System that employs inferencing for troubleshooting complex user authentication problems

[0002] This application claims priority from U.S. Provisional Application No. 60/134,921, Daniel V. LaRue, “Artificial intelligence” based system for troubleshooting token authentication apparatus, filed May 19, 1999.

[0003] 1. Field of the Invention

[0004] This invention relates to authentication systems and artificial intelligence, specifically to an inference system for troubleshooting and maintenance of authentication apparatus.

[0005] 2. Description of Related Art

[0006] To prevent unauthorized access to systems and facilities, many corporations and agencies provide their staff with personal authentication devices such as the credit card sized calculator device in U.S. Pat. No. 4,720,860 to Weiss, Jan. 19, 1998. These devices (tokens) augment or replace traditional password authentication systems (password systems). Token-based authentication provides superior security, when compared to password authentication. Once in use, authentication tokens allow the staff members to obtain secure access to corporate resources. Often these resources are critical to performing tasks.

[0007] When put into practice, these devices and the system components that are necessary for operation (token authentication system) can be comparatively complex. Specifically, the commercial system using Weiss's apparatus has a complexity of usage and of operating state in excess of password systems. The complex states of token authentication systems increase the likelihood of authentication trouble. Whereas password systems have a trivial problem state, token authentication systems have many problem states due to the complexity. The erroneous rejection of an authorized user during authentication is the primary symptom. Historically, the rate of problem occurrence in token authentication systems exceeds that of password systems. Problem states for token authentication systems include user not knowledgeable of token usage, user forgot PIN (personal identification number), token expired, token disabled, and time reference drift. The problem occurrence rate scales up when thousands of users are given authentication devices. The problem states for password systems is trivial, the user forgot the password. Authentication problems with tokens are typically of high urgency, since the staff member with the problem cannot obtain access to the systems needed to perform a task. To enable the staff member to perform their task in a timely manner, the problem should be remedied as quickly as possible. Unfortunately due to the increased complexity, token authentication problems require more time and skill to solve, when compared to password systems. The delay may result in loss of productivity for the staff members unable to attain system access.

[0008] Also due to the increased complexity, token authentication systems require system knowledge and skilled troubleshooting when problems arise. These skills are unique to the particular token authentication system and exceed the skills required for password systems. Authentication problems are typically solved by service personnel, which are trained to solve many types of problems. Service personnel need additional training and on-the-job experience to build the skills necessary for solving problems specific to token authentication systems. The training consumes more resources than those required for password systems. There is a time lag between the time the service personnel start training and the time when troubleshooting proficiency is attained. During that time before proficiency is reached, staff members with authentication problems who call these service personnel, will receive degraded service with possible loss in productivity. Of course, degraded service is counter to the goals of all service organizations.

[0009] Troubleshooting complex authentication systems in an urgent service environment demands a high degree of attention and focus from the service personnel. Issues that must be managed simultaneous to the troubleshooting activity will, in all likelihood, receive reduced attention. This can result in reduced attention on one key issue, the awareness of security and security policies. Unfortunately, reduced attention on security enhances the opportunity for successful security attacks, targeted on the service personnel themselves. This class of security attack is known as “social engineering”. It is understood that, social engineering attacks primarily take advantage of situations that reduce security awareness. Troubleshooting complex systems is a situation that draws attention away from security, thereby weakening security.

[0010] When thousands of staff members use token authentication, many skilled service personnel need to be on duty at all hours to solve potential authentication problems. To properly service thousands of staff members using token authentication, the number of service personnel must be increased or the existing personnel must be increasingly burdened. The overall effect is an increase in resource requirements to properly service thousands of users who have authentication tokens. These resource increases are in excess of those needed for password authentication.

[0011] Thus when put into practice, authentication tokens introduce a new and complex system to the array of systems already present. Due to the critical need that users be able to access the systems being protected by tokens there is a requirement to consistently, quickly and securely troubleshoot and maintain the complex system.

[0012] Accordingly, several objects and advantages of this invention are:

[0013] (a) to provide an inference system that quickly and accurately solves authentication problems in the complex systems used for token authentication—this addresses the increased problem occurrence rate introduced by the added system complexity and addresses the need to urgently solve user authentication problems manifest in complex authentication systems;

[0014] (b) to provide an inference system that delivers consistent, expert-level performance for token authentication system troubleshooting in spite of the variable skills of service personnel—this eliminates degraded troubleshooting performance, due to service personnel who are not skilled in token authentication troubleshooting;

[0015] (c) to provide an inference system that reduces the service skills and system knowledge required for token authentication system troubleshooting—this reduces the resources needed to train a large number of service personnel to be proficient at authentication troubleshooting;

[0016] (d) to provide an inference system that reduces the demand for service personnel attention and explicitly reminds service personnel of security policy during operations that are encountered as a result of authentication problems—this raises the security awareness of personnel, which is the primary defense against social engineering attacks;

[0017] (e) to provide an inference system that can be used by staff members with authentication tokens to solve their own authentication problems without using service personnel—this further reduces the service resources needed to troubleshoot authentication problems;

[0018] (f) to provide an inference system that can be used to automatically perform administrative tasks required to maintain authentication systems;

[0019] Further objects and advantages are to provide an inference system which can be integrated with an authentication system, which has self-contained artificial knowledge or patterns related to troubleshooting and maintaining authentication systems, which contains sufficient knowledge or patterns to solve the classes of authentication problems that consume service resources, which enables companies and agencies to avoid large increases in service resources when deploying authentication tokens to thousands of users, which contains knowledge or patterns that can be enhanced to solve new problems as they are discovered. Still further objects and advantages will become apparent from a consideration of the ensuing description and drawing.

[0020] The objects of the invention are achieved through troubleshooting apparatus for use with a user authentication subsystem of a type that employs a complex user authentication technique such as authentication by token. The apparatus receives inputs from and produces outputs to an interactive interface that a troubleshooter uses to do the troubleshooting. The apparatus includes an authentication information database in the user authentication subsystem and an authentication problem solving system. The authentication information database system responds to a query by providing a result that typically includes state information about the authentication system. The authentication problem solving system includes an inferencer which is able to draw inferences based on information that is known to the inferencer, that is received from the interactive interface, or that is received from the authentication information database. The problem solving system responds to an input from the interactive interface by providing a query to the authentication information database and responds to a result of the query by providing an output to the interactive interface. The provision of the query and/or the output involves the use of the inferencer.

[0021] The output to the interactive interface may be or include a security warning for the problem solver, and the query may specify a modification of the authentication information database. The authentication problem solving system may provide an indication of the proposed modification to the interactive interface and provide the query in response to an input from the interactive interface, giving the troubleshooter the option of permitting the modification or not.

[0022] One way of implementing the inferencer is by means of a knowledge base including rules and facts. The rules are fired in response to the facts, the fact being contained in the knowledge base, having been received from an input, and/or having been received in a result of a query. The output to the interactive interface is the result of the firing of one or more rules.

[0023] The troubleshooting apparatus is particularly useful when the complex user authentication technique involves a token that the user uses to authenticate himself to the user authentication subsystem. The troubleshooting apparatus receives an identifier associated with the token from the interactive interface and uses the identifier to obtain authentication state associated with the token from the authentication database.

[0024] FIG. 1 is a block diagram illustrating the inference system logically between the user interface system and the authentication system, in accordance with the present invention.

[0025] FIG. 2 is a block diagram illustrating the inference system logically between the Web system and the authentication system, in accordance with the present invention.

[0026] FIG. 3 is a diagram of the software layers in the general embodiment consisting of a inference module used in conjunction with an inference system application programming interface (API), and authentication system access client, in accordance with the present invention. Other system components such as application logic and user interface are also shown. Authentication system access server and authentication state database are also shown.

[0027] FIG. 4 is a diagram of the software layers in the preferred embodiment consisting of a JESS expert system shell and knowledge base used in conjunction with a JESS wrapper application programming interface (API), a fix wrapper, and ACE/Server access client, in accordance with the present invention. Other system components are the Java servlet, Web server, Web browser, ACE/Server access server, and ACE/Server database.

[0028] FIG. 5 is a diagram of the software layers in the preferred embodiment that shows the network connections.

[0029] FIG. 6 is a diagram illustrating at a high level, the information and sequence that pass between the inference system, the UI system, and the authentication system in the general embodiment.

[0030] FIG. 7 is a diagram illustrating, the information and sequence that pass between the inference system, the Web system, and the authentication system in the preferred embodiment.

[0031] FIG. 8 and FIG. 9 are the troubleshooter login screens.

[0032] FIG. 10 is the troubleshooter passcode entry screen.

[0033] FIG. 11 is the user entry screen with token serial number entered.

[0034] FIG. 12 is the user initial entry (first question) screen.

[0035] FIG. 13 is a security advisory screen.

[0036] FIG. 14 is a general question screen.

[0037] FIG. 15 is question screen that indicates a fix.

[0038] FIG. 16 is question screen that indicates a solution.

[0039] FIG. 17 is an empty user entry screen, seen when waiting for a user to call with a problem.

[0040] FIG. 18 is the authentication states list.

[0041] FIG. 19 is the possible solution list.

[0042] FIG. 20 shows an actual rule employed in a preferred embodiment.

[0043] FIG. 21A-FIG. 21P is a complete listing of the rules in a preferred embodiment.

[0044] Usually, when a token user has a problem authenticating they call the corporate help desk. The troubleshooter at the help desk then needs to listen to the user's problem statement (typically, simply “I can't log in”) and then solves the authentication problem. Without this invention the troubleshooter needs to access the state of the authentication system 300, from that state reason what the problem might be, ask the user some questions to confirm the problem, and fix the problem.

[0045] Reasoning about the authentication problem and knowing what questions to ask the user require knowledge and skill. This is especially true with some authentication systems since solutions and fixes cannot be directly mapped from authentication state. In one such authentication system the solution to a ‘token disable’ state can be one of many. The token disable state could be caused by, user guessing at the PIN (personal identification number), a hacker, token out of time synchronization or administrative action to intentionally disable the token. The troubleshooter has many possible problem fixes from which to choose. Only one of the fixes is correct. The obvious fix to ‘enable’ the token (affect the token disabled state), is a security violation if administrative action to disable the token has taken place. Synchronizing the token might be a fix, however there is no direct authentication state to determine if that is needed. Synchronizing the token must be inferred from other states, including the length of time it has been since the last successful authentication by the user. Should the troubleshooter enable the token, resynchronize the token, reset the PIN, clear the bad PIN counter, or thwart the hacker? The correct solution is best inferred from a combination or the authentication state and user statements, since in most cases there is no direct mapping of authentication state to the correct solution. Inferring the correct solution can be done by an expert at troubleshooting tokens or by someone less skilled using the inference system in this invention. The authentication state being considered here is only one of many. FIG. 18 shows a more complete list of the singular authentication states. In the states in the authentication system are combinational. As such, the singular states of FIG. 18 combine in various ways to form a larger state space. FIG. 19 shows a more complete list of possible solutions. The solutions are combinational and form a larger solution space.

[0046] This invention provides features that make authentication troubleshooting manageable for those not skilled in authentication systems. With this invention, finding solutions to authentication problems can be accomplished with less dependence on skill. The features of this invention include a question and answer user interface, automatic access of authentication state using database queries, inference of authentication problems to automatically find solutions, inference of security details to automatically remind the user of security issues, remedy of the problem to automatically apply a fix to the authentication state (or other solution to the problem). This invention can be applied to many types of authentication systems, such as time synchronized tokens, cryptographic tokens, smart cards and public key systems.

[0047] The discussion below includes a series of user interface (UI) screen shots, to show how this invention is used to troubleshoot the ‘disabled token’ state problem above. The discussion assumes the troubleshooter has already logged in to the inference system using a Web browser. The troubleshooter login process is described in a later section.

[0048] The troubleshooting process starts when the user with an authentication problem calls the help desk and troubleshooter answers the phone. In this invention, the user is then asked to identify the authentication token with the problem. In the Web browser, in the user entry screen FIG. 11, the token serial number is typed into the entry box 1102 and the submit button 1104 is pressed. This invention then starts the inference process. The process continues internal to the inference system until the inference system makes an external request that a question be answered. The question request results in the presenting the user with the screen in FIG. 12. This screen shows the question and answer interface that is provided by this invention. The question text 1202 presented along with zero or more choices of answers 1204, 1206, 1208, 1210 along with a submit button 1212. As with the ‘disabled token’ troubleshooting example above the user initially states that he could not login. The appropriate answer 1204 is selected by the troubleshooter and the submit button 1212 is pressed. The inference process continues internally using the selected answer.

[0049] The next question is shown in FIG. 13. This question has only one answer 1304. As such, its purpose is not to get an answer but to advise the troubleshooter of a security concern using the question text 1302. The processing has inferred from authentication state that some PIN guessing has occurred, which is a indication of hacker break-in attempt. After being informed, the troubleshooter for instance, might use the procedures established by corporate security to validate the user. Once the troubleshooter is certain that the user has been properly validated, the troubleshooter clicks on submit button 1306. The inference process continues until it determines that the user should be asked if he or she knows his or her PIN. Thereupon the troubleshooting system presents the screen in FIG. 14 to the troubleshooter. The troubleshooter asks the user whether he or she knows his or her PIN (1402), and if the user answers yes, the troubleshooter selects yes 1404 and if not, the troubleshooter selects no 1406 and then presses submit button 1408.

[0050] The inferencing process continues with this new answer and produces the next question, shown in FIG. 15. This question is a special case. It contains a fix for the problem. Given the previous answers, the authentication state and the internal inferences the fix appears in the question text 1502. The system has determined that ‘clearing the count(er)s will enable the disabled token. The troubleshooter has the choice to answer yes 1504 and fix the problem or overrule the system and say no 1506. The yes selection is made and the submit button 1508 is pressed. The system first automatically performs a fix operation on the authentication state. Then the inference process continues searching for another fix if necessary. However, it is determined that the fix was final and the question in FIG. 16 is presented. This question is another special case. It is the solution question that indicates that this troubleshooting session is complete. There is only one answer 1604, so this question is only providing information to the troubleshooter. The question text 1602 indicates that the problem is solved and user should try to log in. With the problem solved the troubleshooter finished the session by pressing submit button 1606. The inference system closes the session and presents an empty user entry screen FIG. 17. The system and the troubleshooter are ready to take another call from a user with an authentication problem. The screen of FIG. 17 is identical to the screen of FIG. 11, with field 1702 corresponding to field 1102, checkbox 1704 permitting the troubleshooter to log out, and submit button 1706 corresponding to submit button 1104.

[0051] The system level block diagram of the present invention is illustrated in FIG. 1. The inference system 200 is logically connected to a user interface (UI) system 100 and an authentication system 300. The UI system is connected by a software interface to the inference system and the inference system is connected by an interface to the authentication system. In a general embodiment the UI system, the inference system and the authentication system, are each composed of certain software components, as shown in FIG. 3. The systems and software components may all execute on the same computer platform. A computer platform is composed of computer hardware and an operating system. Alternatively the systems and software components of this invention may execute on multiple computer platforms, such as in a client/server network or internet computer environment.

[0052] The software components and software interfaces of a general embodiment are depicted in FIG. 3. Though this invention is primarily concerned with the inference system 200, some components of the other systems that are critical to understanding the operation of this invention are shown. In this figure a user interface 102 and application logic 104 are joined by an interface (the line between 102 and 104) and compose the UI system 100. The inference system API (inference system application programming interface) 202, an inference module 204 and the authentication system access client 206 are each joined by interfaces to compose the inference system 200. An authentication system access server 302 and an authentication state database 304 are joined by an interface to compose the authentication system 300. The three systems 100, 200 and 300 are joined by two system interfaces. One system interface is located where the application logic 104 interfaces with the inference system API 202. The other system interface is located where the authentication system access client 206 interfaces with the authentication system server 302.

[0053] The system level block diagram is shown in FIG. 1. Though the operation of the UI system 100 and the authentication system 300, when considered alone, is not essential to this invention, the operation of the UI system and the authentication system (other systems) in combination with the inference system 200 is essential to this invention. Accordingly typical, relevant operations of the UI system and the authentication system are described to enhance understanding of combining the inference system in the present invention with these other systems. Only the essential operations of these other systems are described.

[0054] The sequence diagram FIG. 6 shows a sequence of information that is exchanged between the systems concerning this invention during a troubleshooting or maintenance session. The sequence begins with ‘connect’ 800, proceeds through sequences 810, 820, 830, 840, 850, 860, 870 and 880. The ‘connect’ information and ‘disconnect’ information 880 are used to manage the service connection and occur once. The connection supports one to many troubleshooting sessions. The ‘open session’ 810 and ‘end session’ 870 occur once per troubleshooting session. The other information sequences 820, 830, 840, 850, 860 occur zero to many times and may occur out of order with respect to each other, in other words not in a strict sequence. The session ends when the ‘end session’ information sequence occurs. The description of the operation of this invention will approximately follow the sequence presented in FIG. 6.

[0055] Referring to FIG. 3 and FIG. 6 operation of this invention is initiated by a troubleshooter person who interacts with the user interface 102 and for example activates a graphical user interface (GUI) button to open a connection. The activation is detected by the application logic 104. The application logic will respond by sending ‘connect’ information 800 to the inference system API 202. To begin a troubleshooting session to solve a specific problem the troubleshooter interacts with the user interface. The activation is detected by the application logic, the application responds by sending ‘open session’ information 810 to the inference system API. Information relating to the session that is opened can be included in the ‘open session’ information. For example, if a session is opened to troubleshoot a user's authentication token, then the user identification can be included with the open session information.

[0056] The inference system API responds to the ‘open session’ information, by initiating a query state (internal to the inference system 200) to the authentication system access client 206. The authentication system access client responds by sending ‘authentication state query’ information 820 to the authentication system access server. The authentication system access server collects the state requested in the ‘query state’ information, and responds by sending ‘authentication state’ information 830 to the authentication system access client. The ‘authentication state’ information is translated if necessary by the authentication system access client (or later translated by the inference system API), to a form that is useable by the inference module. The authentication system access client sends the ‘authentication state’ information to the inference system API. The inference system API sends the ‘authentication state’ information to the inference module 204 and the inference module begins processing based on the ‘authentication state’ information.

[0057] In the general embodiment the inference module processes the ‘authentication state’ information using artificial intelligence (AI) techniques as pseudo knowledge to find a solution. There are many AI techniques such as expert systems and neural networks that may be used by the inference module to represent knowledge. Neural networks are a branch of AI that learn to connect patterns to solutions. Neural networks could be used to recognize authentication state patterns and find solutions based on the patterns.

[0058] In the general embodiment, the inference module contains representative knowledge about one or more of the following, troubleshooting an authentication system, maintaining an authentication system, and authentication system security policies. Inference module processing can gather more information by loading information stored in a previous session, getting additional state information from the authentication system via the authentication system access client, or by sending ‘question’ information 850/860 to the application logic via the inference system API. In response to ‘question’ information the application logic presents the troubleshooter with the question via the user interface.

[0059] After the troubleshooter answers the question via the user interface, the application logic sends ‘answer’ information 850 to the inference module via the inference system API. The inference module can send ‘query state’ information to the authentication system or ‘question’ information to the UI system zero or as many times as directed by inference module processing. Inference module processing will continue (including gathering more information) until it detects that a ‘solution’ is found. In some cases, an acceptable end to inference processing is detecting that a solution cannot be found, or in other words a null solution is found.

[0060] When a solution (or null solution) is found the inference module sends ‘solution’ question to the application logic via the inference system API. Also, when a solution is found the inference module may store information about this session for use in a later session. The application logic detects the ‘solution’ question and in conjunction with the user interface presents the troubleshooter with the solution. The troubleshooter confirms the solution via the user interface and the application logic sends ‘end session’ information 870 to the inference system API, which ends the troubleshooting session. When the troubleshooter has completed any number of sessions, the desire to disconnect is indicated via the user interface. The application logic sends ‘disconnect’ information 880 to the inference system and the connection is terminated.

[0061] The system level block diagram of the preferred embodiment is illustrated in FIG. 2. The inference system 200 is logically connected to the Web system 100 and an authentication system 300. The Web system is connected by an interface to the inference system and the inference system is connected by an interface to the authentication system. In the preferred embodiment the Web system, the inference system and the authentication system, are each composed of certain software components shown in FIG. 4. The software components of this invention reside and are executed on multiple computer platforms. A computer platform is composed of computer hardware and an operating system.

[0062] The software components and software interfaces of preferred embodiment are depicted in FIG. 4. Though this invention is primarily concerned with the inference system 200, components of the other systems that are critical to understanding the operation of this invention are shown. In this figure the Web Browser 102A, the Web Server 102B, and the Java servlet 104 are joined by interfaces (the lines between 102A, 102B and 104) and compose the Web System 100. The JESS wrapper API 202, the JESS expert system 204, the ACE/Server access client 206 the Knowledge Base 208, and the Fix Wrapper 210 are joined by interfaces to compose the inference system 200. The ACE/Server access server 302 and the ACE/Server database 304 are joined by an interface to compose the authentication system 300. The three systems 100, 200 and 300 are joined by two system interfaces. One system interface is located where the Java servlet 104 interfaces with the JESS wrapper API 202 and the Fix wrapper 210. The other system interface is located where the ACE/Server access client 206 interfaces with the ACE/Server access server 302.

[0063] The operation of the preferred embodiment is similar to the operation of the general embodiment. The differences are described herein. In the preferred embodiment the JESS expert system 204 (FIG. 4) processes the authentication state information using artificial intelligence techniques specific to expert systems. JESS stands for “Java Expert System Shell.” Typical of expert systems, the JESS expert system uses reasoning or inference to find solutions. The expert system shell reasons using an inference facility, known as an inference engine. The JESS expert system also contains other facilities useful for expert system developers. The JESS expert system used in this embodiment is available for commercial use. The JESS expert system can be obtained from the Web site http://herzberg.ca.sandia.gov/jess/. The JESS expert system is a derivative of the CLIPS expert system. The JESS expert system uses a language that is derived from the language used in the CLIPS expert system. The CLIPS expert system is a development of NASA. In the JESS expert system, inference is controlled by a knowledge base 208, which contains representative knowledge about the problem domain in the form of rules and facts.

[0064] Though not comprehensive, a simplified discussion relating to expert systems is presented to further understanding of this invention. A detailed discussion of expert systems and an explanation of the rules language can be found in “Expert Systems Principles and Programming” by Joseph Giarrantano and Gary Riley, PWS Publishing Company, 1994. In the JESS expert system, multiple inferences occur and are chained together to find a solution. Inferences can be chained in a forward manner or in a backward manner. In the preferred embodiment, forward chaining is used. With forward chaining, reasoning progresses from facts to conclusions about facts. Conclusions generally result in new facts based on other facts. In other word, facts cause rules to be fired (executed), which sets new facts, which in turn causes other rule to fire. The reasoning process continues until a conclusion results in a new fact that represents a solution.

[0065] In this embodiment the knowledge base contains the knowledge needed to troubleshoot a specific authentication system, the ACE/Server system that is produced by RSA Security (RSA) of Bedford, Mass. The knowledge base is developed by one experienced in the expert systems field. The developer obtains knowledge about troubleshooting the ACE/Server system and creates facts and rules base that represents that knowledge. The knowledge is extracted for instance, by interviewing domain experts, reading publications on the subject and from other sources. In this embodiment knowledge is extracted specifically from experts at solving authentication problems. Since without this invention solving authentication problems is a manual process, there are many experts available. From the knowledge extraction, the developer documents the list of facts and resolution strategies related to the problem. A resolution strategy is a specified way that a person finds a solution to a problem. The strategy may include breaking down a big problem into easily solvable smaller problems. Essentially it is a description of the path to a solution. Resolution strategies are used to develop the knowledge base. A resolution strategy may require many rules to be fired and many intermediate facts to be set before a solution is reached. Expert system facts are created by the developer from the list of facts documented during knowledge extraction. Expert system rules are created based on the resolution strategies. The strategies may define additional facts not in the original list of facts. The additional facts are also entered into the expert system.

[0066] Some rules are presented here for discussion. Actual rules have been simplified and translated to English as an aid to understanding for those not versed in the rules language used in the JESS expert system.

[0067] (1) If token:type is standard and the token:bad_PIN is yes Then SET user:PIN_guessing to yes

[0068] (2) If token:enabled is no and user:PIN_guessing is yes Then PRINT “Token was disabled by the ACE/Server due to PIN guessing. Clearing the counts will re-Enable the token and allow the user more tries.”

[0069] The left-hand side (LHS) of rule (1) called the pattern, refers to fact token:type and fact token:bad_PIN. For simplification these are described here as separate facts, in the preferred embodiment these are implemented as one fact that has two slots (type and bad_PIN). These two facts (token:type and token:bad_PIN) represent actual information (state) in the ACE/Server database. Specifically the type of the token (token:type) and whether the user has improperly entered the PIN (token:bad_PIN). The constraints on the LHS indicate that for the rule to fire (execute) the token:type fact must equal to standard (a standard RSA token) and the token:bad_PIN fact must be equal to yes (the user has entered an incorrect PIN). If this is so, then the rule is fired and the right-hand side (RHS) action occurs, which in the case of rule (1) sets the user:PIN_guessing fact equal to yes. Thus a new fact related to the token problem is asserted. As stated previously, conclusions result in new facts based on other facts. The new fact is used to match other rule patterns and the matched rules will fire.

[0070] Rule (2) is one of the potential rules that can be fired based on the user:PIN_guessing fact, since this fact is in the rule's pattern. The token:enabled fact is also in the pattern. If token:enabled is no (token disabled) the pattern is satisfied, since user:PIN_guessing was set to yes when rule (1) fired. When rule (2) fires, information is printed that lets the service person know what has happened and how to fix it.

[0071] Rule (1) and rule (2) implement part of a resolution'strategy to first determine if there has been PIN guessing then determine the results of the PIN guessing. In this case, the token was disabled by the ACE/Server due to PIN guessing. The ACE/Server behaves in this way, because a hacker who has obtained a token will have to guess at PINs to try to break-in. In other words, the ACE/Server thinks there has been a break-in attempt.

[0072] Unfortunately, disabling the token also prevents legitimate users who have forgotten the PIN from getting system access. With the rules as implemented above, the service person is given enough information to fix the problem, however there is a chance that service personnel will be helping a hacker. Helping a hacker get access, is a security violation.

[0073] A simple rule change alleviates this problem. Rule (1) is changed to the following.

[0074] (3) If token:type is standard and the token:bad_PIN is yes Then SET user:pin_guessing to yes; PRINT “Advisory: The ACE/Server indicates there may have been some PIN guessing. This could mean the token is in the wrong hands. Be sure of who you are helping!!!”

[0075] This rule (3) now prints information that raises the security awareness of service personnel. The advisory message in this rule is presented to the troubleshooter in FIG. 13. Armed with this information the service person should verify whom they are helping and avoid helping an unauthorized user. Thus, the expert system is enhanced by adding security knowledge to the rule. The capability of the inference system in this invention to reason or infer about authentication security, reminds the troubleshooter about security. The enhancement improves the apparent skill level of servicing ACE/Server token problems. In order to assist token users properly and without the expert system to guide them, service personnel need to attain knowledge about the details of ACE/Server authentication state, operating features and possible security attacks.

[0076] To allow the JESS expert system to reason about the authentication state (as discussed in paragraphs above) and the troubleshooter answers (as discussed later), the state and answers are reflected in expert system facts. Example facts follow. These have been simplified as an aid to understanding.

[0077] Token:type (allowed-symbols standard soft pad)  (4)

[0078] Token:enabled (allowed-symbols yes no)  (5)

[0079] User_query:has_token (allowed-symbols yes no unknown)  (6)

[0080] User_query:knows_pin (allowed-symbols yes no unknown)  (7)

[0081] Facts (4) and (5) are facts that represent the authentication state of the problematic token obtained from the ACE/Server Database 304. The “allowed-symbols” phrase was included here to show the allowable settings for the fact. Fact token:type (4) represents the ACE/Server Database setting for type of token and fact token:enabled (5) represents the database setting for whether or not the token is enabled. Specifically these database settings are found in the ACE/Server SDToken table and are formally referred to as the iType field and the bEnabled field respectively. The database tables are published in RSA Security's ACE/Server documentation.

[0082] Facts (6) and (7) are facts that represent information obtained by asking questions. Fact user₁₃query:has₁₃token (6) represents the answer to the question “Is the user in possession of the token?” Fact₁₃user_query:knows_pin (7) represents the answer to the question “Does the user know the PIN?” The allowed-symbol unknown represents the fact's setting before the question has been asked. In other words the fact is unknown until the question is answered. Once question is answered only then does the associated fact get set to yes or no. A later discussion shows how a rule asks a question, obtains an answer and sets facts based on the answer. The sections above describe how basic knowledge is represented in the knowledge base and how the JESS expert system reasons using the rules and facts in the knowledge base to troubleshoot token problems.

[0083] To summarize, the JESS expert system reasons with facts that reflect the state of the authentication system, facts that reflect the answers to questions, facts that reflect the symptoms the user is experiencing, and intermediate facts that are part of a resolution strategy relevant to troubleshooting the authentication system. New facts are concluded by the expert system as it reasons until it finds a solution to the authentication problem.

[0084] In this invention the inference system reasons using the answers to troubleshooter question, among other things. The inference system initiates a question that is then answered by the troubleshooter. Initiation of a question occurs in rules. Rules create the text of the question and create the answer choices for the question. Questions are implemented as Java objects. FIG. 20 shows the actual rule 2001 that creates the question that is asked in the screen of FIG. 14. The first rules statement on the RHS of the rule is 2002. This statement establishes a reference to a Java question object. The reference ‘?*question*’ is used to access the question object. Initially the question object is empty. The statement 2004 invokes the ‘setKey’ method of the question object with the argument string “ask-forgot-pin”. Setting the key with a string, establishes an association between this question and the textual information that the troubleshooter sees on the screen 1402. This method of associating a key string with textual information is useful for supporting multiple national languages. The next statement 2006, invokes the question object's ‘addResponseKey’ method with argument “yes”. This associates this question with textual information that represents a possible answer 1404. The “yes” key string is an association, not a direct representation of the text on the screen. Statement 2008 associates this question with the possible answer 1406. With the question text and possible answers established as content in the question object, statement 2010 invokes the question object's ‘ask’ method. This returns the question to the Web system 860 (FIG. 7) Java servlet. Using the contents of the question object displays the screen FIG. 14 to the troubleshooter. Statement 2010 does not finish until the question is answered. When the troubleshooter answers the question and presses the submit button 1408, the selected response 850 gets issued and the ‘?response’ variable in 2010 gets set with the result. In statement 1212 the fact ‘knowsPin’ which represents whether the user knows the PIN, is set to the response. In other words the troubleshooter's answer is represented in the fact ‘knowsPin’. The inference system can now reason with this new information as it searches for a solution. FIGS. 21A-P provide a complete listing of the rules used in a presently-preferred embodiment.

[0085] The discussion below is concerned with how the system components operate together during a token troubleshooting session. The term Java object could be used instead of component. However, component will continue to be used for continuity. The discussion will follow the approximate sequence of a troubleshooting session. The sequence is shown in FIG. 7. However first a discussion of the network topology of the system is in order. The connection between the web browser and the web server is, of course, a network connection. In this embodiment FIG. 5, the Web server and Web servlet 100B reside on the same physical machine as the other inference system components 200. This means that the Web browser 100A resides on a remote machine that communicates across the network to the machine that contains the Web server and the other components (100B and 200). Put another way the Web system 100 is split across two machines that communicate via the network, the Web browser machine 100A and the machine that contains the remaining components 100B. For convenience we will call the machine that contains the components 100B and 200 the ‘inference server.’

[0086] In the preferred embodiment a troubleshooter who wishes to troubleshoot token authentication system problems, starts an interactive session via the Web system. The troubleshooter does this on the web browser 102 (FIG. 4) by entering the web address (URL) 8001 (FIG. 8) of the web server 106 and Java servlet 104 along with his or her login 8002 and then clicking on submit 8004. The web server is configured to start the Java servlet 104 when the that is done. The address is arbitrary and an administration detail not relevant to this invention. If the servlet detects that the session is new, it presents the troubleshooter with a login screen FIG. 9. The troubleshooter is authenticated to be sure they are authorized to access the inference system. This invention requires the troubleshooter to authenticate using a token. The troubleshooter enters the user ID in 902 and presses the submit button 904.

[0087] If the user ID is correct, the servlet then presents the passcode entry screen FIG. 10. The troubleshooter then enters the authentication passcode in 1002 and presses submit button 1004. If the passcode is correct then the servlet continues processing. If the user ID or passcode is incorrect then the servlet does not proceed. Upon proceeding the Java servlet instantiates (creates) the JESS wrapper 800 (FIG. 7) and instantiates the fix wrapper 802. Once created, these components (JESS wrapper 202 and fix wrapper 208, FIG. 4) create the other components that make up the inference system. These components are the JESS expert system 204, ACE/Server access client 206 and other transient components not critical to this discussion.

[0088] Once the JESS wrapper is created, the servlet uses JESS wrapper methods, functions that make up the API used to communicate with the inference system 200. The first method the Java servlet uses is the load rules method 804 i.e. sends the load rules message to the inference system. The terms method, send message or send information can be synonymously. Messages may have arguments. The arguments are annotated in parentheses, FIG. 7. For example, the load rules message includes a fileName argument. The argument is the name of the file that contains the rules to load. The JESS wrapper receives the load rules message and argument, then sends a message (internal to the inference system) to the JESS expert system 204. The messages internal to the systems 100, 200 and 300 are not required to understand the invention and are therefore not discussed. The JESS expert system receives the load rules message and loads the rules. These rules are the rules needed for the inference engine to solve authentication problems as discussed earlier.

[0089] Once the inference system rules are loaded, the inference system is ready to process individual user (troubleshooting) sessions. The user entry screen is shown in FIG. 11. To start a user session, the troubleshooter uses the web browser and enters unique information about the user or the token having the problem. The unique information is usually the token's serial number 1102 (FIG. 11) and clicks on submit button 1104. The unique information can also be the login identity (login ID) of the user having the problem, though only the token serial number is considered here. The servlet sends the open user session message 810 to the inference system. Accompanying this message are a tokenSerialNumber argument that uniquely identifies the token with the problem and a locale argument used for national language localization. Locale is used to allow the troubleshooter to select the language that is displayed during the user session. The details of national language localization are not essential to this discussion.

[0090] As a result of the open user session message the inference system prepares to set the expert system facts in the JESS expert system to reflect the actual state in the ACE/Server database 304. This is done with a query to the ACE/Server Database using unique information. For example, the tokenSerialNumber is used as the database query key. To begin the query the inference system sends an open admin data session message 820 via the ACE/Server access client 206 to the authentication system 300. The arguments included with the open admin data session message are machineName used to select the specific authentication system and ‘port’ used to select the specific service on the authentication system that is provided by the ACE/Server access server 302. In short, the ACE/Server access client 206 (FIG. 5) has connected to the ACE/Server access server 302 via the network using the internet protocol (IP). The client 206 and server 302 use a computer platform independent, computer language independent date exchange protocol, that includes a trust model and data encryption. Security between the inference system and the authentication system is an important aspect of this invention.

[0091] The server is written in the C computer language. The server software can be ported to (compiled and run on) many computer platforms. This allows the server to be used with slight modifications on other authentication systems. The inference system can thus be more easily adapted to troubleshoot authentication systems other than the ACE/Server system. The authentication system 300 is resident on a machine separate from the inference system. The authentication system is running the commercially available ACE/Server version 3.3.1 product of RSA Security. The machine also runs the ACE/Server access server 302 of this invention. Once admin data session 820 is open, the inference system JESS wrapper can send a message to query the ACE/Server database 304.

[0092] The capability of the inference system in this invention to automatically query the ACE/Server database, relieves the troubleshooter from having to do this manually. The retrieve token record message 822 instructs the ACE/Server access server to query the database using the token serial number argument as the query key. When the ACE/Server database has completed the query, the ACE/Server access server returns the token record 832 via the ACE/Server access client to the JESS wrapper. The JESS wrapper converts the token record to token facts and loads the facts into the knowledge base 208. A similar query and conversion is performed for the user record at 824, 834. Thereupon, close admin data session message 826 is sent, ending the admin data session.

[0093] The JESS wrapper can also set facts by accessing information it has save during prior sessions. This allows the JESS expert system to know about prior attempts to fix a problem. With the rules loaded and facts loaded into the knowledge base 208, the JESS expert system has all it needed to begin reasoning. The JESS wrapper sends an internal message to the JESS expert system to start reasoning. The capability of the inference system in this invention to reason or infer about authentication troubleshooting relieves the troubleshooter from having to reason about the detailed authentication problems. The JESS expert system fires rules and sets facts until it determines that a question should be asked. The first question 840 is returned to the Web system. This question is the returned results from the open user session 810 that occurred earlier.

[0094] In this embodiment, the first question is concerned with the general nature of the authentication problem, as shown in FIG. 12. This is part of a resolution strategy to reason from general to the specific. Questions returned by the inference system are implemented as Java objects that contain text and the possible answers to those questions. The Java servlet 104 (FIG. 4) uses the contents to the question object to create an html page (screen) that is displayed to the troubleshooter via the Web server and Web browser. The troubleshooter then selects the appropriate answer 1204 (FIG. 12). Some questions present advisory information to the troubleshooter (FIG. 13). This type of question has zero or one answers. The Java servlet sends the select response message 850 (FIG. 7) to the inference system's JESS wrapper, which forwards the response to the JESS expert system.

[0095] The JESS expert system then continues reasoning with a fact set to reflect the answer to the question. When the JESS expert system determines that another question should be asked, a new question is returned 860 from the earlier selected response and displayed by the servlet FIG. 14. The troubleshooter answers the question 1404 (FIG. 14) and a new select response message is sent to the inference system. The select-response/return-question (850/860) cycle occurs zero to many times as determined by the JESS expert system. In short the troubleshooter gets asked questions and the expert system reasons about the answers to find a solution to the authentication problem.

[0096] The question object has state that indicates if it contains a fix. The JESS expert system sets the question to contain a fixKey when it has found a fix to the authentication problem. Fixes are not limited to one. One to many fixes may occur for a particular problem as determined by the JESS expert system. When a fix does occur, the troubleshooter can select 1504 (FIG. 15) that a fix session can be opened 862. The purpose of a fix session is to remedy the problem automatically so that the troubleshooter has only to allow or disallow the fix. This relieves the troubleshooter from having to perform manual fix operations and eliminates mistakes that could be made during manual fix operations. The Java servlet obtains the fixKey from the question and sends the open fix session message and the fixKey argument 862 to the fix wrapper 210. The fix wrapper uses the fixKey to lookup fix operation(s) to be performed. The fix operations can provide information to the troubleshooter, such as instructions to inform the user of a mistake they have made. The information to the troubleshooter is send in the return fix results message 867 sent by the fix wrapper.

[0097] The fix operations can also remedy problems in the ACE/Server Database (authentication state). In this case, the fix wrapper sends an open admin update session 864 via the ACE/Server access client 302 to the authentication system ACE/Server access server. As with the open admin data session 820 above the open admin update session creates a network connection from the inference system to the authentication system. Based on the fixKey the fix wrapper with send the appropriate fix operation message 865 and argument to the authentication system. The authentication system sends return fix results 866 to the inference system fix wrapper in response to the fix operation message. The fix wrapper sends return fix result 867 to the Web system Java servlet. The fixKey is used by the fix wrapper to lookup one or more fix operations. When all the fix operations have be accomplished the fix wrapper will send the close admin update session message 868.

[0098] To recap, select-response/return-question (850/860) cycles and fix sessions (862, 864, 865, 866, 867, 868) can occur zero to many times during a user session. The select-response/return-question cycle ends when a special solution question is returned. The question object has state that indicates if it contains a solution. The JESS expert system sets the question to contain a solution when it has determined that the authentication system problem has been solved or reasoning cannot continue. The JESS expert system stops reasoning when a solution has been determined. Only one solution occurs per user session, which starts with the open user session message 810. When a solution is indicated the Java servlet 104 displays the solution to the troubleshooter (FIG. 16) and upon confirmation the servlet sends the close user session message to the inference system JESS wrapper 202. The servlet then displays a screen that allows the troubleshooter to open the next user session (FIG. 17). Zero to many user sessions can occur. When the troubleshooter no longer needs access to the inference system (i.e. no longer needs to open user sessions) the troubleshooter can select logout (870) and the Java servlet will destroy the fix wrapper (880) and the JESS wrapper (882). Destroying the JESS wrapper will also automatically destroy the JESS expert system and the ACE/Server access client. The ACE/Server access server though disconnected from the ACE/Server access client, is not destroyed and remains running ready to service any ACE/Server access clients that request service.

[0099] In this embodiment, many troubleshooters can each use one instance of a Web browser 102 and connect to the Web Server 106. Only one instance of the Java servlet 104 exists. However, through the session management capabilities of the Java servlet, an instance of the inference system 200 (JESS wrapper 202, fix wrapper 210, JESS expert system 204 and the ACE/Server access client 206) is created for each troubleshooter that connects to the Web server. Troubleshooters and inference systems have a one-to-one association. Each inference system connects to only one authentication system 300.

[0100] In this embodiment, the Java Servlet 104 conforms to the Java Servlet Version 2.0 API as published by Sun Microsystems Web site ://java.sun.com/products/servlet/index.html. Details of Java servlet programming can be found in “Java Servlet Programming” by Jason Hunter, O'Reilly & Associates, Inc., 1998. The Web server 106 and the Web browser 102 are commercial off-the-shelf products. The Web server supports servlets, supports SSL encryption to the browser, and is configured to run the Java servlet in this embodiment. The ACE/Server access server 302 accesses the ACE/Server database 304 using the ACE/Server Administration Toolkit API and the ESQL query language as provided by RSA Security.

[0101] The foregoing Detailed Description has disclosed to those skilled in the art of troubleshooting user authentication subsystems of the type that employ a complex user authentication technique how to make and use interactive troubleshooting apparatus that greatly simplifies the troubleshooting of such systems. The Detailed Description has moreover disclosed the best mode presently known to the inventor of practicing his invention. It will, however, be immediately apparent to those skilled in the arts of user authentication and troubleshooting that many other troubleshooting systems that employ the principles of the one disclosed herein may be built and used. For example, the troubleshooting system disclosed herein is used in an authentication system that employs tokens; the principles of the invention can, however, be used to make a troubleshooting system for any authentication system that involves complex authentication state. The details of such a troubleshooting system will necessarily be determined by the kind of authentication system. Further, the system disclosed herein employs a knowledge base to do its inferencing; other troubleshooting systems that operate according to the principles of this invention may employ other techniques, for example, neural networks, to do the inferencing. Finally, at the level of implementation, the exact forms of rules will be determined not only by the particular authentication system the troubleshooting system is being used with, but also by the particular knowledge base system being used. The same is true for the precise form of the user interface, which will be determined by the particular authentication system and the kind of interactive user interface that is being employed.

[0102] For all of the foregoing reasons, the Detailed Description is to be regarded as being in all respects exemplary and not restrictive, and the breadth of the invention disclosed here in is to be determined not from the Detailed Description, but rather from the claims as interpreted with the full breadth permitted by the patent laws.