Applications login using a mechanism relating sub-tokens to the quality of a master token

• US 10,474,806 B2
• Filed: 11/20/2018
• Issued: 11/12/2019
• Est. Priority Date: 12/29/2011
• Status: Active Grant

• Current Assignee: PayPal, Inc. (PayPal Holdings, Inc.)
• Original Assignee: PayPal, Inc. (PayPal Holdings, Inc.)
• Inventors: Taveau, Sebastien Ludovic Jean, Mardikar, Upendra S.
• Primary Examiner(s): Shaifer Harriman, Dant B
• Application Number:
  US16/196,847
• Publication Number:
  US 20190087560A1
• Time in Patent Office: 357 Days
• Field of Search: 726 9
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/127 Shopping or accessing services according to a time-limitation
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/38215 Use of certificates or encrypted proofs of transaction rights
• CPC Class Codes: G06Q 20/384 using social networks
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 20/405 Establishing or using transaction specific rules
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 9/3226 : using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3228 : One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04L 9/3231 : Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861

Abstract

Methods and systems allow a user to log in to a device so that a number of apps become accessible on the device without the user repeatedly logging in to each different app as the user launches multiple apps. A mechanism of providing a master token with a quality score and providing sub-tokens for each app that can use the sub-token and the score quality to evaluate the level of security provided by the initial login allows each app to skip its own login process and provides a level of enhanced efficiency and convenience for the user. A method includes authenticating a user; creating a master token on the user device; creating a sub-token of the master token for an app launched on the device; the app skipping the login process of the app in response to the sub-token so that the app proceeds directly to validating a transaction.

Claims

1. A system, comprising:

a non-transitory memory; and

one or more hardware processors coupled with the non-transitory memory and configured to read instructions from the non-transitory memory to cause the system to perform operations comprising;

in response to receiving authentication information from a user via a user device, causing a first application on the user device to generate a master token based on a determined quality score associated with the authentication information;

detecting a request to access a second application on the user device; and

in response to the detecting the request to access the second application, causing an authentication process of the user for the second application to be performed based on the master token and the determined quality score, without requiring any additional authentication information from the user.

2. The system of claim 1, wherein the causing the authentication process of the user for the second application to be performed based on the master token and the quality score includes:

causing the first application to generate a first sub-token based on the master token and the quality score, wherein the first sub-token is utilized to perform the authentication process of the user for the second application.

3. The system of claim 2, wherein the first sub sub-token is valid for a period of time determined based on the quality score.

4. The system of claim 1, wherein the causing the authentication process of the user for the second application to be performed based on the master token and the quality score includes based on determining that the quality score exceeds a threshold value associated with the second application, causing the second application to provide access to the user.

5. The system of claim 1, wherein the causing the authentication process of the user for the second application to be performed based on the master token and the quality score includes based on determining that the quality score exceeds a threshold value associated with the second application, causing the second application to provide a limited access to the user.

6. The system of claim 1, wherein the causing the authentication process of the user for the second application to be performed based on the master token and the quality score includes based on determining that the quality score does not exceed a threshold value associated with the second application, denying the user access to the second application.

7. The system of claim 1, the operations further comprising:

detecting a request to access a third application on the user device; and

in response to the detecting the request to access the third application, causing an authentication process of the user for the third application to be performed based on the master token and the determined quality score, without requiring any additional authentication information from the user.

8. A method comprising:

in response to receiving authentication information from a user via a user device, causing, by one or more hardware processors, a first application on the user device to generate a master token based on a determined quality score associated with the authentication information;

detecting, by the one or more hardware processors, a request to access a second application on the user device; and

in response to the detecting the request to access the second application, causing, by the one or more hardware processors, an authentication process of the user for the second application to be performed based on the master token and the determined quality score, without requiring any additional authentication information from the user.

9. The method of claim 8, wherein the causing the authentication process of the user for the second application to be performed based on the master token and the quality score includes:

causing the first application to generate a first sub-token based on the master token and the quality score, wherein the first sub-token is utilized to perform the authentication process of the user for the second application.

10. The method of claim 9, wherein the first sub-token is valid for a period of time determined based on the quality score.

11. The method of claim 8, wherein the causing the authentication process of the user for the second application to be performed based on the master token and the quality score includes based on determining that the quality score exceeds a threshold value associated with the second application, causing the user to be authenticated for access to the second application.

12. The method of claim 8, wherein the causing the authentication process of the user for the second application to be performed based on the master token and the quality score includes based on determining that the quality score exceeds a threshold value associated with the second application, causing the user to be authenticated for a limited access to the second application.

13. The method of claim 8, wherein the causing the authentication process of the user for the second application to be performed based on the master token and the quality score includes based on determining that the quality score does not exceed a threshold value associated with the second application, causing the user to be denied access to the second application.

14. The method of claim 8, further comprising:

detecting a request to access a third application on the user device; and

in response to the detecting the request to access the third application, causing an authentication process of the user for the third application to be performed based on the master token and the determined quality score, without requiring any additional authentication information from the user.

15. A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:

in response to receiving authentication information from a user via a user device, causing a first application on the user device to generate a master token based on a determined quality score associated with the authentication information;

detecting a request to access a second application on the user device; and

in response to the detecting the request to access the second application, causing an authentication process of the user for the second application to be performed based on the master token and the determined quality score, without requiring any additional authentication information from the user.

16. The non-transitory machine-readable medium of claim 15, wherein the causing the authentication process of the user for the second application to be performed based on the master token and the quality score includes:

causing the first application to generate a first sub-token based on the master token and the quality score, wherein the first sub-token is utilized to perform the authentication process of the user for the second application.

17. The non-transitory machine-readable medium of claim 16, wherein the first sub-token is valid for a period of time determined based on the quality score.

18. The non-transitory machine-readable medium of claim 15, wherein the causing the authentication process of the user for the second application to be performed based on the master token and the quality score includes based on determining that the quality score exceeds a threshold value associated with the second application, causing the user to be authenticated for access to the second application.

19. The non-transitory machine-readable medium of claim 15, wherein the causing the authentication process of the user for the second application to be performed based on the master token and the quality score includes based on determining that the quality score exceeds a threshold value associated with the second application, causing the user to be authenticated for a limited access to the second application.

20. The non-transitory machine-readable medium of claim 15, wherein the causing the authentication process of the user for the second application to be performed based on the master token and the quality score includes based on determining that the quality score does not exceed a threshold value associated with the second application, causing the user to be denied access to the second application.