Multi-dimensional framework for defining criteria that indicate when authentication should be revoked

• US 10,491,593 B2
• Filed: 03/20/2018
• Issued: 11/26/2019
• Est. Priority Date: 08/12/2014
• Status: Active Grant

• Current Assignee: BOKU Identity Incorporated
• Original Assignee: Danal Incorporated (Twilio, Inc.)
• Inventors: Banerjee, Atreedev, Cocklin, Jillian
• Primary Examiner(s): Simitoski, Michael
• Application Number:
  US15/926,602
• Publication Number:
  US 20180316669A1
• Time in Patent Office: 616 Days
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06Q 20/322 Aspects of commerce using mobile devices [M-devices]
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

Methods and systems are presented for defining criteria that indicate when authentication for an identified client device should be revoked based on rules associated with interested parties. Authentication information is stored that indicates that an identified client device is authenticated. Rules that are associated with a plurality of interested parties and include rules of different rule types may also be stored. Criteria may be defined based on the rules and the authentication information, the criteria indicating when authentication of the identified client device should be revoked. Authentication of the identified client device may be revoked based on the criteria.

Claims

1. An aggregator system comprising:

a storage system configured to store;

authentication information associated with a client device, wherein the authentication information indicates that the client device has been authenticated,

first rules information received from a first interested party, comprising a first quantitative parameter value and a first priority score;

second rules information received from a second interested party, comprising a second quantitative parameter value, and a second priority score;

processing circuitry implementing a credentials engine configured to;

calculate a resultant quantitative parameter value by performing a mathematical calculation on the first quantitative parameter value, the second quantitative parameter value, the first priority score, and the second priority score;

define criteria indicating when authentication of the client device will be revoked based on the resultant quantitative parameter value; and

invalidation circuitry configured to revoke authentication for the identified client device based on the criteria.

2. The aggregator system of claim 1, wherein the first quantitative parameter value and the second quantitative parameter value comprise time values.

3. The aggregator system of claim 1, wherein:

the authentication information indicates a time at which the client device has been authenticated;

the first quantitative parameter value and the second quantitative parameter value are indicative of a time periods after the time at which the client device has been authenticated.

4. The aggregator system of claim 3, wherein calculating the resultant quantitative parameter value comprises calculating an average of the first quantitative parameter value and second quantitative parameter value, wherein the average is weighted based on the first priority score and the second priority score.

5. The aggregator system of claim 1, wherein the invalidation circuitry is further configured to revoke authentication for the client device based on the criteria being met.

6. The aggregator system of claim 5, wherein the invalidation circuitry is further configured to revoke the authentication for the identified client device after an amount of time indicated by the resultant quantitative parameter value has elapsed after the time at which the client device has been authenticated.

7. The aggregator system of claim 1, wherein each of the first interested party and the second interested party is one of:

a carrier system, a merchant system, a government organization, and a school organization.

8. The aggregator system of claim 1, wherein the first interested party is a carrier system configured to provide mobile network services to the client device, and wherein the second interested party is a merchant system configured to perform at least one transaction with the client device.

9. The aggregator system of claim 1, wherein the at least one credential comprises a digital key.

10. The aggregator system of claim 1, wherein the resultant quantitative parameter value is a weighted average of the first quantitative parameter value and the second quantitative parameter value using a weight based on the first priority score and on the second priority score.

11. A method comprising:

storing, on a storage device, authentication information associated with a client device, wherein the authentication information indicates that the client device has been authenticated,

storing, on the storage device, first rules information received from a first interested party, comprising a first quantitative parameter value and a first priority score;

storing, on the storage device, second rules information received from a second interested party, comprising a second quantitative parameter value, and a second priority score;

calculating, using a credentials engine, a resultant quantitative parameter value by performing a mathematical calculation on the first quantitative parameter value, the second quantitative parameter value, the first priority score, and the second priority score;

defining, using the credentials engine, criteria indicating when authentication of the client device will be revoked based on the resultant quantitative parameter value; and

revoking, using invalidation circuitry, authentication for the identified client device based on the criteria.

12. The method of claim 11, wherein the first quantitative parameter value and the second quantitative parameter value comprise time values.

13. The method of claim 11, wherein:

the authentication information indicates a time at which the client device has been authenticated;

the first quantitative parameter value and the second quantitative parameter value are indicative of a time periods after the time at which the client device has been authenticated.

14. The method of claim 13, wherein calculating the resultant quantitative parameter value comprises calculating an average of the first quantitative parameter value and second quantitative parameter value, wherein the average is weighted based on the first priority score and the second priority score.

15. The method of claim 11, further comprising revoking authentication for the client device based on the criteria being met.

16. The method of claim 15, further comprising revoking authentication for the identified client device after an amount of time indicated by the resultant quantitative parameter value has elapsed after the time at which the client device has been authenticated.

17. The method of claim 11, wherein each of the first interested party and the second interested party is one of:

a carrier system, a merchant system, a government organization, and a school organization.

18. The method of claim 11, wherein the first interested party is a carrier system configured to provide mobile network services to the client device, and wherein the second interested party is a merchant system configured to perform at least one transaction with the client device.

19. The method of claim 11, wherein the at least one credential comprises a digital key.

20. The method of claim 11, wherein the resultant quantitative parameter value is a weighted average of the first quantitative parameter value and the second quantitative parameter value using a weight based on the first priority score and on the second priority score.