Intuit, Inc.

Douglas L Foiles

Thomas M Pigoski, Ii

Robert E Lee

Alex G Balazs

Parul Jain

Xiaoyan C Liu-Barker

Nagaraj Janardhana

Shrisha Radhakrishna

Soumendra Daas

James Shaw

Antonio Fuentes

Kishore Jonnalagedda

Timothy E Hobson

Bibhakar Ranjan

Ergang Sun

Cindy X Deng

Kam M Law

Jeremy Luchau

Embodiments presented herein provide a partner authentication (PA) system that coordinates a network-based authorization process for an application. The PA system exchanges a series of messages with the application seeking an access token for a protected resource, an authorization server associated with the resource, and an agent executing on a device accessed by a user who wants the application to access the resource. The PA system and the agent communicate with the authorization server on behalf of the application throughout the authorization process. At the completion of the authorization process, the PA system receives an access token and a refresh token from the server on behalf of the application and sends a partner authorization (PA) token to the application. When the application seeks access to the resource that is available to authorized parties via the resource server, the application sends the PA token to the PA system and receives the access token in return.

Coordinating access authorization across multiple systems at different mutual trust levels

Certain aspects of the present disclosure provide techniques for determining an identity of a user requesting access to a resource. An example technique for determining the identity of the user includes, upon receiving a request for a resource, determining the identity assurance strength of the user. The determination of the identity assurance strength of the user is based on personal identifying information, risk signals, user history, and the like. If the user does not have the requisite identity assurance strength to access a resource, based on policy criteria, an identity proofing operation may be determined for the user to complete in order to access the resource, where the operation is determined based on policy criteria, risk signals, and the like. Upon completion of the identity assurance operation, if the user has adequate identity assurance strength, then the user may access the resource.

Policy based adaptive identity proofing

Embodiments presented herein provide a partner authentication (PA) system that coordinates a network-based authorization process for an application. The PA system exchanges a series of messages with the application seeking an access token for a protected resource, an authorization server associated with the resource, and an agent executing on a device accessed by a user who wants the application to access the resource. The PA system and the agent communicate with the authorization server on behalf of the application throughout the authorization process. The PA system receives an access token and a refresh token from the server on behalf of the application and sends a partner authorization (PA) token to the application. When the application seeks access to the resource that is available to authorized parties via the resource server, the application sends the PA token to the PA system and receives the access token in return.

The disclosed embodiments provide a system that manages access to a computer-based resource. During operation, the system obtains a request for the computer-based resource, wherein the request identifies a user seeking access to the computer-based resource. Next, the system obtains a set of security levels for a set of identity-proofing techniques, wherein the set of security levels is based on a first set of success rates of the identity-proofing techniques in preventing fraudulent access to computer-based resources. The system then calculates an identity assurance level for the user based on the set of security levels and a second set of success rates of the user in completing one or more of the identity-proofing techniques. Upon determining that the identity assurance level of the user meets a minimum identity assurance level for accessing the computer-based resource, the system enables access to the computer-based resource in a response to the request.

Verifying a user's identity based on adaptive identity assurance levels

Disclosed are methods, systems, and articles of manufacture for implementing adaptive levels of authentication assurance according to sensitivity or criticality of information accessed or actions performed in a financial management system to enhance user experience and usability of the financial management system while providing adequate security to safeguard sensitive data. Various flow nodes are associated with one or more levels of assurance which are further associated with some authentication tokens of different authentication strengths. Users are usually first authenticated with a lower authentication strength token. Risk profiles may also be accessed to examine the users' requests for access for fraud detection or prevention purposes. As users attempt to access more sensitive data at a higher level of assurance beyond the authorized level, further authentication with higher authentication strength and involving more user efforts in completing the authentication is required before users are authorized on the higher level of assurance.

Methods, systems, and articles of manufacture for implementing adaptive levels of assurance in a financial management system

One embodiment of the present invention relates to a system that enables a user of an application that runs natively on a client to obtain access to a web resource that is affiliated with the native application. First, the native application obtains an access token from a Central Authentication Service (CAS). Next, the native application sends a secure request for a one-time use session token to the CAS. If the CAS determines the request is valid, the CAS initializes a session token and sends the session token to the native application. After receiving the session token, the native application directs a browser to an endpoint server, appending the session token to the browser's request. Finally, the endpoint server initializes an authenticated session wherein the authenticated session is scoped to the desired web resource.

Transitioning a logged-in state from a native application to any associated web resource

A system that tunes search results is presented. During operation, the system receives content to be searched. The system then iteratively performs the following operations until search results meet specified criteria. The system generates an index of the content based on a set of configuration parameters. Next, the system performs a search against the index to produce the search results. The system then determines whether the search results meet the specified criteria. If the search results do not meet the specified criteria, the system modifies one or more of: the set of configuration parameters; and the content. If the search results meet the specified criteria, the system saves the set of configuration parameters into a configuration file which can be used to generate the index for the content.

Growing community of inventors

San Diego, CA, United States of America

Douglas L Foiles