Second factor based domain selection for federated authentication

Abstract

In the method for authenticating usernames, the processor maintains a mapping between usernames and domains. The processor receives a username and a time-based one-time password code (TOTP code) for the username from the authentication application. Upon receiving the TOTP code, the processor: determines the domain from the mapping based on the received username and the received TOTP; and requests input for a certificate associated with the username in that domain. Upon receiving the requested certificate, the processor authenticates the username by determining that the received certificate matches the expected certificate for that domain.

Description

Background Technology

[0001] This invention relates generally to the field of username authentication, and more specifically to username authentication in a cloud computing environment through the automatic selection of a realm.

[0002] The trend of using cloud computing resources operated by cloud providers instead of keeping applications on-premises / on-premises is unwavering. The topic of "cloud" remains one of the top three priorities for CIOs. However, the ongoing trend towards hybrid cloud and more complex cloud computing offerings is also becoming a burden for IT organizations and users. As cloud computing centers continue to grow and compute and storage capacity increases, access to such resources is likely to become more complex. This must be combined with the complexities involved in more secure access to cloud computing resources. Two-factor authentication has become a requirement in many vertical industries, often governed by government regulations.

[0003] Large clouds now often support federated login with customer-owned user repositories. Each such repository can therefore be represented by an identifier called a "domain" ID. However, domain identifiers can be long, complex, and encrypted IDs (identifiers). For users, it's not easy, or even impossible, to remember obscure IDs. Typically, target-range IDs must be manually selected during searches because usernames are not unique across all user repositories. Furthermore, manual domain selection can involve a large number of domains, making it impossible to select the correct one. From a user's perspective, this problem exists in virtually every reputable cloud computing provider.

[0004] However, the replacement of the domain selection field, i.e., the static domain list, also has essentially the same limitations and constraints as described above.

[0005] From a security perspective, second-factor authentication (also known as two-factor authentication) is an existing technology for preventing password attacks. Such a second factor can be implemented using a time-based one-time password (TOTP) code. Thus, the TOTP mechanism is established for each user across each domain on the authentication server used and exported to the client application. The TOTP code generated by the client app is only valid for a limited time and must be provided after the username / password combination is entered for verification on the authentication server. This process is essentially the same for all reputable cloud providers. However, it remains a cumbersome process because it requires typing in all selected domain identifiers.

[0006] Several known documents describe the technical background of the solution proposed herein. US Patent No. 9,419,968B1 describes a mobile push user authentication method for login based on a local client. Here, the authentication server receives a password from the user interface at the local client for logging into a remote server based on the local client. The method determines whether a portion of the password includes a one-time password (OTP). When the password includes an OTP, the method verifies the remainder of the password as a first authentication factor and verifies the OTP as a second authentication factor.

[0007] Furthermore, U.S. Patent Application Publication No. 2020 / 0153814A1 describes a method for authentication with an identifier provider via a federated authorization server, wherein the federated authorization server has at least one interface to at least one identity provider. Each identifier provider is configured to authenticate a user using a corresponding authentication method. Thus, the method includes: receiving login data via a webpage, the login data indicating at least one identity provider and one user.

[0008] However, the known drawback of requiring domain identifiers (especially those represented by complex or obscure identifiers) in cloud computing environments remains. Therefore, it is necessary to overcome this limitation of current solutions and provide easy access to cloud domains in large-scale cloud computing systems. Summary of the Invention

[0009] According to one aspect of the present invention, a computer-implemented method for authenticating a username can be provided. The method may include maintaining a mapping between usernames and domains, and receiving a username and a time-based one-time password code (TOTP code) for that username based on an authentication application. The method may further include, upon receiving the TOTP code, determining a domain from the mapping based on the received username and the received TOTP, and requesting input of a certificate associated with the username in that domain. Furthermore, the method may include, upon receiving the requested certificate, authenticating the username by determining that the received credentials match an expected certificate for that domain.

[0010] According to another aspect of the invention, an authentication system for authenticating usernames can be provided. The authentication system may include a memory communicatively coupled to a processor, the memory storing program code portions adapted to enable the processor to perform operations that maintain a mapping between usernames and domains, and to receive a username and a time-based one-time password code (TOTP code) for that username based on an authentication application.

[0011] In addition, the authentication system may include, upon receiving a TOTP code, determining a domain from a mapping based on the received username and the received TOTP, and requesting input of a certificate associated with the username in that domain.

[0012] In addition, the method may include verifying the username by determining that the received certificate matches the expected certificate for the domain when a requested certificate is received.

[0013] The proposed method for authenticating usernames offers several advantages, technical benefits, contributions, and / or improvements:

[0014] This enhances user acceptance (i.e., user-friendliness) in large and complex cloud computing environments. Compared to known technologies, login is no longer restricted and no longer requires manually selecting a domain from a long list that may include obscure (domain-)IDs. This significantly improves the user experience of the cloud login process.

[0015] Improved security can also be observed, as there is no possibility of password attacks because the password field is not available in the user interface until the successful TOTP process. It can also help incentivize users and customers to enable second-factor authentication methods for their vaults in cloud environments, which in turn can increase the security of data and applications stored and operated in cloud environments.

[0016] Thus, the traditional sequence of logging into a domain (i.e., selecting a domain, providing a username, verifying a password, and verifying a TOTP code) is significantly and advantageously changed, because the sequence can now be: providing a username, verifying a TOTP code, and automatically selecting a domain using the known TOTP code. Finally, verifying the password for that domain. Therefore, the sequence is changed with the positive effect of users no longer needing to pay attention to the domain ID.

[0017] Further embodiments of the inventive concept will be described below.

[0018] According to a useful embodiment, the method may also include receiving the username and TOTP code in two steps. Thus, the user can confirm the username in the first step, for example, by pressing "Enter," and in the second step, confirm the corresponding password, for example, by pressing "Enter" a second time, or confirm the TOTP code by clicking a confirmation field on the user interface.

[0019] According to another notable embodiment, the method may further include providing a user interface adapted to receive the username and / or TOTP code. Thus, the user can enter the username and TOTP code in a single transaction. This can increase the acceptability of the user experience of the solution presented herein. Therefore, and according to another embodiment, the method may further include receiving the username and TOTP code in one step, thereby further increasing usability.

[0020] According to permissible embodiments of this method, the user interface can be a graphical user interface or a command-line interface. Essentially, any type of user interface can be used. This also offers the advantage that, where multiple parts of the user interface can be implemented as APIs (Application Programming Interfaces), authentication can be implemented using another program.

[0021] According to an advantageous embodiment of the method, the domain can be selected from the group consisting of: applications in a cloud computing environment, marketplaces, software development environments, social media platform components, and internet stores. Essentially, any application or group of applications requiring user authentication in a cloud computing environment where different domains may exist is feasible and the proposed concept can be advantageously used.

[0022] According to another preferred embodiment of the method, maintaining the mapping can be performed by an authentication server. This has the advantage that a trusted system (i.e., an authentication server) can be used for reliable mapping of different variables required for secure and easy login to multi-domain computing environments.

[0023] According to an enhanced embodiment of the method, the authentication application can be a client-side TOTP code generator.

[0024] According to an enhanced embodiment of the method, the mapping may also include a TOTP code. Therefore, for the most complete mapping, all three elements can exist: username, domain identifier, and TOTP code. Making these three elements available allows for successful direct forward authentication of usernames for a specific domain.

[0025] According to an additional embodiment of the method, the mapping can be performed using a table, linked list, or database. Furthermore, other mapping mechanisms known to those skilled in the art can also be used. However, it may be necessary and the triplet containing the username, domain (i.e., domain identifier), and TOTP code may be directly accessible.

[0026] According to an optional embodiment, the method may further include determining that the TOTP code is still valid, and terminating the process under the method when the TOTP code is no longer valid. In this case, no domain authentication or pre-selection is possible.

[0027] Furthermore, embodiments may take the form of an associated computer program product accessible from a computer-usable or computer-readable medium, which provides program code for use by or in connection with a computer or any instruction execution system. For the purposes of this description, a computer-usable or computer-readable medium may be any device that can contain means for storing, communicating, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device.

[0028] Brief description of the attached figures

[0029] Figure 1 A cloud computing node according to an embodiment of the present invention is shown.

[0030] Figure 2 A cloud computing environment according to an embodiment of the present invention is shown.

[0031] Figure 3 An abstract model layer according to an embodiment of the present invention is shown.

[0032] Figure 4 This is a flowchart illustrating the operation steps of a method for authenticating a username according to an embodiment of the present invention.

[0033] Figure 5 This is a data flow diagram of a method for authenticating usernames using multiple components according to an embodiment of the present invention.

[0034] Figure 6 This is a functional block diagram illustrating a computing environment including an authentication system according to an embodiment of the present invention. Detailed Implementation

[0035] It should be understood that while this disclosure includes a detailed description of cloud computing, the implementation of the teachings cited herein is not limited to cloud computing environments. Rather, embodiments of the invention can be implemented in conjunction with any other type of computing environment now known or developed hereafter.

[0036] Cloud computing is a service delivery model that enables convenient, on-demand access to a shared pool of configurable computing resources (e.g., a shared pool of configurable computing resources). These resources include networks, network bandwidth, servers, processing power, storage, applications, virtual machines, and services, which can be rapidly provisioned and released with minimal management effort or interaction with the service provider. This cloud model may include at least five features, at least three service models, and at least four deployment models.

[0037] The features are as follows:

[0038] On-demand self-service: Cloud consumers can unilaterally and automatically provide computing power, such as server time and network storage, as needed, without requiring human interaction with the service provider.

[0039] Extensive network access: Capabilities are available through networks and accessed via standard mechanisms that facilitate the use of heterogeneous thin client or thick client platforms (e.g., mobile phones, laptops, and PDAs).

[0040] Resource pooling: A provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, where different physical and virtual resources are dynamically assigned and reassigned as needed. There is a sense of location independence because consumers typically do not have control or knowledge of the exact location of the resources provided, but may be able to specify the location at a higher level of abstraction (e.g., country, state, or data center).

[0041] Rapid elasticity: The ability to provide capacity quickly and flexibly, automatically in some cases, to expand and contract rapidly. For consumers, the available supply capacity often appears unlimited and can be purchased in any quantity at any time.

[0042] Measuring services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at a level of abstraction appropriate to the service type (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both service providers and consumers.

[0043] The service model is as follows:

[0044] Software as a Service (SaaS): This provides consumers with the ability to use the provider's applications running on cloud infrastructure. The applications can be accessed from different client devices via a thin client interface such as a web browser (e.g., web-based email). With the possible exception of limited user-specific application configuration settings, consumers do not manage or control the underlying cloud infrastructure, including the network, servers, operating system, storage, or even individual application capabilities.

[0045] Platform as a Service (PaaS): This provides consumers with the ability to deploy applications created or acquired by the consumer using programming languages ​​and tools supported by the provider onto cloud infrastructure. Consumers do not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but they have control over the deployed applications and the configuration of any application hosting environment.

[0046] Infrastructure as a Service (IaaS): This provides consumers with the capability to deploy and run any software (which may include operating systems and applications) using processing, storage, networking, and other basic computing resources. Consumers do not manage or control the underlying cloud infrastructure, but rather have control over the operating system, storage, deployed applications, and potentially limited control over selected networking components (e.g., host firewalls).

[0047] The deployment model is as follows:

[0048] Private cloud: A cloud infrastructure that operates solely for an organization. It can be managed by the organization or a third party and can exist on-site or off-site.

[0049] Community cloud: A cloud infrastructure shared by several organizations and supporting a specific community with shared concerns (e.g., tasks, security requirements, policies, and compliance considerations). It can be managed by an organization or a third party and can exist on-site or off-site.

[0050] Public cloud: Makes cloud infrastructure available to the public or large industry groups and is owned by an organization that sells cloud services.

[0051] Hybrid cloud: A cloud infrastructure is a combination of two or more clouds (private, community, or public) that remain a single entity but are bound together by standardized or proprietary technologies that enable data and applications to be ported (e.g., cloud bursting for load balancing between clouds).

[0052] Cloud computing environments are service-oriented, focusing on statelessness, loose coupling, modularity, and semantic interoperability. At the heart of cloud computing is the infrastructure comprising a network of interconnected nodes.

[0053] See now Figure 1 The diagram illustrates an example of a cloud computing node. Cloud computing node 10 is merely one example of a suitable cloud computing node and is not intended to impose any limitation on the scope of use or functionality of the embodiments of the invention described herein. In any case, cloud computing node 10 can be implemented and / or perform any of the functions set forth above.

[0054] Within cloud computing node 10, there exists a computer system / server 12 that can operate alongside many other general-purpose or special-purpose computing system environments or configurations. Examples of known computing systems, environments, and / or configurations that may be suitable for computer system / server 12 include, but are not limited to, personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputer systems, mainframe computer systems, and distributed cloud computing environments that include any of the aforementioned systems or devices.

[0055] Computer system / server 12 can be described in the general context of computer system executable instructions (e.g., program modules) executed by the computer system. Generally, program modules may include routines, programs, objects, components, logic, data structures, etc., that perform specific tasks or implement specific abstract data types. Computer system / server 12 can be implemented in a distributed cloud computing environment, where tasks are performed by remote processing devices linked via a communication network. In a distributed cloud computing environment, program modules can reside in local and remote computer system storage media, including memory storage devices.

[0056] like Figure 1 As shown, the computer system / server 12 in cloud computing node 10 is illustrated in the form of a general-purpose computing device. The components of the computer system / server 12 may include, but are not limited to, one or more processors or processing units 16, system memory 28, and a bus 18 that couples the various system components, including the system memory 28, to the processor 16.

[0057] Bus 18 represents any one or more of several types of bus architectures, including memory buses or memory controllers, peripheral buses, accelerated graphics ports, and processor or local buses using any of the various bus architectures. By way of example and not limitation, such architectures include Industry Standard Architecture (ISA) buses, Micro Channel Architecture (MCA) buses, Enhanced ISA (EISA) buses, Video Electronics Standards Association (VESA) local buses, and Peripheral Component Interconnect (PCI) buses.

[0058] Computer system / server 12 typically includes various computer system readable media. Such media can be any available media that can be accessed by computer system / server 12, and includes volatile and non-volatile media, removable and non-removable media.

[0059] System memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. Computer system / server 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage system 34 may be provided for reading from and writing to non-removable, non-volatile magnetic media (not shown, and generally referred to as "hard disk drives"). Although not shown, disk drives for reading from or writing to removable non-volatile disks (e.g., "floppy disks") and optical disk drives for reading from or writing to removable non-volatile optical disks (such as CD-ROMs, DVD-ROMs, or other optical media) may be provided. In such cases, each may be connected to bus 18 via one or more data media interfaces. As will be further described and illustrated below, memory 28 may include at least one program product having at least one set of program modules (e.g., at least one) configured to perform embodiments of the invention.

[0060] By way of example and not limitation, a program / utility 40 having a set (at least one) of program modules 42, along with an operating system, one or more applications, other program modules, and program data, may be stored in memory 28. Each or some combination of the operating system, one or more applications, other program modules, and program data may include an implementation of a network environment. Program modules 42 typically perform functions and / or methods as described herein in embodiments of the invention.

[0061] Computer system / server 12 can also communicate with one or more external devices 14 (e.g., keyboard, pointing device, display 24, etc.); and / or any device that enables computer system / server 12 to communicate with one or more other computing devices (e.g., network interface card, modem, etc.). This communication can be performed via input / output (I / O) interface 22. Furthermore, computer system / server 12 can communicate with one or more networks, such as local area networks (LANs), general area networks (WANs), and / or public networks (e.g., the Internet), via network adapter 20. As shown, network adapter 20 communicates with other components of computer system / server 12 via bus 18. It should be understood that, although not shown, other hardware and / or software components can be used in conjunction with computer system / server 12. Examples include, but are not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archiving storage systems.

[0062] See now Figure 2The diagram illustrates an illustrative cloud computing environment 50. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 to which local computing devices used by cloud consumers can communicate. These local computing devices include, for example, personal digital assistants (PDAs) or cellular phones 54A, desktop computers 54B, laptop computers 54C, and / or automotive computer systems 54N. The nodes 10 can communicate with each other. They can be physically or virtually grouped (not shown) in one or more networks, such as private clouds, community clouds, public clouds, or hybrid clouds, or combinations thereof, as described above. This allows the cloud computing environment 50 to provide infrastructure, platforms, and / or software as services that cloud consumers do not need to maintain on their local computing devices. It should be understood that... Figure 2 The types of computing devices 54A-N shown are intended to be illustrative only, and computing node 10 and cloud computing environment 50 can communicate with any type of computerized device via any type of network and / or network-addressable connectivity (e.g., using a web browser).

[0063] See now Figure 3 This demonstrates a cloud computing environment of 50 ( Figure 2 This provides a set of functional abstractions. It should be understood beforehand. Figure 3 The components, layers, and functions shown are intended to be illustrative only, and embodiments of the invention are not limited thereto. As described, the following layers and corresponding functions are provided:

[0064] The hardware and software layer 60 includes hardware and software components. Examples of hardware components include: a mainframe 61; a RISC (Reduced Instruction Set Computer) based server 62; a server 63; a blade server 64; a storage device 65; and network and networking components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0065] The virtualization layer 70 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual server 71; virtual storage 72; virtual network 73, including virtual private network; virtual application and operating system 74; and virtual client 75.

[0066] In the example, management layer 80 can provide the following functionalities: Resource Provisioning 81 provides dynamic procurement of computing resources and other resources used to perform tasks within the cloud computing environment. Metering and Pricing 82 provides cost tracking as resources are utilized within the cloud computing environment and bills or invoices for the consumption of these resources. In one example, these resources may include application software licenses. Security provides authentication for cloud consumers and tasks, as well as protection for data and other resources. User Portal 83 provides access to the cloud computing environment for consumers and system administrators. Service Level Management 84 provides cloud resource allocation and management to ensure that required service levels are met. Service Level Agreement (SLA) Planning and Fulfillment 85 provides pre-scheduling and procurement of cloud resources based on anticipated future needs according to the SLA.

[0067] Workload tier 90 provides examples of functionalities that can be leveraged in a cloud computing environment. Examples of workloads and functionalities that can be provided from this tier include: mapping and navigation 91; software development and lifecycle management 92; virtual classroom education delivery 93; data analytics and processing 94; transaction processing 95; and authentication 96.

[0068] In the context of this specification, the following conventions, terms and / or expressions may be used:

[0069] The term "authentication" can refer to the process of verifying a user identifier (UID) and, based on this, granting access to specific computing resources (e.g., applications, storage space, network components, etc.).

[0070] The term "username" can refer to an identifier for a user account, which can be used as a login identifier within a domain contained in a complex cloud computing environment.

[0071] The term "realm" can refer to a subgroup of dynamically configurable computing resources within a larger cloud computing environment. A realm can therefore be a specific view on a finite portion of a larger cloud computing environment.

[0072] The term "Time-Based One-Time Password Code" (TOTP code) refers to a numeric code that is valid only for a predefined time period. If the predefined time period is likely to expire, the TOTP code may no longer be available. TOTP codes used for a specific user ID (i.e., username or UID) may be available from specific authentication applications. Technicians may also be aware of alternatives to these popular client-side authentication applications.

[0073] The term "certified application" can refer to an application that is available independently of the cloud computing environment and is installed on a client-side computing system suitable for generating TOTP code.

[0074] The term "certificate" can refer to a secret digital code that enables access to computing resources along with a username. Once the username and certificate or password become available, the username and certificate combination can be compared with previously saved username / certificate combinations. If a match is found, access to the requested resource can be granted.

[0075] It can be noted that cloud software fully leverages the cloud paradigm by focusing on service orientation, statefulness (with exceptions), loose coupling, modularity, and semantic interoperability.

[0076] The following is a detailed description of the accompanying drawings and related embodiments. All instructions in the drawings are illustrative. First, a block diagram of an embodiment of the method of the present invention for authenticating usernames is given. Further embodiments and embodiments of an authentication system for authenticating usernames will then be described.

[0077] Figure 4 A block diagram of a preferred embodiment of a username authentication process 100 is shown. Successful authentication can be granted access to, for example, cloud applications, cloud computing resources (e.g., storage and data), or marketplaces, web apps, etc. The process includes: maintaining a mapping between usernames and domains in step 102; and in step 104, receiving the username (preferably via a user interface, alternatively via an API) and a time-based one-time password code (TOTP code) for that username based on an authentication application that can be executed on the client side (e.g., potentially selected based on user preferences (e.g., related to permissions)). The domain management system then automatically selects the correct domain.

[0078] Process 100 also includes, upon receiving the TOTP code, in step 106, determining a domain from the mapping based on the received username and the received TOTP, and in step 108, requesting input of a certificate (e.g., a password associated with the username in that domain).

[0079] Process 100 also includes, upon receiving a requested certificate in step 110, authenticating the username by determining that the received certificate matches the expected certificate for the domain. If the received certificate does not match the expected certificate for the domain, access should be denied.

[0080] Figure 5 A data flow diagram 200 is shown, illustrating a practical embodiment of the proposed concepts involving element user 202, browser 204, authentication application 206, authentication server 208, and domain_x 210, where domain_x 210 represents a specific domain having an identity or identifier "x".

[0081] In the first step, user 202 provides a username to browser 204 (212), that is, they enter their username. This opens a TOTP session 214 via client-side authentication application 206. To this end, a request for the user ID (i.e., username) to "obtain the TOTP code for the UID" (216) is sent to authentication application 206. This makes the TOTP code available to browser 204 (218). From here, the TOTP code is verified by authentication server 208 (220), which obtains the domain for the UID (222). Furthermore, the domain ID is verified by authentication server 208 (224). Then, the selected domain_x (specifically, the associated identifier) ​​is returned to browser 204 (226). Based on this, a possible conversation between browser 204 and user 202 begins (228).

[0082] After the user enters (230) their password associated with their username (i.e., UID), the password and UID (i.e., username) are verified in domain_x 210 (232). For such verification, a verification request is sent from browser 204 to authentication server 208, which then allows the password to be verified through domain_x 210 (234). Confirmation (e.g., "OK") is returned (236) to authentication server 208. Based on this, authentication server 208 confirms (238) that the user has logged into domain_x 210. Therefore, the login process described herein also uses a two-factor authentication process, but in a more convenient way for login processes in domains within a cloud computing environment.

[0083] Figure 6 A block diagram of an embodiment of the authentication server 300 presented herein for authenticating usernames is shown. Implementation can occur in a combination of memory 302 or processor 304 (both then communicatively coupled to each other) and portions of program code stored in memory, allowing the processor to execute activities. Alternatively, the functionality can also be implemented as part of a module and / or unit. The following description reflects both options.

[0084] Therefore, these program code portions are adapted to enable the processor to perform maintenance (e.g., by maintenance unit 306) of the mapping of usernames and domains, and to receive the username and the time-based one-time password code (TOTP code) for the username via receiver 308 based on the authentication application.

[0085] The program code section can also enable the processor to: upon receiving a TOTP code, determine (e.g., by determination unit 310) a domain from the mapping based on the received username and the received TOTP, and request (by request module 312) input of the certificate associated with the username in that domain.

[0086] In addition, the program code section also enables the processor to: upon receiving a requested certificate, authenticate the username (e.g., by authentication module 314) by determining that the received certificate matches the expected certificate for that domain.

[0087] In a hardware implementation, units and modules can be communicatively coupled for signal and data exchange. This is particularly applicable to memory 302, processor 304, maintenance unit 306, receiver 308, determination unit 310, request module 312, and authentication module 314. They can be interconnected in a 1:1 manner, or alternatively, they can be connected to an internal bus system 316 of the authentication system for data and signal exchange.

[0088] This invention can be a system, method, and / or computer program product with any possible level of technical detail integration. The computer program product may include a computer-readable storage medium having computer-readable program instructions thereon for causing a processor to execute aspects of the invention.

[0089] Computer-readable storage media can be tangible means for retaining and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example, but not limited to, electronic storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital universal disk (DVD), memory sticks, floppy disks, mechanical encoding devices such as punch cards or protrusions in slots having instructions recorded thereon, and any suitable combination of the foregoing. As used herein, computer-readable storage media should not be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses passing through fiber optic cables), or electrical signals transmitted through wires.

[0090] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a suitable computing / processing device via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network), or to an external computer or external storage device. The network may include copper cables, optical fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to a computer-readable storage medium within the suitable computing / processing device.

[0091] Computer-readable program instructions used to perform the operations of this invention may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, integrated circuit configuration data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​(such as Smalltalk, C++, etc.) and procedural programming languages ​​(such as the "C" programming language or similar programming languages). The computer-readable program instructions may be executed entirely on a user's computer, partially on a user's computer, as a standalone software package, partially on a user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter case, the remote computer may be connected to the user's computer via any type of network (including a local area network (LAN) or a wide area network (WAN)) or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs) may execute computer-readable program instructions by utilizing state information from the computer-readable program instructions to personalize the electronic circuitry in order to perform aspects of this invention.

[0092] The present invention will now be described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0093] These computer-readable program instructions may be provided to a processor of a computer or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / actions specified in one or more blocks of a flowchart and / or block diagram. These computer-readable program instructions may also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner, such that the computer-readable storage medium storing the instructions includes an article of manufacture containing instructions that implement aspects of the functions / actions specified in one or more blocks of a flowchart and / or block diagram.

[0094] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus, or other device to produce computer-implemented processing, such that the instructions executed on the computer, other programmable apparatus, or other device perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0095] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. Each block in a flowchart or block diagram may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the figures. For example, two blocks shown consecutively may actually be completed as a single step, executed simultaneously, substantially simultaneously, or with partial or complete temporal overlap, or the blocks may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action or executes a combination of dedicated hardware and computer instructions.

[0096] Various embodiments of the invention have been described for illustrative purposes, but are not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the invention. The terminology used herein has been chosen to best explain the principles of the embodiments, their practical application, or technical improvements superior to those found in the market, or to enable those skilled in the art to understand the embodiments disclosed herein.

[0097] In short, the concept of this invention can be summarized as follows:

[0098] A method for username authentication, the method comprising: maintaining a mapping between usernames and domains; receiving a username and a time-based one-time password code (TOTP code) for the username based on an authentication application; upon receiving the TOTP code, determining a domain from the mapping based on the received username and the received TOTP; requesting input of a certificate associated with the username in the domain; and upon receiving the requested certificate, authenticating the username by determining that the received certificate matches an expected certificate for the domain.

[0099] The method also includes receiving the username and the TOTP code in two steps.

[0100] The method also includes receiving the username and the TOTP code in one step.

[0101] The method described according to any of the above paragraphs further includes providing a user interface adapted to receive the username and / or the TOTP code.

[0102] The method also includes a user interface that is either a graphical user interface or a command-line interface.

[0103] According to any of the methods described in the paragraphs above, the domain is selected from a group that includes at least applications in a cloud computing environment, marketplaces, software development environments, social media platform components, and internet stores.

[0104] According to any of the methods described in the paragraphs above, the maintenance of the mapping is performed by the authentication server.

[0105] According to any of the methods described in the paragraphs above, the authentication application is a client-side TOTP code generator.

[0106] According to any of the methods described in the paragraphs above, the mapping also includes TOTP code.

[0107] According to any of the methods described in the paragraphs above, the mapping is performed using a table, a linked list, or a database.

[0108] The method described in any of the preceding paragraphs further includes: determining that the TOTP code is still valid; and terminating the process under the method when the TOTP code is no longer valid.

[0109] An authentication system for username authentication includes: a memory communicatively coupled to a processor, the memory storing program code portions adapted to enable the processor to perform the following operations: maintaining a mapping of usernames and domains; receiving a username and a time-based one-time password code (TOTP code) for the username based on an authentication application; determining a domain from the mapping based on the received username and the received TOTP code upon receiving the TOTP code; requesting input of a certificate associated with the username in the domain; and authenticating the username upon receiving the requested certificate by determining that the received certificate matches an expected certificate for the domain.

[0110] The authentication system, in which these program code portions are adapted to enable the processor to also receive the username and the TOTP code in two steps.

[0111] The authentication system, in which these program code portions are adapted to enable the processor to also receive the username and the TOTP code in a step-by-step process.

[0112] The authentication system, wherein these program code portions are adapted to enable the processor to also provide a user interface adapted to receive the username and / or the TOTP code.

[0113] The authentication system has a user interface that is either a graphical user interface or a command-line interface.

[0114] The authentication system, wherein the domain is selected from a group that includes at least applications in cloud computing environments, marketplaces, software development environments, social media platform components, and internet stores.

[0115] In this authentication system, the maintenance of the mapping is performed by the authentication server.

[0116] The authentication system uses a client-side TOTP code generator as its authentication application.

[0117] The authentication system, in which the mapping also includes TOTP codes.

[0118] An authentication system in which mappings are performed using tables, linked lists, or databases.

[0119] The authentication system, wherein these program code portions are adapted to enable the processor to determine that the TOTP code is still valid, and to terminate the process under this method when the TOTP code is no longer valid.

[0120] A computer program product for username authentication includes a computer-readable storage medium having program instructions embodied therein, which are executable by one or more computing systems or controllers to cause the one or more computing systems to: maintain a mapping of usernames and domains; receive a username and a time-based one-time password code (TOTP code) for the username based on an authentication application; determine a domain from the mapping based on the received username and the received TOTP code upon receiving the TOTP code; request input of a certificate associated with the username in the domain; and, upon receiving the requested certificate, authenticate the username by determining that the received certificate matches an expected certificate for the domain.

Claims

1. A computer-implemented method for authenticating usernames, the method comprising: One or more processors receive the username entered by the user through a browser and a time-based one-time password code (TOTP) for the username based on the authentication application; Upon receiving the TOTP: The TOTP is verified by one or more processors; One or more processors determine a domain from a maintained mapping of usernames and multiple domains based on the received username and the TOTP, wherein the determined domain is the user's user repository. A domain determined by verification by one or more processors; One or more processors request input of the certificate associated with the username in the domain; as well as Upon receiving a requested certificate, one or more processors authenticate the username by determining that the received certificate matches the expected certificate for the domain; The password associated with the username is received by one or more processors; Upon receiving the password associated with the username, one or more processors verify the password associated with the username in the determined domain.

2. The method according to claim 1, further comprising: The username and the TOTP are received by one or more processors in two steps.

3. The method according to claim 1 or 2, further comprising: A user interface adapted to receive the username and the TOTP is provided by one or more processors.

4. The method according to claim 3, wherein, The user interface is selected from a combination of a graphical user interface and a command-line interface.

5. The method according to claim 1, further comprising: The username and the TOTP are received by one or more processors in a single step.

6. The method according to any one of claims 1, 2, and 5, wherein, The domain is selected from a group consisting of applications, marketplaces, software development environments, social media platform components, and internet stores within a cloud computing environment.

7. The method according to any one of claims 1, 2, and 5, wherein, The authentication application is a client-side TOTP generator.

8. The method according to any one of claims 1, 2, and 5, wherein, The mapping also includes TOTP.

9. The method according to any one of claims 1, 2, and 5, wherein, The mapping is performed using content selected from a group consisting of tables, linked lists, and databases.

10. The method according to any one of claims 1, 2, and 5, further comprising: The TOTP is determined to be still valid by one or more processors; as well as When the TOTP is no longer valid, the process is terminated by one or more processors.

11. A computer program product for authenticating usernames, the computer program product comprising: One or more computer-readable storage media, and program instructions commonly stored on the one or more computer-readable storage media, the program instructions comprising: Program instructions for receiving a username entered by a user through a browser and a time-based one-time password code (TOTP) for that username based on an authentication application; Program instructions for performing the following operations upon receiving the TOTP: Verify the TOTP; Based on the received username and the TOTP, the domain is determined from the maintained mapping of usernames and multiple domains, and the determined domain is the user's user repository. Verify the identified domain; Request input of the certificate associated with the username in the domain; Upon receiving the requested certificate, the username is authenticated by determining that the received certificate matches the expected certificate for the domain; Receive the password associated with the username; Upon receiving the password associated with the username, the password associated with the username is verified against the determined domain.

12. The computer program product according to claim 11, further comprising: Program instructions, commonly stored on the one or more computer-readable storage media, are used to receive the username and the TOTP in two steps.

13. The computer program product according to claim 11 or 12, further comprising: Program instructions, commonly stored on one or more computer-readable storage media, are used to provide a user interface adapted for receiving the username and the TOTP.

14. The computer program product according to claim 13, wherein, The user interface is selected from a combination of a graphical user interface and a command-line interface.

15. The computer program product according to claim 11, further comprising: Program instructions, commonly stored on the one or more computer-readable storage media, are used to receive the username and the TOTP in a single step.

16. The computer program product according to any one of claims 11, 12, and 15, wherein, The domain is selected from a group consisting of applications, marketplaces, software development environments, social media platform components, and internet stores within a cloud computing environment.

17. The computer program product according to any one of claims 11, 12, and 15, wherein, The authentication application is a client-side TOTP generator.

18. The computer program product according to any one of claims 11, 12, and 15, wherein, The mapping also includes TOTP.

19. The computer program product according to any one of claims 11, 12, and 15, wherein, The mapping is performed using content selected from a group consisting of tables, linked lists, and databases.

20. The computer program product according to any one of claims 11, 12, and 15, further comprising: Program instructions, co-located on the one or more computer-readable storage media, are used to determine that the TOTP is still valid; as well as Program instructions, commonly stored on the one or more computer-readable storage media, are used to terminate the process when the TOTP is no longer valid.

21. A computer system for authenticating usernames, the computer system comprising: One or more computer processors, one or more computer-readable storage media, and program instructions commonly stored on the one or more computer-readable storage media for execution by at least one of the one or more computer processors, the program instructions including: Program instructions for receiving a username entered by a user through a browser and a time-based one-time password code (TOTP) for that username based on an authentication application; Program instructions for performing the following operations upon receiving the TOTP: Verify the TOTP; Based on the received username and the TOTP, the domain is determined from the maintained mapping of usernames and multiple domains, and the determined domain is the user's user repository. Verify the identified domain; Request input of the certificate associated with the username in the requested domain; and Upon receiving a requested certificate, the username is authenticated by determining that the received certificate matches the expected certificate for the domain. Receive the password associated with the username; Upon receiving the password associated with the username, the password associated with the username is verified against the determined domain.

22. The computer system of claim 21, further comprising: Program instructions, commonly stored on one or more computer-readable storage media, are used to receive the username and the TOTP in two steps.

23. The computer system according to claim 21 or 22, further comprising: Program instructions, commonly stored on one or more computer-readable storage media, are used to provide a user interface adapted for receiving the username and the TOTP.

24. The computer system according to claim 23, wherein, The user interface is selected from a combination of a graphical user interface and a command-line interface.

25. The computer system of claim 21, further comprising: Program instructions, commonly stored on the one or more computer-readable storage media, are used to receive the username and the TOTP in a single step.

Images