Service provider initiated additional authentication in a federated system

Patent metadata

Field	Value
Publication number	US-2017187708-A1
Application number	US-201514982116-A
Country	US
Kind code	A1
Filing date	Dec 29, 2015
Priority date	Dec 29, 2015
Publication date	Jun 29, 2017
Grant date	—

Abstract

An indication is received that a user has initiated an access to a website hosted by a service provider. Access to the website requires an authorization of a user identification associated with the user and a password associated with the user. A token is requested. The token provides access to an application programming interface. The token is received. The token is stored by the service provider.

First claim

What is claimed is:

1 . A method for accessing, initiated by a service provider, a high value transaction website using an additional authentication, the method comprising:
receiving, by one or more computer processors, an indication that a user has initiated an access to a website hosted by a service provider, wherein the access to the website requires an authorization of a user identification associated with the user and a password associated with the user; responsive to receiving a validated user identification associated with the user and password associated with the user, requesting, by one or more computer processors, a token, wherein the token provides access to an application programming interface; and receiving, by one or more computer processors, at least one token, wherein the token is stored by the service provider.

2 . The method of claim 1 , further comprising:
receiving, by one or more computer processors, a second indication by the user that the user has initiated access to a high value transaction website hosted by the service provider, wherein the high value transaction website is an area of the website which requires an additional credential beyond the user identification associated with the user and password associated with the user in order to access the area; responsive to receiving the second indication by the user, determining by one or more computer processors, whether the service provider has a token associated with the user; and responsive to determining the service provider has a token associated with the user, transmitting, by one or more computer processors, a one-time password to the user.

3 . The method of claim 1 , further comprising:
receiving, by one or more computer processors, a third indication that the user has provided the one-time password to the high value transaction website hosted by the service provider; receiving, by one or more computer processors, an indication from an identity provider that the one-time password has been verified, and responsive to receiving the indication that the one-time password has been verified, executing, by one or more computer processors, an endpoint, wherein the endpoint allows access to the high value transaction website hosted by the service provider.

4 . The method of claim 1 , wherein the website is a member of a federated system.

5 . The method of claim 4 , wherein the federated system is comprised of any number of member organizations which accept a federated single sign-on user identification and password for access to each website of each member organization.

6 . The method of claim 2 , wherein the step of determining by one or more computer processors, whether the service provider has a token associated with the user; and
responsive to determining the service provider has a token associated with the user, transmitting, by one or more computer processors, a one-time password to the user, comprises: requesting, by one or more computer processors, the token from the service provider; receiving, by one or more computer processors, a validation of the token from an identity provider; and responsive to receiving the validated token from the service provider, transmitting, by one or more computer processors, the one-time password to the user.

7 . The method of claim 1 , wherein the service provider provides web hosting services to the user.

8 . A computer program product for accessing, initiated by a service provider, a high value transaction using an additional authentication, the computer program product comprising:
one or more computer readable storage media; and program instructions stored on the one or more computer readable storage media, the program instructions comprising:
program instructions to receive an indication that a user has initiated an access to a website hosted by a service provider, wherein the access to the website requires an authorization of a user identification associated with the user and a password associated with the user;
responsive to receiving a validated user identification associated with the user and password associated with the user, program instructions to request a token, wherein the token provides access to an application programming interface; and
program instructions to receive at least one token, wherein the token is stored by the service provider.

9 . The computer program product of claim 8 , further comprising program instructions, stored on the one or more computer readable storage media, to:
receive a second indication by the user that the user has initiated access to a high value transaction website hosted by the service provider, wherein the high value transaction website is an area of the website which requires an additional credential beyond the user identification associated with the user and password associated with the user in order to access the area; responsive to receiving the second indication by the user, program instructions to determine whether the service provider has a token associated with the user; and responsive to determining the service provider has a token associated with the user, program instructions to transmit a one-time password to the user.

10 . The computer program product of claim 8 , further comprising program instructions, stored on the one or more computer readable storage media, to:
receive a third indication that the user has provided the one-time password to the high value transaction website hosted by the service provider; receive an indication from an identity provider that the one-time password has been verified, and responsive to receiving the indication that the one-time password has been verified, execute an endpoint, wherein the endpoint allows access to the high value transaction website hosted by the service provider.

11 . The computer program product of claim 8 , wherein the website is a member of a federated system.

12 . The computer program product of claim 11 , wherein the federated system is comprised of any number of member organizations which accept a federated single sign-on user identification and password for access to each website of each member organization.

13 . The computer program product of claim 9 , wherein program instructions to determine whether the service provider has a token associated with the user; and
responsive to determining the service provider has a token associated with the user, program instructions to transmit a one-time password to the user, comprises: program instructions to request the token from the service provider; program instructions to receive a validation of the token from an identity provider; and responsive to receiving the validated token from the service provider, program instructions to transmit the one-time password to the user.

14 . The computer program product of claim 8 , wherein the service provider provides web hosting services to the user.

15 . A computer system for accessing, initiated by a service provider, a high value transaction using an additional authentication, the computer system comprising:
one or more computer processors; one or more computer readable storage media; and program instructions stored on the one or more computer readable storage media for execution by at least one of the one or more computer processors, the program instructions comprising:
program instructions to receive an indication that a user has initiated an access to a website hosted by a service provider, wherein the access to the website requires an authorization of a user identification associated with the user and a password associated with the u

Assignees

• IBM

Inventors

• Moore David P
• Norvill Trevor S
• Nye Philip A J
• Trotter Robert T

Classifications

• H04L63/0838 Primary

  using one-time-passwords · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04L63/0815

  providing single-sign-on or federations · CPC title

• H04L63/0807

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title