Preventing unauthorized access to secured information systems using tokenized authentication techniques

• US 10,057,249 B2
• Filed: 07/20/2016
• Issued: 08/21/2018
• Est. Priority Date: 07/20/2016
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Votaw, Elizabeth S., Keys, Andrew T., Arora, Ashish
• Primary Examiner(s): Turchen, James R
• Application Number:
  US15/214,972
• Publication Number:
  US 20180026960A1
• Time in Patent Office: 762 Days
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A computing platform may receive, from a client portal server, a request to authenticate a user to a user account associated with a client portal provided by the client portal server. Based on receiving the request to authenticate, the computing platform may send, to a social messaging server, an authentication token request message. Subsequently, the computing platform may receive, from the social messaging server, an authentication token. Thereafter, the computing platform may validate the authentication token received from the social messaging server. Based on validating the authentication token received from the social messaging server, the computing platform may generate a validation message directing the client portal server to provide the user with access to the user account. Subsequently, the computing platform may send, to the client portal server, the validation message directing the client portal server to provide the user with access to the user account.

Claims

1. A computing platform, comprising:

at least one processor;

a communication interface communicatively coupled to the at least one processor; and

memory storing computer-readable instructions that, when executed by the at least one processor, cause the computing platform to;

receive, via the communication interface, and from a client portal server, a request to authenticate a first user to a first user account associated with a client portal provided by the client portal server,

wherein the request to authenticate the first user to the first user account associated with the client portal provided by the client portal server comprises information indicating that a first tokenized link has been selected, the first tokenized link having been included in a notification generated by the client portal server and sent via a social messaging service provided by a social messaging server, wherein the social messaging server is operated by a social networking service different from an organization operating the client portal server, and

wherein the first tokenized link comprises a unique identifier linked to the first user account associated with the client portal provided by the client portal server and a first interface of the client portal provided by the client portal server;

based on receiving the request to authenticate the first user to the first user account associated with the client portal provided by the client portal server, send, via the communication interface, and to the social messaging server, a first authentication token request message;

receive, via the communication interface, and from the social messaging server, a first authentication token;

validate the first authentication token received from the social messaging server;

based on validating the first authentication token received from the social messaging server, generate a first validation message directing the client portal server to provide the first user with access to the first user account; and

send, via the communication interface, and to the client portal server, the first validation message directing the client portal server to provide the first user with access to the first user account, wherein sending the first validation message directing the client portal server to provide the first user with access to the first user account causes the client portal server to generate and present the first interface of the client portal associated with the first tokenized link to the first user.

2. The computing platform of claim 1, wherein the first authentication token request message comprises information identifying a first social messaging service account associated with the social messaging service provided by the social messaging server.

3. The computing platform of claim 2, wherein the first authentication token received from the social messaging server comprises information indicating that the first user is authenticated to the first social messaging service account associated with the social messaging service provided by the social messaging server.

4. The computing platform of claim 3, wherein the first validation message directing the client portal server to provide the first user with access to the first user account comprises information indicating that the first user has been authenticated to the first user account based on the first authentication token received from the social messaging server.

5. The computing platform of claim 3, wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:

prior to generating the first validation message directing the client portal server to provide the first user with access to the first user account;

generate a first step-up authentication prompt for a first registered client computing device linked to the first user account;

send, via the communication interface, and to the first registered client computing device linked to the first user account, the first step-up authentication prompt generated for the first registered client computing device linked to the first user account; and

validate a first response to the first step-up authentication prompt generated for the first registered client computing device linked to the first user account,

wherein the first validation message directing the client portal server to provide the first user with access to the first user account is generated based on validating the first response to the first step-up authentication prompt generated for the first registered client computing device linked to the first user account.

6. The computing platform of claim 3, wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:

receive, via the communication interface, and from the client portal server, a request to authenticate a second user to a second user account associated with the client portal provided by the client portal server;

based on receiving the request to authenticate the second user to the second user account associated with the client portal provided by the client portal server, send, via the communication interface, and to the social messaging server, a second authentication token request message;

receive, via the communication interface, and from the social messaging server, a second authentication token;

validate the second authentication token received from the social messaging server;

based on validating the second authentication token received from the social messaging server, generate a second validation message directing the client portal server to provide the second user with access to the second user account; and

send, via the communication interface, and to the client portal server, the second validation message directing the client portal server to provide the second user with access to the second user account.

7. The computing platform of claim 6, wherein the request to authenticate the second user to the second user account associated with the client portal provided by the client portal server comprises information indicating that a second tokenized link included in a notification generated by the client portal server and sent via the social messaging service provided by the social messaging server has been selected.

8. The computing platform of claim 7, wherein the second tokenized link comprises a unique identifier linked to the second user account associated with the client portal provided by the client portal server and a second interface of the client portal provided by the client portal server.

9. The computing platform of claim 7, wherein the second authentication token request message comprises information identifying a second social messaging service account associated with the social messaging service provided by the social messaging server.

10. The computing platform of claim 9, wherein the second authentication token received from the social messaging server comprises information indicating that the second user is authenticated to the second social messaging service account associated with the social messaging service provided by the social messaging server.

11. The computing platform of claim 10, wherein the second validation message directing the client portal server to provide the second user with access to the second user account comprises information indicating that the second user has been authenticated to the second user account based on the second authentication token received from the social messaging server.

12. The computing platform of claim 10, wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:

prior to generating the second validation message directing the client portal server to provide the second user with access to the second user account;

generate a second step-up authentication prompt for a second registered client computing device linked to the second user account;

send, via the communication interface, and to the second registered client computing device linked to the second user account, the second step-up authentication prompt generated for the second registered client computing device linked to the second user account; and

validate a second response to the second step-up authentication prompt generated for the second registered client computing device linked to the second user account,

wherein the second validation message directing the client portal server to provide the second user with access to the second user account is generated based on validating the second response to the second step-up authentication prompt generated for the second registered client computing device linked to the second user account.

13. A method, comprising:

at a computing platform comprising at least one processor, memory, and a communication interface;

receiving, by the at least one processor, via the communication interface, and from a client portal server, a request to authenticate a first user to a first user account associated with a client portal provided by the client portal server,

wherein the request to authenticate the first user to the first user account associated with the client portal provided by the client portal server comprises information indicating that a first tokenized link has been selected, the first tokenized link having been included in a notification generated by the client portal server and sent via a social messaging service provided by a social messaging server, wherein the social messaging server is operated by a social networking service different from an organization operating the client portal server, and

wherein the first tokenized link comprises a unique identifier linked to the first user account associated with the client portal provided by the client portal server and a first interface of the client portal provided by the client portal server;

based on receiving the request to authenticate the first user to the first user account associated with the client portal provided by the client portal server, sending, by the at least one processor, via the communication interface, and to the social messaging server, a first authentication token request message;

receiving, by the at least one processor, via the communication interface, and from the social messaging server, a first authentication token;

validating, by the at least one processor, the first authentication token received from the social messaging server;

based on validating the first authentication token received from the social messaging server, generating, by the at least one processor, a first validation message directing the client portal server to provide the first user with access to the first user account; and

sending, by the at least one processor, via the communication interface, and to the client portal server, the first validation message directing the client portal server to provide the first user with access to the first user account, wherein sending the first validation message directing the client portal server to provide the first user with access to the first user account causes the client portal server to generate and present the first interface of the client portal associated with the first tokenized link to the first user.

14. The method of claim 13, wherein the first authentication token request message comprises information identifying a first social messaging service account associated with the social messaging service provided by the social messaging server.

15. The method of claim 14, wherein the first authentication token received from the social messaging server comprises information indicating that the first user is authenticated to the first social messaging service account associated with the social messaging service provided by the social messaging server.

16. The method of claim 15, wherein the first validation message directing the client portal server to provide the first user with access to the first user account comprises information indicating that the first user has been authenticated to the first user account based on the first authentication token received from the social messaging server.

17. The method of claim 15, comprising:

prior to generating the first validation message directing the client portal server to provide the first user with access to the first user account;

generating, by the at least one processor, a first step-up authentication prompt for a first registered client computing device linked to the first user account;

sending, by the at least one processor, via the communication interface, and to the first registered client computing device linked to the first user account, the first step-up authentication prompt generated for the first registered client computing device linked to the first user account; and

validating, by the at least one processor, a first response to the first step-up authentication prompt generated for the first registered client computing device linked to the first user account,

wherein the first validation message directing the client portal server to provide the first user with access to the first user account is generated based on validating the first response to the first step-up authentication prompt generated for the first registered client computing device linked to the first user account.

18. The method of claim 15, comprising:

receiving, by the at least one processor, via the communication interface, and from the client portal server, a request to authenticate a second user to a second user account associated with the client portal provided by the client portal server;

based on receiving the request to authenticate the second user to the second user account associated with the client portal provided by the client portal server, sending, by the at least one processor, via the communication interface, and to the social messaging server, a second authentication token request message;

receiving, by the at least one processor, via the communication interface, and from the social messaging server, a second authentication token;

validating, by the at least one processor, the second authentication token received from the social messaging server;

based on validating the second authentication token received from the social messaging server, generating, by the at least one processor, a second validation message directing the client portal server to provide the second user with access to the second user account; and

sending, by the at least one processor, via the communication interface, and to the client portal server, the second validation message directing the client portal server to provide the second user with access to the second user account.

19. The method of claim 18, wherein the request to authenticate the second user to the second user account associated with the client portal provided by the client portal server comprises information indicating that a second tokenized link included in a notification generated by the client portal server and sent via the social messaging service provided by the social messaging server has been selected.

20. One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, memory, and a communication interface, cause the computing platform to:

receive, via the communication interface, and from a client portal server, a request to authenticate a first user to a first user account associated with a client portal provided by the client portal server,

wherein the request to authenticate the first user to the first user account associated with the client portal provided by the client portal server comprises information indicating that a first tokenized link has been selected, the first tokenized link having been included in a notification generated by the client portal server and sent via a social messaging service provided by a social messaging server, wherein the social messaging server is operated by a social networking service different from an organization operating the client portal server, and

wherein the first tokenized link comprises a unique identifier linked to the first user account associated with the client portal provided by the client portal server and a first interface of the client portal provided by the client portal server;

based on receiving the request to authenticate the first user to the first user account associated with the client portal provided by the client portal server, send, via the communication interface, and to the social messaging server, a first authentication token request message;

receive, via the communication interface, and from the social messaging server, a first authentication token;

validate the first authentication token received from the social messaging server;

based on validating the first authentication token received from the social messaging server, generate a first validation message directing the client portal server to provide the first user with access to the first user account; and

send, via the communication interface, and to the client portal server, the first validation message directing the client portal server to provide the first user with access to the first user account, wherein sending the first validation message directing the client portal server to provide the first user with access to the first user account causes the client portal server to generate and present the first interface of the client portal associated with the first tokenized link to the first user.