Authorization and authentication based on an individual's social network

• US 8,291,477 B2
• Filed: 03/26/2010
• Issued: 10/16/2012
• Est. Priority Date: 07/22/2004
• Status: Active Grant

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Inventors: Lunt, Christopher
• Primary Examiner(s): PHAM, LUU T
• Application Number:
  US12/748,139
• Publication Number:
  US 20100180032A1
• Time in Patent Office: 935 Days
• Field of Search: None
• US Class Current: 726/4
• CPC Class Codes: G06F 16/24575 using context
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 16/9024 Graphs; Linked lists G06F16/9027 takes precedence
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06Q 50/01 Social networking
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/52 for supporting social networking services
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/60 Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources admission control or resource allocation H04L47/70

Abstract

An individual'"'"'s social network is used to authorize information flow to the individual and to authenticate the individual for access to certain information or services. Information flow to the individual is authorized if the source of the information is a member of the individual'"'"'s social network who is connected to the individual along a path that does not traverse through anyone on a gray list of the individual. The black list identifies those members who previously sent unwanted communication to the individual or posted content that was deemed offensive by the individual. The gray list identifies those members who are one degree separated from any black list member. The individual is authenticated for access to certain information or services if a member of the individual'"'"'s social network already has access and this member is connected to the individual along a path that does not traverse through anyone on a gray list of the individual, or if members of the individual'"'"'s social network who are connected to the individual along a path that does not traverse through anyone on a gray list of the individual have an average authentication rating that is at least a minimum value.

Claims

1. A method comprising:

receiving, by one or more computing devices, a request to transmit to a first user content relating to a second user, each of the users having a user identifier (ID);

retrieving, by one or more of the computing devices, a black list maintained for the second user, the black list comprising a first set of user IDs of a first set users;

accessing, by one or more of the computing devices, a graph structure defining relationships among a plurality of users, the graph structure comprising a plurality of nodes and connections between the nodes, each node corresponding to one of the users, each connection between two nodes being a single degree of separation between the two users corresponding to the two nodes;

determining, by one or more of the computing devices, a gray list comprising a second set of user IDs of a second set of users based on the relationships defined by the graph structure, each of the users in the second set of users being separated in the graph structure from at least one of the users in the first set of users of the black list by only one degree of separation; and

authorizing, by one or more of the computing devices, the transmission of the content to the first user if the nodes corresponding to the first and second users are connected to each other in the graph structure by a series of connections and nodes that does not comprise a node corresponding to a user in the second set of users of the gray list.

2. The method of claim 1, further comprising transmitting, by one or more of the computing devices, the content to a computing device of the first user if the transmission of the content is authorized and blocking the transmission of the content to the computing device of the first user if the transmission of the content is not authorized.

3. The method of claim 1, wherein the content comprises profile information of the second user.

4. The method of claim 3, wherein the profile information comprises one or more of a unique member identifier, name, age, sex, location, hometown, references to image files, listing of interests, or attributes.

5. The method of claim 1, wherein the first set of user IDs comprises user IDs of users selected by the second user who are not authorized to view content related to the second one of the individuals.

6. The method of claim 1, wherein the first set of user IDs comprises user IDs of users selected by a third-party service provider who are not authorized to view content related to the second user.

7. The method of claim 1, further comprising retrieving, by one or more of the computing devices, a white list comprising a third set of user IDs of a third set of users.

8. The method of claim 7, wherein the third set of user IDs comprises user IDs of selected by the second user who are authorized to view content related to the second user.

9. The method of claim 7 wherein the third set of users comprises all users from the plurality of users corresponding to all nodes from the plurality of nodes, respectively, that are:

connected to the node corresponding to the first user by a series of connections and nodes that does not comprise a node corresponding to one of the users in the first set or second set of users; and

not nodes corresponding to users first set of users.

10. The method of claim 1, further comprising communicating to the first one of the users a notification if the transmission of the content to the first user was not authorized.

11. A system comprising:

one or more processors; and

a memory storing instructions that when executed by one or more of the processors cause the processors to;

receive a request to transmit to a first user content relating to a second user, each of the users having a user identifier (ID);

retrieve a black list maintained for the second user, the black list comprising a first set of user IDs of a first set of users;

access a graph structure defining relationships among a plurality of users, the graph structure comprising a plurality of nodes and connections between the nodes, each node corresponding to one of the users, each connection between two nodes being a single degree of separation between the two users corresponding to the two nodes;

determine a gray list comprising a second set of user IDs of a second set of users based on the relationships defined by the graph structure, each of the users in the second set of users being separated in the graph structure from at least one of the users in the first set of users of the black list by only one degree of separation; and

authorize the transmission of the content to the first user if the nodes corresponding to the first and second users are connected to each other in the graph structure by a series of connections and nodes that does not comprise a node corresponding to one of the users in the second set of users of the gray list.

12. The system of claim 11, wherein the processors are further operable when executing the instructions to:

transmit the content to a computing device of the first user if the transmission of the content is authorized and blocking the transmission of the content to the computing device of the first user if the transmission of the content is not authorized.

13. The system of claim 11, wherein the content comprises profile information of the second user.

14. The system of claim 13, wherein the profile information comprises one or more of a unique member identifier, name, age, sex, location, hometown, references to image files, listing of interests, or attributes.

15. The system of claim 11, wherein the first set of user IDs comprises user IDs of users selected by the second user who are not authorized to view content related to the second user.

16. The system of claim 11, wherein the first set of user IDs comprises user IDs of users selected by a third-party service provider who are not authorized to view content related to the second user.

17. The system of claim 11, wherein the processors are further operable when executing the instructions to retrieve a white list comprising a third set of user IDs of a third set of users.

18. The system of claim 17, wherein the third set of user IDs comprises user IDs of users selected by the second user who are authorized to view content related to the second user.

19. The system of claim 17 wherein the third set of users comprises all users from the plurality of users individuals corresponding to all nodes from the plurality of nodes, respectively, that are:

connected to the node corresponding to the first user by a series of connections and nodes that does not comprise a node corresponding to one of the users in the first set or second set of users; and

not nodes corresponding to users in the first set of users.

20. The system of claim 11, wherein the processors are further operable when executing the instructions to communicate to the first user a notification if the transmission of the content to the first user was not authorized.