method for authenticating a username, the method comprising: maintaining a mapping of usernames and realms; receiving a username and a time-based one-time password code (TOTP code) for the username based on an authentication application; upon receipt of the TOTP code, determining a realm from the mapping based on the received username and the received TOTP; and requesting input of credentials associated with the username into the realm; and upon receipt of the requested credentials, authenticating the username by determining that the received credentials match expected credentials for the realm.

[0098] The method also includes receiving the username and the TOTP code in two stages.

[0099] The method also includes receiving the username and TOTP code in a one-step process.

[0100] 10. The method of any of the preceding claims, also comprising providing a user interface adapted for receiving a username and / or a TOTP code.

[0101] The method also includes wherein the user interface is a graphical user interface or a command line interface.

[0102] 10. The method according to any of the preceding claims, wherein the realm is selected from the group comprising at least an application in a cloud computing environment, a marketplace, a software development environment, a social media platform component, an internet shop.

[0103] 10. The method of any preceding claim, wherein maintaining the mapping is performed by an authentication server.

[0104] 10. The method of any of the preceding paragraphs, wherein the authentication application is a client-side TOTP code generator.

[0105] 10. The method of any of the preceding paragraphs, wherein the mapping also includes a TOTP code.

[0106] 10. The method of any of the preceding claims, wherein the mapping is performed using a table, a linked list, or a database.

[0107] 10. The method of any preceding claim, further comprising determining that the TOTP code is still valid; and terminating the process underlying the method once the TOTP code is no longer valid.

[0108] 1. An authentication system for authenticating a username, the authentication system comprising: a memory communicatively coupled to a processor, the memory storing program code portions adapted to enable the processor to perform the following steps: maintaining a mapping of usernames and realms; receiving, based on an authentication application, a username and a time-based one-time password code (TOTP code) for the username; upon receipt of the TOTP code, determining a realm from the mapping based on the received username and the received TOTP; and requesting input of credentials associated with the username into the realm; and, upon receipt of the requested credentials, authenticating the username by determining that the received credentials match expected credentials for the realm.

[0109] The authentication system, wherein the program code portions are adapted to also enable the processor to receive the username and the TOTP code in two stages.

[0110] The authentication system, wherein the program code portions are adapted to also enable the processor to receive the username and TOTP code in a one-step process.

[0111] The authentication system, wherein the program code portions are adapted to also enable the processor to provide a user interface adapted for receiving a username and / or a TOTP code.

[0112] An authentication system in which the user interface is a graphical user interface or a command line interface.

[0113] An authentication system, wherein the realm is selected from the group including at least an application in a cloud computing environment, a marketplace, a software development environment, a social media platform component, and an internet shop.

[0114] The step of maintaining the mapping is performed by an authentication server in the authentication system.

[0115] The authenticator application is a client-side TOTP code generator and authentication system.

[0116] The mapping also includes TOTP codes, authentication systems.

[0117] An authentication system in which the mapping is performed using a table, linked list, or database.

[0118] The program code portions are adapted to enable the processor to execute a procedure for determining that the TOTP code is still valid, and also a procedure for terminating the process underlying the method when the TOTP code is no longer valid.

[0119] 1. A computer program product for authenticating a username, the computer program product comprising a computer-readable storage medium having program instructions embodied therein, the program instructions being executable by one or more computing systems or controllers to cause one or more computing systems to perform steps of: maintaining a mapping of usernames and realms; receiving, based on an authentication application, a username and a time-based one-time password code (TOTP code) for the username; upon receipt of the TOTP code, determining a realm from the mapping based on the received username and the received TOTP; and requesting input of credentials associated with the username into the realm; and, upon receipt of the requested credentials, authenticating the username by determining that the received credentials match expected credentials for the realm.

Claims

1. 1. A computer-implemented method for username authentication, comprising: one or more processors maintaining a mapping of usernames and realms; receiving, by one or more processors, a username and a time-based one-time password code (TOTP code) for the username based on an authentication application; Upon receiving said TOTP code: one or more processors determining a realm from the mapping based on the received username and the received TOTP; and one or more processors requesting input of credentials associated with the username into the realm; and Upon receiving the requested credentials, one or more processors authenticate the username by determining that the received credentials match expected credentials for the realm. A method comprising:

2. one or more processors receiving said user name and said TOTP code in two stages; The method of claim 1 further comprising:

3. one or more processors providing a user interface adapted to receive the username and the TOTP code. The method of claim 1 or 2, further comprising:

4. The method of claim 3 , wherein the user interface is selected from the group consisting of a graphical user interface and a command line interface.

5. one or more processors receiving the username and the TOTP code in a one-step process; The method of claim 1 further comprising:

6. The method of claim 1 , wherein the realm is selected from the group consisting of a cloud computing environment, a marketplace, a software development environment, a social media platform component, and an application in an internet shop.

7. The method of claim 1 , wherein the authentication application is a client-side TOTP code generator.

8. The method of claim 1 , wherein the mapping also includes a TOTP code.

9. The method of claim 1 , wherein the mapping is performed using a selection from the group consisting of a table, a linked list, and a database.

10. one or more processors determining that the TOTP code is still valid; and one or more processors terminating the process when the TOTP code is no longer valid. The method of claim 1 , further comprising:

11. 1. A computer program for username authentication, the computer program comprising: Procedures for maintaining username and realm mappings; receiving a username and a time-based one-time password code (TOTP code) for said username based on an authentication application; Upon receiving said TOTP code: determining a realm from the mapping based on the received username and the received TOTP; and prompting input of credentials associated with said username into said realm; and upon receiving the requested credentials, authenticating the username by determining that the received credentials match expected credentials for the realm. A computer program for executing

12. the processor, 12. The computer program product of claim 11, further comprising receiving the user name and the TOTP code in two stages.

13. the processor, 13. The computer program product of claim 11 or 12, further comprising the step of providing a user interface adapted for receiving the user name and the TOTP code.

14. 14. The computer program product of claim 13, wherein the user interface is selected from the group consisting of a graphical user interface and a command line interface.

15. the processor, 12. The computer program product of claim 11, further comprising receiving the username and the TOTP code in a one-step process.

16. 16. The computer program of claim 11, wherein the realm is selected from the group consisting of an application in a cloud computing environment, a marketplace, a software development environment, a social media platform component, and an internet shop.

17. 17. The computer program of claim 11, wherein the authentication application is a client-side TOTP code generator.

18. 18. A computer program according to any one of claims 11 to 17, wherein the mapping also includes a TOTP code.

19. 19. A computer program product according to any one of claims 11 to 18, wherein the mapping is performed using a selection from the group consisting of a table, a linked list, and a database.

20. the processor, determining whether the TOTP code is still valid; and Terminating the process when the TOTP code is no longer valid.

20. A computer program product according to any one of claims 11 to 19, further comprising:

21. 1. A computer system for username authentication comprising: one or more computer processors, one or more computer-readable storage media, and at least one of the one or more computer processors: program instructions for maintaining a username and realm mapping; program instructions for receiving a username and a time-based one-time password code (TOTP code) for the username based on an authentication application; Upon receiving said TOTP code: determining a realm from the mapping based on the received username and the received TOTP; Prompt for the credentials associated with the username to be entered into the realm program instructions for: program instructions for, upon receipt of the requested credentials, authenticating the username by determining that the received credentials match expected credentials for the realm; program instructions collectively stored on said one or more computer-readable storage media for executing program instructions having A computer system comprising:

22. program instructions collectively stored on the one or more computer-readable storage media for receiving the user name and the TOTP code in two stages; 22. The computer system of claim 21 further comprising:

23. and program instructions collectively stored on the one or more computer-readable storage media for providing a user interface adapted to receive the username and the TOTP code.

23. The computer system of claim 21 or 22, further comprising:

24. 24. The computer system of claim 23, wherein the user interface is selected from the group consisting of a graphical user interface and a command line interface.

25. and program instructions collectively stored on the one or more computer-readable storage media for receiving the user name and the TOTP code in a one-step process.

22. The computer system of claim 21 further comprising:

Images