公开(公告)号：GB2529632A

公开(公告)日：2016-03-02

申请号：GB201415067

申请日：2014-08-26

Applicant: IBM

Inventor： PIPES STEPHEN DAVID ,  JENKINS PETER ,  BROWN KEVIN CHRISTOPHER ,  SUZUKI LARISSA ROMUALDO

IPC: H04L29/08 ,  H04L29/06

Abstract: A method of managing user authentication levels during a user session comprises the steps of: operating a user session for a specific user S2.1; maintaining a user authentication level for the user session S2.2; monitoring one or more factors relating to the user's activity S2.3; applying one or more rules to the monitored factors S2.4; detecting that a rule has indicated the user's current authentication level is too high S2.5; and lowering the user's authentication level, without ending the user's session S2.5 (i.e. keep the user logged in). Monitored factors may include the users current task or the users current location. The users authentication level will be automatically reduced when it is detected to be higher than it needs to be for the users current task, for example, or when the user leaves a safe territory such as his/her home. A visual indication may be output for the current authentication level. The arrangement avoids having to rely on manually stepping-down an authentication level by the user after (manually) stepping-up the authentication level to perform a particular task e.g. online bank transfer. The method acts as a transparent background process to monitor whether the current authentication level is too high.