Systems and methods for authenticating an online user using a secure authorization server

Patent metadata

Field	Value
Publication number	US-9800580-B2
Application number	US-201514942575-A
Country	US
Kind code	B2
Filing date	Nov 16, 2015
Priority date	Nov 16, 2015
Publication date	Oct 24, 2017
Grant date	Oct 24, 2017

Abstract

A secure authorization server computer system for verifying an identity of an end-user is provided. The computer system is programmed to receive, from a computing client, an authentication request at an authorization component. The authentication request includes a secure authentication request identifier. The computer system is also programmed to validate the authentication request at the authorization component by validating the secure authentication request identifier. The computer system is further programmed to transmit an authentication response from the authorization component to the computing client. The authentication response includes an authorization code. The authorization code represents a validation of the authentication request.

First claim

What is claimed is:

1. A secure authorization server for verifying an identity of an end-user, said secure authorization server programmed to:
receive, from a computing client, an authentication request at an authorization component, wherein the authentication request includes a secure authentication request identifier and a first redirection uniform resource indicator (URI);
validate the authentication request at the authorization component by at least verifying that the secure authentication request identifier is valid;
generate an authorization code, wherein the authorization code includes at least the secure authentication request identifier;
transmit an authentication response from the authorization component to the computing client, wherein the authentication response includes the authorization code, wherein the authorization code represents a validation of the authentication request;
receive, from the computing client, a token request at a token component, wherein the token request includes the authorization code and a second redirection uniform resource indicator (URI);
validate the token request, at the token component, by matching the first redirection URI and the second redirection URI; and
transmit a token response from the token component to the computing client, wherein the token response includes an identification token associated with an authenticated session, an access token, and a lifetime in seconds of the access token.

2. A secure authorization server in accordance with claim 1 , wherein said secure authorization server is further programmed to:
validate the token request, at the token component, by validating the authorization code.

3. A secure authorization server in accordance with claim 1 , wherein said secure authorization server is further programmed to:
receive, from the computing client, a user information request at a user information component, wherein the user information request includes the access token;
validate the user information request, at the user information component, by validating the access token; and
transmit end-user data from the user information component to the computing client in response to validating the user information request.

4. A secure authorization server in accordance with claim 1 , wherein said secure authorization server is further programmed to transmit the identification token including at least the secure authentication request identifier from the authentication request, algorithm header parameters identifying an algorithm, and a digital certificate with a certificate thumbprint.

5. A secure authorization server in accordance with claim 1 , wherein the identification token is encoded using Base64 encoding and formatted to enable the identification token to be parsed into three strings, wherein each string is configured to be decoded by the computing client during identification token validation.

6. A secure authorization server in accordance with claim 1 , wherein the secure authentication request identifier is based upon at least a scope value, a response type, a computing client identifier, a redirection uniform resource indicator (URI) to which the authentication response will be sent, an opaque value, and a string value that associates a computing client session with an identification token.

7. A secure authorization server in accordance with claim 1 , wherein said secure authorization server is further programmed to transmit the authentication response including at least the secure authentication request identifier from the authentication request, algorithm header parameters identifying an algorithm, and a digital certificate with a certificate thumbprint.

8. A secure authorization server in accordance with claim 1 , wherein the authorization code is encoded using Base64 encoding and formatted to enable the authorization code to be parsed into three strings, wherein each string is configured to be decoded by the computing client during authorization code validation.

9. A method for verifying an identity of an end-user, said method implemented using a secure authorization computing device including at least one processor in communication with a memory, the secure authorization computing device in communication with a computing client, said method comprising:
receiving, from the computing client, an authentication request at an authorization component, wherein the authentication request includes a secure authentication request identifier and a first redirection uniform resource indicator (URI);
validating the authentication request at the authorization component by at least verifying that the secure authentication request identifier is valid;
generating an authorization code, wherein the authorization code includes at least the secure authentication request identifier;
transmitting an authentication response from the authorization component to the computing client, wherein the authentication response includes the authorization code, wherein the authorization code represents a validation of the authentication request;
receiving, from the computing client, a token request at a token component, wherein the token request includes the authorization code and a second redirection uniform resource indicator (URI);
validating the token request, at the token component, by matching the first redirection URI and the second redirection URI; and
transmitting a token response from the token component to the computing client, wherein the token response includes an identification token associated with an authenticated session, an access token, and a lifetime in seconds of the access token.

10. The method in accordance with claim 9 , wherein the secure authorization computing device further includes an authorization component and a token component, said method further comprising:
validating the token request, at the token component, by validating the authorization code.

11. The method in accordance with claim 9 , wherein transmitting a token response further comprises transmitting the token response with the identification token, the identification token including at least the secure authentication request identifier from the authentication request, algorithm header parameters identifying an algorithm, and a digital certificate with a certificate thumbprint.

12. The method in accordance with claim 9 further comprising encoding the identification token using Base64 encoding, and formatting the identification token such that the identification token can be parsed into three strings, wherein each string can be decoded by the computing client during identification token validation.

13. The method in accordance with Claim 9 , wherein the secure authorization computing device further includes an authorization component, a token component, and a user information component, said method further comprising:
receiving, from the computing client, a user information request at the user information component, wherein the user information request includes the access token;
validating the user information request, at the user information component, by validating the access token; and
transmitting end-user data from the user information component to the computing client in response to validating the user information request.

14. The method in accordance with claim 9 , wherein the secure authentication request identifier is based upon at least a scope value, a response type, a computing client identifier, a redirection uniform resource indicator (URI) to which the authentication response will be sent, an opaque value, and a string value that associates a computing client session with an

Assignees

• Mastercard International Inc

Inventors

• Zhang Jenny Qian
• Alger Eric G
• Bucher Steven Patrick

Classifications

• H04L63/0884 Primary

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L63/0807 Primary

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• C06C7/00

  Non-electric detonators; Blasting caps; Primers · CPC title

• C06B25/04

  the nitrated compound being an aromatic · CPC title