SYSTEMS AND METHODS TO AUTHENTICATE USERS AND/OR CONTROL ACCESS MADE BY USERS ON A COMPUTER NETWORK USING IDENTITY SERVICES
6 Assignments
0 Petitions
Accused Products
Abstract
A controller for user authentication and access control, configured to: store data representing a graph having: nodes representing data elements associated with accesses made using an access token; and links among the nodes representing connections between the data elements identified in details of the accesses. In response to receiving details of an access made using the access token, the controller updates the graph according to the details and identifies a new connection in the graph resulting from update. The controller communicates with an identity service to verify the association of data elements corresponding to the new connection in the graph. Based on a result of the verification, the controller authenticates the user of the access and/or controls the access.
-
Citations
24 Claims
-
1. (canceled)
-
6. A controller for user authentication and access control, the controller comprising:
-
at least one microprocessor; a network interface controlled by the at least one microprocessor to communicate over a computer network with; at least one computing site, and at least one identity service, wherein the identity service stores identification information of a user and is configured to communicate with the user for identity protection; and memory coupled with the at least one microprocessor and storing; graph data representing a graph having; nodes representing data elements associated with accesses made using an access token, and links among the nodes representing connections between the data elements associated with the accesses made using the access token; and instructions which, when executed by the at least one microprocessor, cause the controller to; receive, from the computing site, input data specifying details of an access made using the access token; determine, from the input data; a device identity representing a user device from which the access is made using the access token, and a user identity representing the user who uses the user device to make the access using the access token; update the graph according to the input data; identify a connection in the graph resulting from updating the graph according to the input data, wherein the connection identified in the graph is one of; a connection between a node representing the device identity and a node representing the user identity; a connection to a shipping address added in the updating of the graph; and a connection to an access token added in the updating of the graph; transmit a query over the network to the identity service, the query causing the identity service to verify association of data elements corresponding to the connection identified in the graph; receive, over the network and from the identity service, a validation responsive to the query; and process, based on the validation, the access made using the access token. - View Dependent Claims (2, 3, 4, 5, 7)
-
-
8. A controller for user authentication and access control, the controller comprising:
-
at least one microprocessor; a network interface controlled by the at least one microprocessor to communicate over a computer network with; at least one computing site, and at least one identity service, wherein the identity service stores identification information of a user and is configured to communicate with the user for identity protection; and memory coupled with the at least one microprocessor and storing; graph data representing a graph having; nodes representing data elements associated with accesses made using an access token, and links among the nodes representing connections between the data elements associated with the accesses made using the access token; and instructions which, when executed by the at least one microprocessor, cause the controller to; receive, from the computing site, input data specifying details of an access made using the access token; determine, from the input data; a device identity representing a user device from which the access is made using the access token, and a user identity representing the user who uses the user device to make the access using the access token; update the graph according to the input data; identify a connection in the graph resulting from updating the graph according to the input data; transmit a query over the network to the identity service, the query causing the identity service to verify association of data elements corresponding to the connection identified in the graph, wherein the association of the data elements corresponding to the connection identified in the graph includes association of attributes of the device identity and the user identity; receive, over the network and from the identity service, a validation responsive to the query; and process, based on the validation, the access made using the access token. - View Dependent Claims (21, 22)
-
-
9. A controller for user authentication and access control, the controller comprising:
-
at least one microprocessor; a network interface controlled by the at least one microprocessor to communicate over a computer network with; at least one computing site, and at least one identity service, wherein the identity service stores identification information of a user and is configured to communicate with the user for identity protection; and memory coupled with the at least one microprocessor and storing; graph data representing a graph having; nodes representing data elements associated with accesses made using an access token, and links among the nodes representing connections between the data elements associated with the accesses made using the access token; and instructions which, when executed by the at least one microprocessor, cause the controller to; receive, from the computing site, input data specifying details of an access made using the access token; determine, from the input data; a device identity representing a user device from which the access is made using the access token, and a user identity representing the user who uses the user device to make the access using the access token; update the graph according to the input data; identify a connection in the graph resulting from updating the graph according to the input data; transmit a query over the network to the identity service, the query causing the identity service to verify association of data elements corresponding to the connection identified in the graph; receive, over the network and from the identity service, a validation responsive to the query; and process, based on the validation, the access made using the access token, wherein the controller flags the user identity as an imposter candidate in response to the determination that the identity service cannot confirm the association of the data elements corresponding to the connection identified in the graph. - View Dependent Claims (10, 11, 23, 24)
-
-
12. A controller for user authentication and access control, the controller comprising:
-
at least one microprocessor; a network interface controlled by the at least one microprocessor to communicate over a computer network with; at least one computing site, and at least one identity service, wherein the identity service stores identification information of a user and is configured to communicate with the user for identity protection; and memory coupled with the at least one microprocessor and storing; graph data representing a graph having; nodes representing data elements associated with accesses made using an access token, and links among the nodes representing connections between the data elements associated with the accesses made using the access token; wherein the graph is generated based on a cluster of access activities after identifying the cluster from a set of access activities; and instructions which, when executed by the at least one microprocessor, cause the controller to; receive, from the computing site, input data specifying details of an access made using the access token; determine, from the input data; a device identity representing a user device from which the access is made using the access token, and a user identity representing the user who uses the user device to make the access using the access token; update the graph according to the input data; identify a connection in the graph resulting from updating the graph according to the input data; transmit a query over the network to the identity service, the query causing the identity service to verify association of data elements corresponding to the connection identified in the graph; receive, over the network and from the identity service, a validation responsive to the query; and process, based on the validation, the access made using the access token. - View Dependent Claims (13, 14, 15, 16)
-
-
17. A non-transitory computer storage medium storing instructions which, when executed by a controller, cause the controller to perform a method for user authentication and access control, the method comprising:
-
storing, in the controller coupled to a network, graph data representing a graph having; nodes representing data elements associated with accesses made using an access token, and links among the nodes representing connections between the data elements associated with the accesses made using the access token; wherein the graph is generated based on a cluster of access activities after identifying the cluster from a set of access activities; receiving, in the controller over the network from the computing site, input data specifying details of an access made using the access token; determining, by the controller, from the input data; a device identity representing a user device from which the access is made using the access token, and a user identity representing the user who uses the user device to make the access using the access token; updating, by the controller, the graph according to the input data; identifying, by the controller, a connection in the graph resulting from updating the graph according to the input data; transmitting, by the controller over the network to an identity service storing identification information of a user and configured to communicate with the user for identity protection, a query over the network to the identity service, the query causing the identity service to verify association of data elements corresponding to the connection identified in the graph; receiving, in the controller over the network and from the identity service, a validation responsive to the query; and processing, by the controller based on the validation, the access made using the access token.
-
-
18. A method for user authentication and access control, the method comprising:
-
storing, in a controller coupled to a network, graph data representing a graph having; nodes representing data elements associated with accesses made using an access token, and links among the nodes representing connections between the data elements associated with the accesses made using the access token; wherein the graph is generated based on a cluster of access activities after identifying the cluster from a set of access activities; receiving, in the controller over the network from the computing site, input data specifying details of an access made using the access token; determining, by the controller, from the input data; a device identity representing a user device from which the access is made using the access token, and a user identity representing the user who uses the user device to make the access using the access token; updating, by the controller, the graph according to the input data; identifying, by the controller, a connection in the graph resulting from updating the graph according to the input data; transmitting, by the controller over the network to an identity service storing identification information of a user and configured to communicate with the user for identity protection, a query over the network to the identity service, the query causing the identity service to verify association of data elements corresponding to the connection identified in the graph; receiving, in the controller over the network and from the identity service, a validation responsive to the query; and processing, by the controller based on the validation, the access made using the access token. - View Dependent Claims (19, 20)
-
Specification