Hierarchical multi-transaction policy orchestrated authentication and authorization

• US 10,715,555 B1
• Filed: 11/29/2018
• Issued: 07/14/2020
• Est. Priority Date: 07/28/2013
• Status: Active Grant

• Current Assignee: SecureAuth Incorporated
• Original Assignee: Acceptto Corporation
• Inventors: Shahidzadeh, Nahal, Akkary, Haitham
• Primary Examiner(s): Lwin, Maung T
• Application Number:
  US16/205,134
• Time in Patent Office: 593 Days
• Field of Search: None
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 20/405 Establishing or using transaction specific rules
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24

Abstract

A system and method for authentication policy orchestration may include a user device, a client device, and a server. The server may include a network interface configured to be communicatively coupled to a network. The server may further include a processor configured to obtain, from a client device via the network, a transaction request for a transaction, determine an authorization requirement for the transaction request based, at least in part, on a plurality of authorization policies, individual ones of the plurality of authorization policies being separately configurable by at least one of a relying party and an authorizing party, and complete the transaction based on the authorization requirement having been met.

Claims

1. A server, comprising:

a network interface configured to be communicatively coupled to a network utilizing a secure communication protocol;

at least one hardware processor of a plurality of hardware processors configured to;

implement authorization policies which are separately configurable between the authorization policies received from a relying party policy engine located on the server and the authorization policies received from an authorizing party policy engine located on at least one of a plurality of authorizing party user devices;

obtain, from a client device via the network, a transaction request for a transaction;

determine an authorization requirement for the transaction request based on the authorization policies as follows;

a first policy of the authorization policies being configurable by the relying party policy engine;

a second policy of the authorization policies being configurable by the authorizing policy engine;

a third policy of the authorization policies being configurable by the relying party policy engine or authorizing policy engine and being based on availability of the network; and

a fourth policy of the authorization policies based on a location of at least one of the authorizing party user devices;

obtain for the relying party policy engine a status of the plurality of the authorizing party user devices;

provide a notification of the transaction and an associated transaction context to at least one of the authorizing party user devices;

divide the transaction request into subtransaction authorization requests that are separately subject to approval by the plurality of authorizing party user devices;

receive authorization responses for the subtransaction authorization requests from the plurality of authorizing party user devices; and

complete the transaction by approving the transaction based on the authorization requirement having been met.

2. The server of claim 1, further comprising:

a fifth policy of the authorization policies being configurable by the relying party policy engine or the authorizing policy engine and being based on context of the at least one of the authorizing party user devices.

3. The server of claim 1, further comprising:

a fifth policy of the authorization policies being configurable by the relying party policy engine or the authorizing policy engine and being based on location of the client device.

4. The server of claim 1, wherein the transaction is at least one of a monetary transaction.

5. The server of claim 1, wherein the transaction is an attempt to access a physical location.

6. The server of claim 1, wherein the transaction is an attempt to utilize personal information.

7. The server of claim 1, wherein the transaction is an attempt to access electronic data.