Multi-dimensional framework for defining criteria that indicate when authentication should be revoked

• US 9,461,983 B2
• Filed: 08/12/2014
• Issued: 10/04/2016
• Est. Priority Date: 08/12/2014
• Status: Active Grant

• Current Assignee: BOKU Identity Incorporated
• Original Assignee: Danal Incorporated (Twilio, Inc.)
• Inventors: Banerjee, Atreedev, Cocklin, Jillian
• Primary Examiner(s): SIMITOSKI, MICHAEL J
• Application Number:
  US14/458,058
• Publication Number:
  US 20160050192A1
• Time in Patent Office: 784 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06Q 20/322 Aspects of commerce using mobile devices [M-devices]
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

Methods and systems are presented for defining criteria that indicate when authentication for an identified client device should be revoked based on rules associated with interested parties. Authentication information is stored that indicates that an identified client device is authenticated. Rules that are associated with a plurality of interested parties and include rules of different rule types may also be stored. Criteria may be defined based on the rules and the authentication information, the criteria indicating when authentication of the identified client device should be revoked. Authentication of the identified client device may be revoked based on the criteria.

Claims

1. An aggregator system comprising:

a storage system configured to store;

authentication information associated with an identified client device, wherein the authentication information indicates that the client device has been authenticated; and

rules information comprising rules of different rule types, wherein the different rule types comprise at least one rule type that is based on time and at least one rule type that is based on something other than time, the rules being associated with a plurality of interested parties, wherein each of the rules has a priority associated therewith;

circuitry implementing a credentials engine comprising a multi-dimensional framework that defines criteria indicating when authentication of the identified client device should be revoked based on the authentication information, on the rules information, and on the priority associated with each rule, wherein the credentials engine is configured to reconcile the rules associated with the plurality of interested parties, including when a conflict exists; and

invalidation circuitry configured to revoke authentication for the identified client device based on the criteria.

2. The system of claim 1, wherein the plurality of interested parties comprises at least one of a country, a carrier system, a merchant system, a government organization, and a school organization.

3. The system of claim 1, wherein the authentication information comprises at least one credential.

4. The system of claim 3, wherein the at least one credential comprises a digital key.

5. The system of claim 1, wherein the invalidation circuitry is further configured to revoke authentication for the identified client device based on the criteria being met.

6. The system of claim 5, wherein the criteria are met upon receiving an event notification which matches at least one predetermined event.

7. The system of claim 5, wherein the criteria are met when data associated with the authentication matches at least one condition.

8. The system of claim 1, wherein the rule types comprise at least one of a predetermined time period, a predetermined number of uses, an event identifying the device as lost, an event identifying the device as stolen, an event identifying a deactivated mobile number associated with the client device, an event identifying a fraud alert associated with the client device, a detected change between previously stored hashed information associated with a client device and current hashed information associated with a client device, and any combination thereof.

9. The system of claim 1, wherein the rule types comprise a rule type which specifies detecting a change of information associated with the client device based at least in part on a comparison of previously stored encrypted information associated with the client device to current encrypted information associated with the client device.

10. The system of claim 1, wherein the credentials engine is configured to define criteria which comprise one rule of each of the rule types.

11. The system of claim 1, wherein the criteria comprise a criterion based on a default rule type if the rules do not include a rule of the default rule type.

12. A method comprising:

storing, on a storage device, authentication information associated with an identified client device, wherein the authentication information indicates that the client device has been authenticated;

storing, on a storage device, rules information comprising rules of different rule types, wherein the different rule types comprise at least one rule type that is based on time and at least one rule type that is based on something other than time, the rules being associated with a plurality of interested parties, wherein each of the rules has a priority associated therewith;

defining, using a credentials engine, criteria that indicate when authentication of the identified client device should be revoked based on the authentication information, on the rules information, and on the priority associated with each rule, wherein defining the criteria comprises reconciling the rules associated with the plurality of interested parties when a conflict exists; and

revoking, using invalidation circuitry, authentication for the identified client device based on the criteria.

13. The method of claim 12, wherein the plurality of interested parties comprises at least one of a country, a carrier system, a merchant system, a government organization, and a school organization.

14. The method of claim 12, wherein the authentication information comprises at least one credential.

15. The method of claim 14, wherein the at least one credential comprises a digital key.

16. The method of claim 12, wherein authentication is revoked for the identified client device based on the criteria being met.

17. The method of claim 16, wherein the criteria are met upon receiving an event notification which matches at least one predetermined event.

18. The method of claim 16, wherein the criteria are met when a particular data point associated with the credential matches at least one condition.

19. The method of claim 12, wherein the rule types comprise at least one of a predetermined time period, a predetermined number of uses, an event identifying the device as lost, an event identifying the device as stolen, an event identifying a deactivated mobile number associated with the client device, an event identifying a fraud alert associated with the client device, a detected change between previously stored hashed information associated with a client device and current hashed information associated with a client device, and any combination thereof.

20. The method of claim 12, wherein the rule types comprise a rule type which specifies detecting a change of information associated with the client device based at least in part on a comparison of previously stored encrypted information associated with the client device to current encrypted information associated with the client device.

21. The method of claim 12, wherein the criteria comprise one rule of each of the rule types.

22. The method of claim 12, wherein the criteria comprise a criterion based on a default rule type if the rules do not include a rule of the default rule type.