International Business Machines Corporation

Craig A Pearson

David Paul Moore

Shane Bradley Weeden

Trevor Scott Norvill

Stephen Burmester

Carsten Hagemann

Leo M M Farrell

Keiran W Robinson

A method allows access to computer resources to authorized native applications on a client device. An authorization server receives, from a native application on a device, an initial authorization grant, a public key of a private/public key pair generated on the device, and an attestation of authenticity of the native application. The authorization server receives, from the native application on the device, a refresh token and a digital signature of the refresh token that is created with the private key. The authorization server recognizes the refresh token only if the refresh token is verified with the public key that has been previously registered. The authorization server validates the digital signature of the refresh token, and transmits a new access token and a new refresh token to the native application on the device, thus allowing the native application on the device to access the computer resource.

Using device-bound credentials for enhanced security of authentication in native applications

A service provider configured to establish a federated identity management with an identity provider, provision a first user account, and retrieve revocation information from a ledger. The revocation information can include a revoked user account identifier published to the ledger by the identity provider. The service provider can determine that the revoked user account identifier corresponds to the first user account. The service provider can delete the first user account from the service provider.

Trusted account revocation in federated identity management

An indication is sent to a host server device. The indication includes a request for a push notification service identification (PNSID). The PNSID is used to establish a secure registration between one or more applications on the computing device of a user and the host server device. The PNSID is received from the host server device. An input is received from the user. The input includes one or more application server devices that may send push notifications to the computing device. A unique key is generated for each application server device. The PNSID and a different unique key are sent to each application server device. Each different unique key is associated with a different application server device. A registration is received from each application server device.

Push notifications from multiple tenant servers

A context-aware biometric access control policy is provided. A request to access a protected resource received from a client device is identified. A resource hierarchy associates each of a plurality of protected resources with one or more respective confidence levels of authentication. A confidence level that is associated with the protected resource is identified based on the resource hierarchy. Instructions to capture a biometric token via the client device are generated based on a set of one or more confidence level parameters that is associated with the identified confidence level. The generated instructions are sent to the client device. A biometric token received from the client device is determined to authenticate the user of the client device and, in response, the request to access the protected resource is approved.

Context-aware biometric access control policies

A method sends a request for a delegated authorization grant data set, receives a delegated authorization grant data set that defines the delegated authorization grant scope, with respect to a resource. The delegated authorization grant data set includes a scope variable value having been selected by a delegator entity through a delegation grant scope user interface on the delegator device. The scope controls access to the resource in a manner limited by the scope of the delegated authorization grant defined by the delegated authorization grant data set.

User managed access scope specific obligation policy for authorization

A host organization system for a host organization of a physical site, receives a request, by a visitor with an identifier of a visitor organization for a visitor access medium, for access to the physical site controlled by a physical access control system requiring presentation of the visitor access medium for access to the physical site, wherein there is an electronic trust relationship between the host organization system and a visitor organization system for the visitor organization via a network, wherein the visitor organization system maintains an electronic identity profile for the visitor. Responsive to the host organization system receiving an authenticated identifier for the visitor from the visitor organization system and validating the authenticated identifier from the visitor organization system, issuing a visitor access medium to the visitor for controlling access to the physical site.

Growing community of inventors

Varsity Lakes, Australia

Craig A Pearson