Credential technology

• US 9,516,018 B1
• Filed: 03/13/2014
• Issued: 12/06/2016
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: Microstrategy Incorporated
• Original Assignee: Microstrategy Incorporated
• Inventors: Vazquez, Hector, Chen, Gang, Mironenko, Sergey, Gabriel, Gary
• Primary Examiner(s): Rahman, Mahfuzur
• Application Number:
  US14/209,101
• Time in Patent Office: 999 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity

Abstract

In one implementation, a server system receives, from a device of a user, a request to validate a credential of a second user. The server system identifies the credential of the second user to validate based on the request received from the device of the first user. The server system confirms that the credential of the second user corresponds to a credential issued to the second user by a credential issuing organization. The server system accesses the credential information for the credential of the second user and validates the credential of the second user to the first user.

Claims

1. A computer implemented method comprising:

maintaining, at a server system, credential information for users including a first user and a second user;

receiving, at the server system and from a device of the second user, a request for an alphanumeric code to use in validating a credential of the second user;

generating, by the server system, an alphanumeric code associated with the credential of the second user to be validated;

storing the generated alphanumeric code in association with timing data that defines how long the generated alphanumeric code is valid;

sending, to the device of the second user, the generated alphanumeric code;

receiving, at the server system and from a device of the first user, a request to validate a credential of the second user, wherein receiving the request to validate the credential comprises receiving, at the server system and from the device of the first user, an alphanumeric code based on user input;

identifying, by the server system, the credential of the second user to validate based on the request received from the device of the first user;

determining a match between the alphanumeric code received from the first user and the generated alphanumeric code and that reception of the received alphanumeric code accords with the timing data that defines how long the generated alphanumeric code is valid;

based on the determination of the match between the alphanumeric code received from the first user and the generated alphanumeric code and that reception of the received alphanumeric code accords with the timing data that defines how long the generated alphanumeric code is valid, confirming, at the server system, that the credential of the second user corresponds to a credential issued to the second user by a credential issuing organization;

based on confirmation that the credential of the second user corresponds to a credential issued to the second user by the credential issuing organization, accessing, by the server system and for the credential of the second user, credential information provided by the credential issuing organization; and

validating, to the first user, the credential of the second user based on the accessed credential information provided by the credential issuing organization, wherein validating the credential of the second user comprises transmitting, to the device of the first user;

an electronic notification that the credential of the second user is valid.

2. The method of claim 1:

wherein accessing credential information provided by the credential issuing organization comprises;

prior to the request to validate the credential of the second user;

receiving, from the credential issuing organization, credential information that defines the credential of the second user, and

caching, in electronic storage of the server system, the received credential information in association with cache until data that defines how long the cached credential information is valid;

determining that, at the time of the request to validate the credential of the second user, the cached credential information is valid based on the cache until data; and

accessing the cached credential information; and

wherein validating, to the first user, the credential of the second user based on the accessed credential information provided by the credential issuing organization comprises validating, to the first user, the credential using the cached credential information and sending at least a portion of the cached credential information to the first user.

3. The method of claim 1:

wherein accessing credential information provided by the credential issuing organization comprises;

prior to the request to validate the credential of the second user;

receiving, from the credential issuing organization, credential information that defines the credential of the second user, and

caching, in electronic storage of the server system, the received credential information in association with cache until data that defines how long the cached credential information is valid;

determining that, at the time of the request to validate the credential of the second user, the cached credential information is not valid based on the cache until data;

based on the determination that the cached credential information is not valid, sending, to the credential issuing organization, a request for updated credential information for the credential of the second user; and

receiving, from the credential issuing organization, updated credential information for the credential of the second user; and

wherein validating, to the first user, the credential of the second user based on the accessed credential information provided by the credential issuing organization comprises validating, to the first user, the credential using the updated credential information received from the credential issuing organization and sending at least a portion of the updated credential information to the first user.

4. The method of claim 3:

wherein sending, to the credential issuing organization, the request for updated credential information for the credential of the second user comprises;

accessing, by the server system, a user access token associated with the credential of the second user, the user access token having been stored at the server system prior to the request to validate the credential of the second user based on the credential being added to an account of the second user; and

providing, by the server system and using communication information established between the server system and the credential issuing organization, the accessed user access token, the accessed user access token being provided with the request for updated credential information and being used by the credential issuing organization to verify the request;

wherein receiving, from the credential issuing organization, updated credential information for the credential of the second user comprises receiving, from the credential issuing organization, updated credential information stored at the credential issuing organization in association with the user access token.

5. The method of claim 1:

wherein accessing credential information provided by the credential issuing organization comprises;

accessing, by the server system, a user access token associated with the credential of the second user, the user access token having been stored at the server system prior to the request to validate the credential of the second user based on the credential being added to an account of the second user;

sending, to the credential issuing organization, a request for updated credential information for the credential of the second user;

providing, by the server system and using communication information established between the server system and the credential issuing organization, the accessed user access token with a request for updated credential information for the credential of the second user, the accessed user access token being used by the credential issuing organization to verify the request; and

receiving, from the credential issuing organization, updated credential information for the credential of the second user, the updated credential information being stored at the credential issuing organization in association with the user access token; and

wherein validating, to the first user, the credential of the second user based on the accessed credential information provided by the credential issuing organization comprises validating, to the first user, the credential using the updated credential information received from the credential issuing organization and sending at least a portion of the updated credential information to the first user.

6. The method of claim 1:

wherein validating, to the first user, the credential of the second user comprises transmitting the accessed credential information to the device of the first user in a manner that enables the device of the first user to display the accessed credential information.

7. The method of claim 1, wherein the credential of the second user is a first credential of the second user and the accessed credential information provided by the credential issuing organization is first credential information, the method further comprising:

receiving, at the server system and from the device of the first user, a second request to validate a second credential of the second user, the second credential being different than the first credential and having been issued to the second user by the credential issuing organization, wherein the second request to validate the second credential comprises receiving, at the server system and from the device of the first user, a second alphanumeric code based on user input;

identifying, by the server system, the second credential of the second user to validate based on the second request received from the device of the first user;

confirming, at the server system, based on determining a match between the second alphanumeric code received from the first user and the generated alphanumeric code and that reception of the received alphanumeric code accords with the timing data that defines how long the generated alphanumeric code is valid that the second credential of the second user corresponds to a credential issued to the second user by the credential issuing organization;

based on confirmation that the second credential of the second user corresponds to a credential issued to the second user by the credential issuing organization, accessing, by the server system and for the second credential of the second user, second credential information provided by the credential issuing organization; and

validating, to the first user, the second credential of the second user based on the second credential information provided by the credential issuing organization.

8. The method of claim 1, wherein:

the credential of the second user is a first credential of the second user;

the credential issuing organization is a first credential issuing organization;

the accessed credential information provided by the credential issuing organization is first credential information; and

the method further comprises;

receiving, at the server system and from the device of the first user, a second request to validate a second credential of the second user, the second credential being different than the first credential and having been issued to the second user by a second credential issuing organization that is different than the first credential issuing organization;

identifying, by the server system, the second credential of the second user to validate based on the second request received from the device of the first user;

confirming, at the server system, that the second credential of the second user corresponds to a credential issued to the second user by the second credential issuing organization;

based on confirmation that the second credential of the second user corresponds to a credential issued to the second user by the second credential issuing organization, accessing, by the server system and for the second credential of the second user, second credential information provided by the second credential issuing organization; and

validating, to the first user, the second credential of the second user based on the second credential information provided by the second credential issuing organization.

9. The method of claim 1, further comprising maintaining, by the server system, accounts for multiple, different users with credentials issued by multiple, different organizations.

10. A system comprising:

at least one processor; and

at least one memory coupled to the at least one processor having stored thereon instructions which, when executed by the at least one processor, cause the at least one processor to perform operations comprising;

maintaining, at a server system, credential information for users including a first user and a second user;

receiving, at the server system and from a device of the second user, a request for an alphanumeric code to use in validating a credential of the second user;

generating, by the server system, an alphanumeric code associated with the credential of the second user to be validated;

storing the generated alphanumeric code in association with timing data that defines how long the generated alphanumeric code is valid;

sending, to the device of the second user, the generated alphanumeric code;

receiving, at the server system and from a device of the first user, a request to validate a credential of the second user, wherein receiving the request to validate the credential comprises receiving, at the server system and from the device of the first user, an alphanumeric code based on user input;

identifying, by the server system, the credential of the second user to validate based on the request received from the device of the first user;

determining a match between the alphanumeric code received from the first user and the generated alphanumeric code and that reception of the received alphanumeric code accords with the timing data that defines how long the generated alphanumeric code is valid;

based on the determination of the match between the alphanumeric code received from the first user and the generated alphanumeric code and that reception of the received alphanumeric code accords with the timing data that defines how long the generated alphanumeric code is valid, confirming, at the server system, that the credential of the second user corresponds to a credential issued to the second user by a credential issuing organization;

based on confirmation that the credential of the second user corresponds to a credential issued to the second user by the credential issuing organization, accessing, by the server system and for the credential of the second user, credential information provided by the credential issuing organization; and

validating, to the first user, the credential of the second user based on the accessed credential information provided by the credential issuing organization, wherein validating the credential of the second user comprises transmitting, to the device of the first user, an electronic notification that the credential of the second user is valid.

11. The system of claim 10:

wherein accessing credential information provided by the credential issuing organization comprises;

prior to the request to validate the credential of the second user;

receiving, from the credential issuing organization, credential information that defines the credential of the second user, and

caching, in electronic storage of the server system, the received credential information in association with cache until data that defines how long the cached credential information is valid;

determining that, at the time of the request to validate the credential of the second user, the cached credential information is valid based on the cache until data; and

accessing the cached credential information; and

wherein validating, to the first user, the credential of the second user based on the accessed credential information provided by the credential issuing organization comprises validating, to the first user, the credential using the cached credential information and sending at least a portion of the cached credential information to the first user.

12. The system of claim 11:

wherein accessing credential information provided by the credential issuing organization comprises;

prior to the request to validate the credential of the second user;

receiving, from the credential issuing organization, credential information that defines the credential of the second user, and

caching, in electronic storage of the server system, the received credential information in association with cache until data that defines how long the cached credential information is valid;

determining that, at the time of the request to validate the credential of the second user, the cached credential information is not valid based on the cache until data;

based on the determination that the cached credential information is not valid, sending, to the credential issuing organization, a request for updated credential information for the credential of the second user; and

receiving, from the credential issuing organization, updated credential information for the credential of the second user; and

wherein validating, to the first user, the credential of the second user based on the accessed credential information provided by the credential issuing organization comprises validating, to the first user, the credential using the updated credential information received from the credential issuing organization and sending at least a portion of the updated credential information to the first user.

13. The system of claim 12:

wherein sending, to the credential issuing organization, the request for updated credential information for the credential of the second user comprises;

accessing, by the server system, a user access token associated with the credential of the second user, the user access token having been stored at the server system prior to the request to validate the credential of the second user based on the credential being added to an account of the second user; and

providing, by the server system and using communication information established between the server system and the credential issuing organization, the accessed user access token, the accessed user access token being provided with the request for updated credential information and being used by the credential issuing organization to verify the request;

wherein receiving, from the credential issuing organization, updated credential information for the credential of the second user comprises receiving, from the credential issuing organization, updated credential information stored at the credential issuing organization in association with the user access token.

14. The system of claim 11:

wherein accessing credential information provided by the credential issuing organization comprises;

accessing, by the server system, a user access token associated with the credential of the second user, the user access token having been stored at the server system prior to the request to validate the credential of the second user based on the credential being added to an account of the second user;

sending, to the credential issuing organization, a request for updated credential information for the credential of the second user;

providing, by the server system and using communication information established between the server system and the credential issuing organization, the accessed user access token with a request for updated credential information for the credential of the second user, the accessed user access token being used by the credential issuing organization to verify the request; and

receiving, from the credential issuing organization, updated credential information for the credential of the second user, the updated credential information being stored at the credential issuing organization in association with the user access token; and

wherein validating, to the first user, the credential of the second user based on the accessed credential information provided by the credential issuing organization comprises validating, to the first user, the credential using the updated credential information received from the credential issuing organization and sending at least a portion of the updated credential information to the first user.

15. A non-transitory computer program product embodied in a computer readable medium storing instructions that, when executed, cause one or more computer processors to perform operations comprising:

maintaining, at a server system, credential information for users including a first user and a second user;

receiving, at the server system and from a device of the second user, a request for an alphanumeric code to use in validating a credential of the second user;

generating, by the server system, an alphanumeric code associated with the credential of the second user to be validated;

storing the generated alphanumeric code in association with timing data that defines how long the generated alphanumeric code is valid;

sending, to the device of the second user, the generated alphanumeric code;

receiving, at the server system and from a device of the first user, a request to validate a credential of the second user, wherein receiving the request to validate the credential comprises receiving, at the server system and from the device of the first user, an alphanumeric code based on user input;

identifying, by the server system, the credential of the second user to validate based on the request received from the device of the first user;

determining a match between the alphanumeric code received from the first user and the generated alphanumeric code and that reception of the received alphanumeric code accords with the timing data that defines how long the generated alphanumeric code is valid;

based on the determination of the match between the alphanumeric code received from the first user and the generated alphanumeric code and that reception of the received alphanumeric code accords with the timing data that defines how long the generated alphanumeric code is valid, confirming, at the server system, that the credential of the second user corresponds to a credential issued to the second user by a credential issuing organization;

based on confirmation that the credential of the second user corresponds to a credential issued to the second user by the credential issuing organization, accessing, by the server system and for the credential of the second user, credential information provided by the credential issuing organization; and

validating, to the first user, the credential of the second user based on the accessed credential information provided by the credential issuing organization, wherein validating the credential of the second user comprises transmitting, to the device of the first user, an electronic notification that the credential of the second user is valid.