Oracle International Corporation

Ramya Subramanya

Stephen Mathew

Aarathi Balakrishnan

Vipin Anaparakkal Koottayi

Madhu Martin

Vikas Pooven Chathoth

Deepak Ramakrishnan

Ranjan Khanna

Vikas Pooven Chatoth

Vipin Anaparakkal Kootayi

Techniques are disclosed to modify the authentication level of a session providing access to resources. In some embodiments, an access management system is configurable to enable voluntary (e.g., request by a user) or involuntary (e.g., by the access management system) reduce, or 'step-down' the authentication level for a session if a lower authentication level exists. For example, an access management system may be configured to enable a user to request a step-down of the authentication level of a session to prevent access to resources at a higher authentication level. By reducing the authentication level to a lower authentication level, a user may be prompted to provide credentials for authentication according to the authentication schemes defined for higher authentication levels. These techniques can reduce, if not prevent, unauthorized access to protected resources by challenging a user for credentials to authenticate to higher authentication levels.

Techniques for authentication level step-down

Techniques are disclosed for providing and/or implementing utilizing declarative techniques for transaction-specific authentication. Certain techniques are disclosed herein that enable transaction signing using modular authentication via declarative requests from applications. An application can declaratively specify one or more transaction factor values to be used in an authentication, and the authentication, using a transaction-signed one-time password, can be directed by an access manager module without further involvement of the application. Upon a successful or non-successful authentication, the access manager module can provide the result back to the application. Accordingly, an authentication process specific to (and valid only for) a particular transaction can be performed without direct involvement of the application and without application-centric knowledge required by the access manager module.

Declarative techniques for transaction-specific authentication

Techniques are disclosed for protecting a user from denial of service (DOS) to access his/her a user account that has been locked. An access management system can provide features that enable an owner of an account to prevent the account from becoming locked. Specifically, the techniques disclosed herein enable an account holder to circumvent procedures of the access management system that lock an account after several unsuccessful attempts to access the account. The access management system may operate according to a configuration for managing access to account. The access management system can manage access to an account by presenting a user with an interface to received access information (e.g., account information and credential information) for the account to determine whether to unlock the account. The access management system can deny access to an account upon determining that the credential information is not correct for the account.

Protection against end user account locking denial of service (DOS)

Techniques are disclosed for enabling a user to validate the authenticity of a computing system (e.g., an access management system) such as one which controls access to one or more resources. A user can determine the authenticity of an access management system before the user provides credential information to the access management system. A user can be presented at a client system with an interface to request authentication of an access management system. The access management system may provide the user at the client system with temporary access information to submit back to the access management system. The access management system may provide recent personal information to the user at the client system to verify the access management system. Upon verification of the personal information, the access management system may prompt the user for credential information to establish a session.

End user initiated access server authenticity check

Techniques are disclosed for using a global unified session identifier across data centers. Upon creating an initial session in the data center for a user first accessing the data center, a session identifier is generated for the user session. Because the initial session is the first session created for that user, the initial session identifier is designated as the global unified session identifier for all sessions that may be created for the user in other data centers within the enterprise network. Data centers may then map the global unified session identifiers to locally generated session identifiers for the user. A global unified session identifier enables various user session actions to be performed globally across the data centers, including global logout, global session termination, global session updates, and/or the like. A global unified session identifier prevents the risk of collision that can occur between randomly generated numbers of different data centers.

Global unified session identifier across multiple data centers

Methods and systems are described for upgrading an access manager framework. In response to an upgrade request from a client, current and new versions of the access manager framework are identified. Upon successful identification of the current version, one or more supported upgrade paths are determined for the upgrade process. An appropriate upgrade path from the current version to the new version is determined upon successful identification of the current and/or new version of the access manager framework. In response to determination of the appropriate upgrade path, a version specific program upgrade component and a version specific upgrade program are associated with the determined upgrade path. In addition, a set of information may be extracted from the access manager framework, transformed, and imported to the upgraded access manager framework based at least in part upon the determined version specific upgrade program and the version specific program upgrade component.

Methods and systems for dynamic upgrade of an access manager

Methods and systems are described for state driven orchestration of authentication components to access a resource protected by an access manager framework. In response to a client request for a protected resource, relevant authentication components and their respective order are determined. Upon successful authentication of the first authentication component, proper state information of the authentication process is stored by the client indicating the next authentication component. In response to a request for additional credential information for the authentication process from the next authentication component, the client provides the stored state information so that the authentication process continues with the second authentication component according to the determined order of the authentication components within an authentication process.

State driven orchestration of authentication components in an access manager

A method of applying a timeout protocol by an access manager to a plurality of resources may include storing the timeout protocol comprising at least one criterion, and receiving a request for a first resource. Each of the resources can be segregated into separate application domains, the first resource can be associated with a first attribute, and the first attribute can be assigned a first value. The method may also include determining that the first value satisfies the at least one criterion, associating the timeout protocol with the first resource, and associating the timeout protocol with each resource that is associated with the first attribute assigned a value that satisfies the at least one criterion. The method may further include granting access to the first resource according to the timeout protocol.

Hierarchical criteria-based timeout protocols

Systems and methods are disclosed for using a global unified session identifier across data centers. When a user first accesses a data center and an initial session is created for the user in the data center, a session identifier is generated for the user session. Because the initial session is the first session created for that user, the initial session identifier is designated as the global unified session identifier for all sessions that may be created for the user in other data centers within the enterprise network. Other data centers may then map the global unified session identifiers to locally generated session identifiers for the user. Using a global unified session identifier enables various user session actions to be performed globally across the data centers, including global logout, global session termination, global session updates, and/or the like. Using a global unified session identifier also prevents the risk of collision that can occur between randomly generated numbers of different data centers.

Various arrangements for providing authentication information to a user are presented. A single-point authentication manager executed by a computer system may receive a request to access a resource from a remote client computer system. The single-point authentication manager may manage access to a plurality of resources including the resource. The single-point authentication manager may perform authentication using an authentication plug-in. In response to performing authentication of the user, the authentication plug-in may generate a parameter having a value that is a message to be transmitted to the remote client computer system. In response to receiving the parameter and the value from the authentication plug-in, the single-point authentication manager may transmit the value of the parameter to the application if the authentication is successful and to a credential collector if the authentication of the user failed.

Communication between authentication plug-ins of a single-point authentication manager and client systems

A method for detecting changes in a computing environment. In an example embodiment, the method includes observing a file system of the computing environment during a predetermined time interval and providing a signal when a predetermined change to the file system is detected during the predetermined time interval; employing the signal to log a description of detected file system changes; and using a logged description of the file system changes to perform an incremental crawl of the file system. In a more specific embodiment, the predetermined time interval includes an interval of time between crawls of the file system. The predetermined change to the file system includes a change to content of a file included in the file system, a change in user access rights to a file, a change in a location of a file of the file system, a change in a folder of the file system, a deletion of a file or folder in the file system, and so on.

File change detector and tracker

A method of dynamically communicating a parameter during runtime may include providing a script to a command-line scripting module that uses the parameter, where the parameter is to be provided during runtime by a user and the script is configured to generate an exception including an identifier associated with the parameter. The method may also include generating byte code based on the script, executing the byte code on a virtual machine until the exception is generated, passing the exception to the command-line scripting module, causing, by the command-line scripting module, receiving a parameter value from the user through an input device, passing the parameter value to the virtual machine, and continuing execution of the byte code on the virtual machine.

Dynamic communication between script and execution layers

A master flow controller can branch to a dynamic flow controller for a specific event in an authentication process. The master flow controller saves the state of the plug-in execution before branching the control into the dynamic flow controller. All the attributes stored in the authentication context by the authentication plug-in is saved and synchronized before the control is branched to the child flow controller. After the dynamic flow controller finishes execution, the state information is synchronized between flow controllers.

Growing community of inventors

Bengaluru, India

Ramya Subramanya