Method and system for proxy-driven authentication and authorization for software

Patent metadata

Field	Value
Publication number	US-2023421558-A1
Application number	US-202318212410-A
Country	US
Kind code	A1
Filing date	Jun 21, 2023
Priority date	Jun 25, 2022
Publication date	Dec 28, 2023
Grant date	—

Abstract

A method for using a proxy service as an intermediary between an end service and a client for authenticating and authorizing software is provided. The method includes: receiving a first service request from a user; generating and transmitting a request for an identity authentication token by mapping information included in the first request to an application programming interface (API) that is used by an identity provider; receiving a second service request in conjunction with the identity authentication token; verifying an authorization of the user; generating and transmitting a third service request by mapping information included in the authorization of the user to an API that is used by a service provider; receiving data is responsive to the third service request from the service provider; and transmitting data that is responsive to the second service request to the user.

First claim

What is claimed is:

1 . A method for authenticating a service, the method being implemented by at least one processor, the method comprising:
receiving, by the at least one processor from a user, a first request for a service, the user including at least one from among a person and an application; transmitting, by the at least one processor to an identity provider, a request for an identity authentication token that relates to the user; receiving, by the at least one processor from the user, a second request for the service in conjunction with the identity authentication token; verifying, based on the identity authentication token by the at least one processor, an authorization of the user to submit the second request for the service; transmitting, by the at least one processor to a service provider, a third request for providing the service to the user; receiving, by the at least one processor from the service provider, data that is responsive to the third request; and transmitting, by the at least one processor to the user, data that is responsive to the second request.

2 . The method of claim 1 , further comprising: after the data that is responsive to the third request is received, filtering the data that is responsive to the third request based on the authorization of the user in order to generate the data that is responsive to the second request.

3 . The method of claim 1 , wherein the data that is responsive to the second request includes data that is usable by the user for receiving the service.

4 . The method of claim 1 , wherein the verifying of the authorization comprises using a technique that is based on at least one from among a Natural Language Processing (NLP) concept and a Natural Language Understanding (NLU) concept for performing the verifying.

5 . The method of claim 1 , further comprising generating the request for the identity authentication token by mapping information included in the first request to an identity provider protocol via an application programming interface (API) that is used by the identity provider.

6 . The method of claim 5 , wherein the generating of the request for the identity authentication token comprises using a technique that is based on at least one from among a Natural Language Processing (NLP) concept and a Natural Language Understanding (NLU) concept for generating the request for the identity authentication token.

7 . The method of claim 1 , further comprising generating the third request by mapping information included in the authorization of the user to a service provider protocol via an application programming interface (API) that is used by the service provider.

8 . The method of claim 7 , wherein the generating of the third request comprises using a technique that is based on at least one from among a Natural Language Processing (NLP) concept and a Natural Language Understanding (NLU) concept for generating the third request.

9 . The method of claim 7 , wherein the service provider protocol is different from and independent of an identity provider protocol that is associated with the identity provider.

10 . A computing apparatus for authenticating a service, the computing apparatus comprising:
a processor; a memory; and a communication interface coupled to each of the processor and the memory, wherein the processor is configured to:
receive, from a user via the communication interface, a first request for a service, the user including at least one from among a person and an application;
transmit, to an identity provider via the communication interface, a request for an identity authentication token that relates to the user;
receive, from the user via the communication interface, a second request for the service in conjunction with the identity authentication token;
verify, based on the identity authentication token, an authorization of the user to submit the second request for the service;
transmit, to a service provider via the communication interface, a third request for providing the service to the user;
receive, from the service provider via the communication interface, data that is responsive to the third request; and
transmit, to the user via the communication interface, data that is responsive to the second request.

11 . The computing apparatus of claim 10 , wherein the processor is further configured to: after the data that is responsive to the third request is received, filter the data that is responsive to the third request based on the authorization of the user in order to generate the data that is responsive to the second request.

12 . The computing apparatus of claim 10 , wherein the data that is responsive to the second request includes data that is usable by the user for receiving the service.

13 . The computing apparatus of claim 10 , wherein the processor is further configured to use a technique that is based on at least one from among a Natural Language Processing (NLP) concept and a Natural Language Understanding (NLU) concept for performing the verification.

14 . The computing apparatus of claim 10 , wherein the processor is further configured to generate the request for the identity authentication token by mapping information included in the first request to an identity provider protocol via an application programming interface (API) that is used by the identity provider.

15 . The computing apparatus of claim 14 , wherein the processor is further configured to use a technique that is based on at least one from among a Natural Language Processing (NLP) concept and a Natural Language Understanding (NLU) concept for generating the request for the identity authentication token.

16 . The computing apparatus of claim 10 , wherein the processor is further configured to generate the third request by mapping information included in the authorization of the user to a service provider protocol via an application programming interface (API) that is used by the service provider.

17 . The computing apparatus of claim 16 , wherein the processor is further configured to use a technique that is based on at least one from among a Natural Language Processing (NLP) concept and a Natural Language Understanding (NLU) concept for generating the third request.

18 . The computing apparatus of claim 16 , wherein the service provider protocol is different from and independent of an identity provider protocol that is associated with the identity provider.

19 . A non-transitory computer readable storage medium storing instructions for authenticating a service, the storage medium comprising executable code which, when executed by a processor, causes the processor to:
receive, from a user, a first request for a service, the user including at least one from among a person and an application; transmit, to an identity provider, a request for an identity authentication token that relates to the user; receive, from the user, a second request for the service in conjunction with the identity authentication token; verify, based on the identity authentication token, an authorization of the user to submit the second request for the service; transmit, to a service provider, a third request for providing the service to the user; receive, from the service provider, data that is responsive to the third request; and transmit, to the user, data that is responsive to the second request.

20 . The storage medium of claim 19 , wherein when executed by the processor, the executable code further causes the processor to: after th

Assignees

• Jpmorgan Chase Bank Na

Inventors

• Teotia Anuj
• Aubrey David P
• Son Yushin
• Krishnappa Shilpa

Classifications

• H04L63/0884 Primary

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title

• H04L63/0807

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title