Authorization and Authentication Based on an Individual's Social Network

• US 20160286000A1
• Filed: 06/06/2016
• Published: 09/29/2016
• Est. Priority Date: 07/22/2004
• Status: Active Grant

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Inventors: Lunt, Christopher
• Granted Patent: US 9,798,777 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/24575 using context
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 16/9024 Graphs; Linked lists G06F16/9027 takes precedence
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06Q 50/01 Social networking
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/52 for supporting social networking services
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/60 Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources admission control or resource allocation H04L47/70

Abstract

In particular embodiments, a method includes receiving, from a client device associated with a first entity of a communication service, a request by the first entity to access the communication service, the request comprising an entity identifier (ID) of the first entity, determining whether the first entity is authorized to access the communication service based at least in part on a gray list comprising entity IDs of the entities who are not authorized to access the communication service, wherein the gray list is based on a black list, and prohibiting, by one or more of the computing devices, access to the communication service by the first entity if the first entity is not authorized to access the communication service based on the gray list.

Claims

1. A method comprising, by one or more computing devices:

receiving, from a client device associated with a first entity of a communication service, a request by the first entity to access the communication service, the request comprising an entity identifier (ID) of the first entity;

determining, by one or more of the computing devices, whether the first entity is authorized to access the communication service based at least in part on a gray list comprising entity IDs of the entities who are not authorized to access the communication service, wherein the gray list is based on a black list; and

prohibiting, by one or more of the computing devices, access to the communication service by the first entity if the first entity is not authorized to access the communication service based on the gray list.

2. The method of claim 1, further comprising:

accessing, by one or more of the computing devices, a graph data structure comprising a plurality of nodes and a plurality of edges connecting the nodes, the nodes comprising a first node corresponding to the first entity and one or more second nodes corresponding to one or more second entities associated with the communication service, respectively.

3. The method of claim 2, wherein determining whether the first entity is authorized to access the communication service comprises determining if the first node is connected by an edge to a second node corresponding to an entity on the gray list.

4. The method of claim 2, wherein determining whether the first entity is authorized to access the communication service comprises determining if the first node is connected by an edge to a second node corresponding to an entity on the black list.

5. The method of claim 2, wherein each of edge between two nodes represents a single degree of separation between them.

6. The method of claim 2, wherein the gray list comprises all entities corresponding to nodes within a threshold degree of separation of at least one node corresponding to an entity on the black list.

7. The method of claim 6, wherein the threshold degree of separation is one, two, or three.

8. The method of claim 1, further comprising:

accessing, by one or more of the computing devices, the black list, wherein the black list comprises a first set of entity IDs of a first set of entities, wherein each entity in the first set of entities is not authorized to access the communication service.

9. The method of claim 1, wherein the black list is maintained by the communication service.

10. The method of claim 1, wherein the black list is maintained by a third-party system.

11. The method of claim 1, wherein the request to access the communication service comprises a request to send a message via the communication service.

12. The method of claim 1, wherein the request to access the communication service comprises a request to access a content item on the communication service.

13. The method of claim 1, wherein the request to access the communication service comprises a request to authenticate the first entity via the communication service.

14. The method of claim 1, wherein the communication service comprises an online social network.

15. The method of claim 1, wherein the communication service comprises an e-mail service.

16. The method of claim 1, wherein the communication service comprises a messaging service.

17. The method of claim 1, wherein the request is received from a third-party application via an API associated with the communication service.

18. The method of claim 1, wherein the request is received from a native application associate with the communication service installed on the client device.

19. A service provider system comprising:

one or more processors; and

one or more servers having a memory storing computer-executable instructions that when executed by one or more of the processors cause the processors to;

receive, from a client device associated with a first entity of a communication service, a request by the first entity to access the communication service, the request comprising an entity identifier (ID) of the first entity;

determine whether the first entity is authorized to access the communication service based at least in part on a gray list comprising entity IDs of the entities who are not authorized to access the communication service, wherein the gray list is based on a black list; and

prohibit access to the communication service by the first entity if the first entity is not authorized to access the communication service based on the gray list.

20. A system comprising:

means for receiving, from a client device associated with a first entity of a communication service, a request by the first entity to access the communication service, the request comprising an entity identifier (ID) of the first entity;

means for determining whether the first entity is authorized to access the communication service based at least in part on a gray list comprising entity IDs of the entities who are not authorized to access the communication service, wherein the gray list is based on a black list; and

means for prohibiting access to the communication service by the first entity if the first entity is not authorized to access the communication service based on the gray list.