According to one aspect of the invention,
authorization events trigger
authentication requests for a user during the course of a
computer session. In one example an
authorization event trigger occurs as a user navigates through a web interface. In one embodiment, a user authenticates him or herself to enter a secure site. During the course of navigation through the secure site,
authentication events are triggered.
Authorization events occur when, for example, the user wishes to perform some action associated with the secure site or provide comment on information obtained from the secure site or obtain information from the secure site. The act of submitting or taking some action comprises a triggering event. In response to a triggered
authorization request, a
system related to the secure site (or the same
system) generates
authentication information, in one example, as a one-time
password (OTP) that is transmitted to the user. The hardware /
software necessary to accomplish the generation of a secure OTP resides with the provider hosting the secure site, although one should appreciate that the OTP generation may be delegated to another site or received as a service from a
third party. In one embodiment, the user receives the OTP in the form a page to a
pager. With respect to the medical field, a physician may be required to maintain a
pager and liability can result from its loss or absence. In one example, such a requirement can be leveraged to provide additional
layers of security where
patient data is accessible over networks, and in one example over
the Internet.
Authorization event triggers are also used in conjunction with a
system that does not require an authenticated user before reaching the authorization event triggers. Such environments can include a medical services / treatment environment, a financial services environment, and an information brokerage service environment.