T-mobile Usa, Inc.

Michael Engan

Douglas McDorman

James Alexander Latham

Vikash Kodati

Komethagan Subramaniam

Senthil Kumar Mulluppadi Velusamy

Ramkishan Sadasivam

Zoltan Homorodi

Ahmad Arash Obaidi

Shelby Seward

Christopher Harvey Joul

Nilesh Ranjan

Alexandru Catalin Ionescu

Brett Christopher Peppe

Anjani Deepthi Nandigam

Steven S Farsai

Savitha Venkata Rao

Julia Chanelle Buis

Nilay Srivastava

Michael Kary

Jiawen Tu

Brad Smith

Anthony Yiu

Douglas Mcdorman

The system receives an indication of a sensitive operation. The system obtains a unique ID of a user's UE. Based on the unique ID of the UE, the system retrieves a visual authentication method including a visual ID. The system records the visual ID, and retrieves a corresponding stored visual ID. The system performs a liveness check associated with the visual ID, to determine whether the visual ID is a recording or a live version of the visual ID. Upon determining that the visual ID is the recording, the system refuses to authenticate the user. Upon determining that the visual ID is the live version of the visual ID, the system compares the visual ID and the corresponding stored visual ID to determine whether the visual ID and the corresponding stored visual ID match. Upon determining that the visual ID and the corresponding stored visual ID match, the system authenticates the user.

Authenticate a user before performing a sensitive operation associated with a UE in communication with a wireless telecommunication network

Methods and systems for unique session number sharing to ensure traceability are discussed herein. According to an implementation, a user sends a request to login a browser from a user equipment to a server device. The server device validates a user credential associated with the browser by comparing the user credential with pre-stored user registration information. Once the user credential is validated, the server device generates a session with a unique session number (USN) with respect to the request. The server device generates a plurality of logs with respect to the activities occurred during the session and associates the USN with each of the multiple logs. The USN is further included in an access token that authorizes the user to access the websites hosted by the browser.

Methods and systems for implementing unique session number sharing to ensure traceability

The present disclosure describes techniques that improve upon the use of authentication tokens as a means of verifying a user identify. A server is described that receives a service request to access a secure service provided by another service provider. The server may determine whether an additional secure service is required from a third-party server, and if so, generate a recursive authentication token for delivery to the third-party server. The recursive authentication token is intended to authenticate an identity of the server to the third-party server.

Recursive token binding for cascaded service calls

A method of interpreting an authorization token is described herein. The service can receive an authorization token from a client device, and validate a signature of the authorization token. The service can identify an allowed function value associated at least part of an entitlement representation contained in a body of the authorization token. The service can convert the allowed function value to an allowed function bitmask that includes bits at a plurality of bit positions that are set to values indicating whether the subscriber element has attributes associated with each of the plurality of bit positions on a predefined attribute list. The service can determine whether the allowed function bitmask indicates that the subscriber element has one or more qualifying attributes that entitle a user of the client device to access the service.

Authorization token including fine grain entitlements

A server application may request an authentication token from an authentication token provider on behalf of a client application instance. An application instance public key of a client application instance may be received at the server application, in which the application instance public key belongs to an application instance public-private key pair of the client application instance. An authentication token request is generated at the server application, in which the request includes the application instance public key of the client application instance and is signed with a server application private key of a server application public-private key pair that belongs to the server application. The authentication token request is sent by the server application to an authentication token provider to request an authentication token for use by the client application instance.

Authentication token request with referred application instance public key

This disclosure describes techniques that permit a user of a client device to authenticate their identity to a service provider using location-based telemetry data associated with the client device that is captured unobtrusively by a service provider over a predetermined time interval. More specifically, a Location-based identity authentication (LIA) system is described that is configured to develop authentication challenges that are based on the location-based telemetry data, such as location data, transaction data, calendar data, and event data. In one example, a client device may transmit an authentication request that relates to a set of service features available to a user identity. The LIA system may transmit a subset of the authentication challenges to the client device to authenticate the user identity. The LIA system may further receive to the subset of authentication challenges, and further, verify the user identity based at least in part on the number of correct responses.

Location-based identity authentication (LIA) system

A network-accessible service such as a web site may authenticate users through a login process. In order to detect possibly fraudulent login events, the service may implement a framework based on recorded login events. For example, attributes of multiple recorded login events may be analyzed to create a framework that can be applied to attributes of newly received login requests to predict whether the newly received login requests are fraudulent. The framework may comprise criteria, algorithms, rules, models, and/or techniques, and may be constructed using various means such as pattern recognition, machine learning, and/or cluster analysis.

Detecting fraudulent logins

An adaptive greylist may be used to reject authentication requests that originate from a source network address that has been taken over by a malicious actor. A percentage of successful authentications for a predetermined number of authentication requests that last originated from a source network address may be calculated. Accordingly, the source network address may be added to a greylist of suspended network addresses when the percentage of successful authentications is less than a predetermined percentage threshold. On the other hand, the source network address is kept off the greylist of suspended network addresses when the percentage of successful authentications is equal to or greater than the predetermined percentage threshold.

Adaptive malicious network traffic response

The present disclosure describes techniques that improve upon the use of authentication tokens as a means of verifying a user identity. Rather than facilitating the issuance of authentication tokens as bearer tokens, whereby any user may present an authentication token to a secure service provider for access to secure service, this disclosure describes techniques for generating recursive authentication tokens that are digitally signed by an Identity Service Provider (IDP) and the entity that purports to present the authentication token to the service provider. Additionally, a recursive token application is described that is configured to nest preceding authentication tokens that trace back to an initial secure service request. For example, a recursive authentication token received by a second service provider may include, nested therein, the first service provider recursive authentication token and a preceding client recursive authentication token that is associated with the initial secure service request.

A secure device access token allows a server to verify that a device presenting the token for access to the server is an authorized device and that an application presenting the token is an authorized application as it purports to be. The secure device access token is unique to the device and to the application attempting to access the server. The secure device access token differs from a bearer token in that it is unique to the device and to the application.

Secure device access token

Techniques are described for using two tokens to request access to a secure server. The tokens allow the server to verify, without an external call, that the requesting device is one identified in the request and that the requesting device is authorized by a trusted identity provider. A first token is an authentication token issued by the trusted identity provider and including a client device public key. The second token is a proof-of-possession token that is signed by a client device using a client device private key corresponding to the client device public key. The server obtains the client device public key from the authentication token, and then uses the client device public key to validate the proof-of-possession token. The authentication token can be re-used by a server creating its own proof-of-possession token for presentation to a second server to access a secure service on the second server.

Authentication token with client key

An access management account that includes an access identifier may be used to control access to telecommunications services or applications. An access identifier is designated for obtaining access to multiple telecommunications services or applications, in which the multiple telecommunications services or applications are accessible to a user through multiple user accounts that are protected by account credentials. Once the access credential is designated, the access credential may be used to determine whether access to the one or more telecommunications services or applications is to be granted instead of using the account credentials of the multiple user accounts.

Growing community of inventors

Bellevue, WA, United States of America

Michael Engan