Method for global identity verification

Patent metadata

Field	Value
Publication number	US-12537814-B2
Application number	US-202318265567-A
Country	US
Kind code	B2
Filing date	Mar 1, 2023
Priority date	Mar 1, 2022
Publication date	Jan 27, 2026
Grant date	Jan 27, 2026

Abstract

Disclosed herein are system, method, and computer readable media embodiments for global identity verification of a user for multiple services. In some embodiments, a centralized authentication platform (CAP) may receive a request from an independent service to generate an authentication token for a client device based on authentication performed by the service. The CAP may generate an authentication token of a particular authorization level, based on the method of authentication used by the service. The CAP may send the token to the client device as well as store the token in a database. The CAP may receive a second request from a second, unrelated service to validate the authentication token on the client device. The CAP may validate the token on the client device against the token in the database based on an authentication level thereof, and send a response to the second service indicating token validity.

First claim

What is claimed is:

1 . A computer-implemented method, comprising:
receiving, by one or more computing devices from a first service, a first request for an authentication token to be generated for a client device to perform one or more transactions, wherein the first request comprises a unique device identifier for the client device, an indication of successful authentication of the client device by the first service, and a method of authentication, and wherein the one or more transactions includes a first transaction of a first transaction type; determining, by the one or more computing devices, an authorization level based on the method of authentication provided by the first service; determining, by the one or more computing devices, based on the authorization level, a first duration of time for which authentication of the client device is trusted, wherein the first duration of time is associated with the first transaction type; generating, by the one or more computing devices, based on the authorization level, the authentication token for the client device and token information associated with the authentication token, wherein the token information comprises the authorization level for the authentication token and a timestamp indicating when the client device was authenticated, and wherein the authentication token is active based on the timestamp and the first duration of time; sending, by the one or more computing devices to the client device, the authentication token; sending, by the one or more computing devices to the first service, a response indicating the authentication token has been generated for the client device and is valid for use; storing, by the one or more computing devices, the authentication token and token information for the client device in a token database; receiving, by the one or more computing devices, from a second service, a second request to validate authentication of the client device, the second request comprising: the unique device identifier of the client device; a second transaction type for which validation of the client device is required; and an indication that the authentication token is present on the client device; validating, by the one or more computing devices and based on the unique device identifier for the client device, that the authentication token present on the client device is active and valid for performing a transaction of the second transaction type included in the second request, wherein the authentication token present on the client device matches the authentication token stored in the token database; and sending, by the one or more computing devices to the second service, a second response indicating that the authentication token on the client device is active and valid for use.

2 . The computer-implemented method of claim 1 , wherein the method of authentication used to authenticate the client device with the first service is a username and password login.

3 . The computer-implemented method of claim 1 , wherein the token information further comprises a token ID.

4 . The computer-implemented method of claim 1 , wherein the first service is an online merchant.

5 . The computer-implemented method of claim 1 , wherein the second service is an online banking service.

6 . The computer-implemented method of claim 1 , wherein validating that the authentication token on the client device is active and valid for performing the transaction of the second type comprises:
retrieving, by the one or more computing devices, from a services database, data for the second service comprising a second authorization level required for the second transaction type indicated in the second request and a second duration of time for which authentication of the client device is trusted for the second transaction type; determining, by the one or more computing devices, that the authorization level of the authentication token on the client device is equal to or greater than the second authorization level required for the second transaction type; and determining, by the one or more computing devices, based on the timestamp indicating when the client device was authenticated and the first duration of time for which authentication of the client device is trusted for the first transaction type, that authentication of the client device has not expired.

7 . The computer-implemented method of claim 6 , wherein the second transaction type indicated in the second request is one of multiple transaction types for the second service, and wherein each transaction type has a corresponding authorization level that is required to perform corresponding a transaction categorized under that transaction type.

8 . The computer-implemented method of claim 1 , further comprising:
receiving, by the one or more computing devices from the second service, a third request to validate authentication of the client device, wherein the third request includes the unique device identifier for the client device and a third transaction type; validating, by the one or more computing devices, that the authentication token on the client device is not valid for use to perform a transaction of the third transaction type; sending, by the one or more computing devices to the second service, a response indicating that the authentication token on the client device is not valid for use to perform the transaction of the third transaction type; receiving, by the one or more computing devices from the second service, a fourth request for a new authentication token to be generated for the client device, wherein the fourth request comprises the unique device identifier for the client device, an second indication of successful authentication of the client device by the second service, and a second method of authentication; determining, by the one or more computing devices, a second authorization level based on the second method of authentication provided by the second service; generating, by the one or more computing devices, based on the second authorization level, a second authentication token for the client device and a second set of token information associated with the second authentication token, wherein the second set of token information comprises the second authorization level for the second authentication token; sending, by the one or more computing devices to the client device, the second authentication token; sending, by the one or more computing devices to the first service, a response indicating the second authentication token has been generated for the client device and is valid for use; and replacing, by the one or more computing devices, the authentication token and token information for the client device stored in the token database with the second authentication token and the second set of token information for the client device.

9 . The computer-implemented method of claim 8 , wherein the second method of authentication used to authenticate the client device with the second service comprises two-factor authentication.

10 . A method, comprising:
accessing, by a client device, a first application corresponding to a first service, wherein the first application is configured to require authentication of the client device to access a user account managed by the first service, and wherein accessing a user account corresponds to a first transaction type; sending, by the client device to the first service, a first request to access the user account managed by the first service, wherein the first request includes a unique device identifier for the client device; receiving, by the client device from the first service, an indication that authentication of the client device is required and an

Assignees

• Capital One Services Llc

Inventors

• Macomber Jackson
• Rule Jeffrey
• Douglas Lawrence
• Koshy Bob Uni

Classifications

• H04L63/105

  Multiple levels of security · CPC title

• H04L63/083 Primary

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• G06F21/31 Primary

  User authentication · CPC title