Authentication policy orchestration for a user device

• US 9,742,809 B1
• Filed: 08/22/2016
• Issued: 08/22/2017
• Est. Priority Date: 07/28/2013
• Status: Active Grant

• Current Assignee: SecureAuth Incorporated
• Original Assignee: Acceptto Corporation
• Inventors: Shahidzadeh, Nahal, Akkary, Haitham
• Primary Examiner(s): Lwin, Maung
• Application Number:
  US15/243,462
• Time in Patent Office: 365 Days
• Field of Search: None
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 20/405 Establishing or using transaction specific rules
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24

Abstract

A system and method for authentication policy orchestration may include a user device, a client device, and a server. The server may include a network interface configured to be communicatively coupled to a network. The server may further include a processor configured to obtain, from a client device via the network, a transaction request for a transaction, determine an authorization requirement for the transaction request based, at least in part, on a plurality of authorization policies, individual ones of the plurality of authorization policies being separately configurable by at least one of a relying party and an authorizing party, and complete the transaction based on the authorization requirement having been met.

Claims

1. A server, comprising:

a network interface configured to be communicatively coupled to a network utilizing a secure communication protocol;

at least one hardware processor configured to;

implement authorization policies which are separately configurable between the authorization policies received from a relying party policy engine located on the server and the authorization policies received from an authorizing party policy engine located on at least one of a plurality of authorizing party user devices;

obtain, from a client device via the network, a transaction request for a transaction;

determine an authorization requirement for the transaction request based on the authorization policies as follows;

a first policy of the authorization policies being configurable by the relying party policy engine but not the authorizing party policy engine;

a second policy of the authorization policies being configurable by the authorizing party policy engine;

a third policy of the authorization policies being based on risk factors related to the transaction and configurable by the relying party policy engine; and

a fourth policy of the plurality of authorization policies based on a habit of at least one of the authorizing party user devices;

obtain for the relying party policy engine a status of the plurality of the authorizing party user devices,

provide a notification of the transaction and an associated transaction context;

divide the transaction request into subtransaction authorization requests that are separately subject to approval by the plurality of authorizing party user devices and transmit the subtransaction authorization requests to the plurality of authorizing party user devices;

receive authorization responses for the subtransaction authorization requests from the plurality of authorizing party user devices; and

complete the transaction by approving the transaction based on the authorization requirement having been met.

2. The server of claim 1:

wherein requiring for an authorization of the subtransaction request, the plurality of the authorizing party devices approve the authorization in one of the following ways;

i) all of the plurality of authorizing party devices provide the authorization responses;

ii) a majority of the plurality of authorizing party devices provide the authorization responses; and

iii) at least some of the plurality of authorizing party devices providing the authorization responses in a reverse seniority sequence with a superior authorizing party of the plurality of authorizing party devices receiving a subtransaction authorization request and providing the authorization response last after at least one of a plurality of inferior authorizing party devices of the plurality of authorizing party devices have provided the authorization response.

3. The server of claim 1, wherein the hardware processor is further configured to conclude the transaction by rejecting the transaction upon receiving a rejection from at least one of the plurality of authorizing party user devices.

4. The server of claim 1, wherein the authorization requirement is an automatic authorization of the transaction and wherein the hardware processor is configured to complete the transaction without input from a plurality of authorizing parties.

5. The server of claim 1, wherein the hardware processor is further configured to:

meet the authorization requirement without input from the plurality of authorizing party user devices based on automatic authorization criterion.

6. The server of claim 1, wherein the plurality of authorization policies further include at least two of:

multiple transacting party user devices;

multiple client devices;

a location of at least one of the client device and at least one of the authorizing party user devices;

a transaction amount;

a status of the network;

an availability of a security token;

provision of biometric information;

provision of a personal identification number (PIN);

an authorization request message delivery mechanism;

proximity;

a timeout;

a serial rejection of preceding transactions; and

a method of providing an authorization response from the authorizing party user devices.

7. The server of claim 1, wherein a configuration of at least one of the plurality of authorization policies by the relying party policy engine supersedes a configuration of the at least one of the plurality of authorization policies by the authorizing party policy engine.

8. The server of claim 1, wherein the transaction is at least one of a monetary transaction, an attempt to access a physical location, an attempt to utilize personal information, and an attempt to access electronic data.

9. The server of claim 1, wherein the authorization policies are further based on a set of policies for content delivery.

10. The server of claim 1, wherein the transaction is a monetary transaction.

11. The server of claim 1, wherein the transaction is an attempt to access a physical location.

12. The server of claim 1, wherein the transaction is an attempt to access electronic data.

13. The server of claim 1, wherein the at least one hardware processor is further configured to transmit a notification of the transaction to at least one of the authorizing party devices of the plurality of authorizing party devices when the authorization requirement is that authorization is not required by the at least one of the plurality of authorizing party devices.

14. The server of claim 1, wherein at least one of the authorization policies further includes requiring biometric information.

15. The server of claim 1, wherein at least one of the authorization policies further requires a location of the client device or at least one of the plurality of authorizing party devices.

16. The server of claim 1, wherein at least one of the authorization policies requires a context of the client device or at least one of the plurality of the authorizing party devices.

17. The server of claim 1, wherein at least one of the authorization policies further include for an authorization of the transaction request the plurality of the authorizing party devices approving the authorization in one of the following ways:

i) at least some of the plurality of authorizing party devices provide the authorization responses in a reverse seniority sequence with a superior authorizing party of the plurality of authorizing party devices receiving an authorization request and providing the authorization response last after at least one of a plurality of inferior authorizing party devices of the plurality of authorizing party devices have provided an authorization response;

ii) the plurality of authorizing party devices provide the authorization response in a reverse seniority sequence with a superior authorizing party of the plurality of authorizing party devices receiving an authorization request and providing the authorization last after all of a plurality of inferior authorizing party devices of the plurality of authorizing party devices have provided authorization responses; and

iii) expiration of a predetermined time and a plurality of the authorizing devices provide the authorization responses.

18. The server of claim 1, wherein at least one of the authorization policies includes an availability of a security token.

19. A system, comprising:

a network interface configured to be communicatively coupled to a network utilizing a secure communication protocol;

a hardware processor to execute a policy engine configured to;

implement authorization policies which are separately configurable between the authorization policies received from a relying party policy engine located on a server and the authorization policies received from an authorizing party policy engine located on at least one of a plurality of authorizing party user devices;

obtain, from a client device via the network, a transaction request for a transaction; and

determine the authorization requirement for the transaction request based on the authorization policies;

a hardware-implemented information engine comprising a processor and instructions executing on the processor, configured to receive a configuration of the authorization policies;

a first policy of the authorization policies being configurable by the relying party server policy engine but not the authorizing party policy engine;

a second policy of the authorization policies being configurable by the authorizing party policy engine, the first policy taking precedence over the second policy;

a third policy of the plurality of authorization policies being based on risk factors related to the transaction and configurable by the relying party policy engine; and

a fourth policy of the plurality of authorization policies based on a habit of the authorizing party user device;

wherein the relying party obtains a status of the plurality of authorizing party user devices, provides a notification of the transaction, and an associated transaction context;

wherein the hardware-implemented information engine is further configured to;

divide the transaction request into subtransaction authorization requests that are separately subject to approval by the plurality of authorizing party user devices and transmit subtransaction authorization requests to the plurality of authorizing party user devices; and

receive authorization responses for the transaction request from the plurality of authorizing party user devices; and

a hardware-implemented transaction engine configured to complete the transaction based on the authorization requirement having been met.

20. The system of claim 19, wherein the hardware-implemented transaction engine is further configured to conclude the transaction by rejecting the transaction upon receiving an authorization rejection in response to at least one of the subtransaction authorization requests.

21. The system of claim 19, wherein the plurality of authorization policies further include at least two of:

multiple transacting party user devices;

multiple client devices;

a location of at least one of the client device and the authorizing party user devices;

a transaction amount;

a status of the network;

an availability of a security token;

provision of biometric information;

provision of a personal identification number (PIN);

an authorization request message delivery mechanism;

proximity;

a timeout;

a serial rejection of preceding transactions; and

a method of providing an authorization response from the plurality of authorizing party user devices.

22. At least one of a plurality of authorizing party user devices, comprising:

a network interface configured to be communicatively coupled to a network;

a hardware processor configured to;

obtain, from a server via the network utilizing a secure communication protocol, a subtransaction authorization request associated with a transaction request which has been divided for separate approval from the plurality of authorizing party user devices, the subtransaction authorization request being based on a plurality of authorization policies, individual ones of the plurality of authorization policies being separately configurable by at least one of a relying party policy engine located on the server and an authorizing party policy engine located on the at least one of the authorizing party user devices;

a first policy of the plurality of authorization policies being configurable by the relying party policy engine but not the authorizing party policy engine;

a second policy of the plurality of authorization policies being configurable by the authorizing party policy engine;

a third policy of the plurality of authorization policies being based on risk factors related to the transaction and configurable by the relying party policy engine; and

a fourth policy of the plurality of authorization policies based on a habit of the at least one of a plurality of authorizing party user devices;

receive the subtransaction authorization request;

a user interface configured to;

display information associated with the subtransaction authorization request; and

obtain an-authorization response from an authorizing party;

wherein the hardware processor is further configured to transmit the authorization response to the server via the network interface.

23. The user device of claim 22, wherein the user interface is further configured to obtain a configuration of at least one of the authorization policies from the at least one of the authorizing party user devices, wherein the subtransaction authorization request is based on the plurality of authorization policies, as configured.

24. The user device of claim 22, wherein the plurality of authorization policies include at least two of:

multiple transacting party user devices;

multiple client devices;

a location of at least one of the client device and the plurality of authorizing party user devices;

a transaction amount;

a status of the network;

an availability of a security token;

provision of biometric information;

provision of a personal identification number (PIN);

an authorization request message delivery mechanism;

proximity;

a timeout;

a serial rejection of preceding transactions; and

a method of providing an authorization response from the at least one of the authorizing party user devices.