Abstract: The disclosed computer-implemented method for securing push authentications may include (i) receiving, by a security service and from a security service relying party, a push authentication for a user that the security service relying party encrypted using a public key assigned to a client device of the user, (ii) forwarding, by the security service, the push authentication to the client device of the user, (iii) receiving, by the security service, a response to the push authentication from the client device of the user, and (iv) forwarding, by the security service, the response to the push authentication from the client device of the user to the security service relying party. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for providing two-factor authentication with an enterprise gateway when an authentication server is unavailable may include (1) receiving, at a computing device, an authentication request from a client device; (2) determining the authentication server is unavailable; (3) sending, to the client device and in response to determining the authentication server is unavailable, a backup credential stored on the enterprise gateway; (4) receiving, from the client device, a security code generated by the backup credential; (5) authenticating the security code; (6) sending, in response to determining the security code is authentic, access approval to the client device. The provided methods may provide authentication, by an enterprise gateway, of one or more factors in a multi-factor authentication system when an authentication server is unavailable. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for facilitating single sign-on for multiple devices may include (1) establishing a login session for a user account, (2) in response to establishing the login session, providing, to a device associated with the user account, a session token for the user account, (3) receiving, from at least one client, a request to access resources associated with the user account, (4) determining that the associated device possesses the session token for the user account, and (5) in response to determining that the associated device possesses the session token, providing, to the client, access to the resources associated with the user account. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The present disclosure relates to changing a password in a proximity-based authentication system. After a successful proximity-based authentication, a password agent may determine that a password does not comply with an administrative password policy. The password agent may then generate a new password that does comply with the administrative password policy and submit a password change request to an administrator of that password policy, without any input by a user at these steps. The user can then request to view the password for input to a service using the same password, and after passing a biometric challenge may view the password.

Abstract: A computer-implemented method for detecting man-in-the-middle attacks may include (1) registering a mobile device of a user within a computing environment as an authenticated mobile device that corresponds to the user, (2) receiving an authentication request to log into a secure computing resource as the user, (3) transmitting, in response to receiving the authentication request, an out-of-band push authentication prompt to the registered mobile device of the user through a different channel than a channel through which the authentication request was received, (4) comparing a geolocation indicated by the authentication request with a geolocation indicated by the registered mobile device, and (5) performing remedial action in response to detecting a man-in-the-middle attack based on a determination that the geolocation indicated by the authentication request and the geolocation indicated by the registered mobile device do not match.

Abstract: The present disclosure relates to changing a password in a proximity-based authentication system. After a successful proximity-based authentication, a password agent may determine that a password does not comply with an administrative password policy. The password agent may then generate a new password that does comply with the administrative password policy and submit a password change request to an administrator of that password policy, without any input by a user at these steps. The user can then request to view the password for input to a service using the same password, and after passing a biometric challenge may view the password.

Abstract: The disclosed computer-implemented method for facilitating single sign-on for multiple devices may include (1) establishing a login session for a user account, (2) in response to establishing the login session, providing, to a device associated with the user account, a session token for the user account, (3) receiving, from at least one client, a request to access resources associated with the user account, (4) determining that the associated device possesses the session token for the user account, and (5) in response to determining that the associated device possesses the session token, providing, to the client, access to the resources associated with the user account. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for blocking push authentication spam may include (1) detecting an attempt by an unauthenticated source to gain access to a web resource protected by an MFA service, (2) issuing, to a mobile device of an authenticated user of the MFA service, a push authentication request to query the authenticated user about whether to allow the unauthenticated source's attempt, (3) determining, based at least in part on the push authentication request issued to the mobile device, that the authenticated user has not allowed the unauthenticated source's attempt, and (4) in response to determining that the authenticated user has not allowed the unauthenticated source's attempt, blacklisting the unauthenticated source such that the MFA service refuses to issue any subsequent push authentication requests in connection with the unauthenticated source. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A computer-implemented method for detecting man-in-the-middle attacks may include (1) registering a mobile device of a user within a computing environment as an authenticated mobile device that corresponds to the user, (2) receiving an authentication request to log into a secure computing resource as the user, (3) transmitting, in response to receiving the authentication request, an out-of-band push authentication prompt to the registered mobile device of the user through a different channel than a channel through which the authentication request was received, (4) comparing a geolocation indicated by the authentication request with a geolocation indicated by the registered mobile device, and (5) performing remedial action in response to detecting a man-in-the-middle attack based on a determination that the geolocation indicated by the authentication request and the geolocation indicated by the registered mobile device do not match.

Abstract: A method and apparatus for knowledge-based authentication by a cloud-based authentication service are described. A cloud-based authentication service is to track credential usage of an end-user at the cloud-based authentication service. The authentication service receives a credential request for credentials associated with the end-user from a relying party website. The end-user no longer has authentication credentials for access to the relying party website. The authentication service issues a dynamic knowledge-based (KB) challenge to the end-user, the dynamic KB challenge being based on at least some of the tracked credential usage of the end-user. The processing logic receives a response to the dynamic KB challenge from the end-user and sends temporary credentials to the relying party for the end-user when the response is validated.

Abstract: Techniques are disclosed for authenticating users to a computing application. A mobile or tablet device is used to generate a security code. Near field communication (NFC) hardware on the mobile device is used to transfer the security code from the mobile device to a computer. To transfer the one-time value, a user simply taps an NFC enabled mobile device on an NFC enabled computing device (e.g. a laptop running a web browser used to access a web service). In one embodiment, doing so triggers a connection between the two devices and an application running on the mobile device transfers the security code to an NFC receiver application running on the computer. The receiving computer may be configured to auto-fill the received security code in the appropriate form field of the application authentication interface.

Abstract: A computer-implemented method for mitigating remote authentication service unavailability. The method may include 1) monitoring an availability of a remote authentication service that an authentication system, while performing multi-factor authentications, uses to validate an authentication factor of the multi-factor authentications, 2) while monitoring the availability of the remote authentication service, detecting that the remote authentication service is unavailable, and 3) in response to detecting that the remote authentication service is unavailable, causing the authentication system to bypass the authentication factor such that the authentication system can perform authentications while the remote authentication service is unavailable. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A computer-implemented method may include providing authentication code for an existing web-based application. The authentication code may be programmed to modify functionality of the existing web-based application as the existing web-based application executes while leaving a binary of the existing web-based application unchanged. The method may also include establishing strong authentication for the existing web-based application by 1) identifying, via the authentication code, a request to bind an authentication credential to a profile of a user, the request being received via a browser through which the existing web-based application is accessed, 2) directing, via the authentication code and in response to the request, the browser to an external authentication site that is not part of the existing web-based application, and 3) at the external authentication site, enabling the user to bind the authentication credential to the profile.

Abstract: Techniques are disclosed for authenticating users to a computing application. A mobile or tablet device is used to generate a security code. Near field communication (NFC) hardware on the mobile device is used to transfer the security code from the mobile device to a computer. To transfer the one-time value, a user simply taps an NFC enabled mobile device on an NFC enabled computing device (e.g. a laptop running a web browser used to access a web service). In one embodiment, doing so triggers a connection between the two devices and an application running on the mobile device transfers the security code to an NFC receiver application running on the computer. The receiving computer may be configured to auto-fill the received security code in the appropriate form field of the application authentication interface.

Abstract: A method for managing offline authentication. The method may include 1) identifying an attempt, by a user, to access a client device, wherein accessing the client device requires the user to be authenticated, 2) determining whether the client device is offline, 3) in response to determining that the client device is offline, authenticating the user using offline authentication, wherein offline authentication does not require an active network connection with a remote authentication service, 4) upon successful authentication of the user using offline authentication, allowing the user to access the client device, 5) monitoring the network-connection state of the client device, 6) detecting that the client device is online, and then 7) in response to detecting that the client device is online, locking the client device in order to require the user to reauthenticate using online authentication, wherein online authentication requires the active network connection with the remote authentication service.

Abstract: Two factor LDAP authentication systems and methods are presented. In one embodiment, implementation of a method for authenticating a user through a two factor process includes: at an LDAP proxy server, receiving a BIND request from a client, wherein the BIND request is for authenticating a user associated with a username to an LDAP server, and wherein the BIND request comprises a password comprising a first factor security code and a second factor security code; stripping the second factor security code from the password; reconfiguring the BIND request with the password that is stripped of the second factor security code; forwarding the reconfigured BIND request to the LDAP server for authentication of the username using the first factor security code; performing authentication of the second factor security code; and positively authenticating the username to the LDAP server when the first factor security code and the second factor security code are authenticated in connection with the username.

Abstract: Two factor LDAP authentication systems and methods are presented. In one embodiment, implementation of a method for authenticating a user through a two factor process includes: at an LDAP proxy server, receiving a BIND request from a client, wherein the BIND request is for authenticating a user associated with a username to an LDAP server, and wherein the BIND request comprises a password comprising a first factor security code and a second factor security code; stripping the second factor security code from the password; reconfiguring the BIND request with the password that is stripped of the second factor security code; forwarding the reconfigured BIND request to the LDAP server for authentication of the username using the first factor security code; performing authentication of the second factor security code; and positively authenticating the username to the LDAP server when the first factor security code and the second factor security code are authenticated in connection with the username.