International Business Machines Corporation

Shane Bradley Weeden

Simon Gilbert Canning

David Paul Moore

Leo M M Farrell

Patrick Ryan Wardrop

Simon Gee

Craig A Pearson

Stephen Viselli

Christopher John Hockings

Trevor Scott Norvill

Jasmine Anne Smith

Philip A Nye

Asha Shivalingaiah

Benjamin M E Martin

Heather Maria Hinton

Ivan Matthew Milman

Neil Ian Readshaw

Scott Anthony Exton

Codur Sreedhar Pranam

Carsten Hagemann

John William Court

Leo Michael Farrell

Venkat Raghavan

Jared R Page

Davin J Holmes

Pranam C Sreedhar

A method allows access to computer resources to authorized native applications on a client device. An authorization server receives, from a native application on a device, an initial authorization grant, a public key of a private/public key pair generated on the device, and an attestation of authenticity of the native application. The authorization server receives, from the native application on the device, a refresh token and a digital signature of the refresh token that is created with the private key. The authorization server recognizes the refresh token only if the refresh token is verified with the public key that has been previously registered. The authorization server validates the digital signature of the refresh token, and transmits a new access token and a new refresh token to the native application on the device, thus allowing the native application on the device to access the computer resource.

Using device-bound credentials for enhanced security of authentication in native applications

An indication is sent to a host server device. The indication includes a request for a push notification service identification (PNSID). The PNSID is used to establish a secure registration between one or more applications on the computing device of a user and the host server device. The PNSID is received from the host server device. An input is received from the user. The input includes one or more application server devices that may send push notifications to the computing device. A unique key is generated for each application server device. The PNSID and a different unique key are sent to each application server device. Each different unique key is associated with a different application server device. A registration is received from each application server device.

Push notifications from multiple tenant servers

A method, system and computer-usable medium for web application aware rate-limiting. One embodiment of the system involves a computer-implemented method in which requests for a web application are receive from a plurality of client entities. When the received requests are to be rate-limited, a rate-limiting identifier is requested from a plug-in respectively associated with the web application. The plug-in generates the rate-limiting identifier, wherein the rate-limiting identifier is unique to the web application. The plug and sends the rate-limiting identifier to the rate-limiting engine, which uses the rate-limiting identifier to rate-limit passing of the received requests to the web application. In some embodiments, the rate-limiting identifier is generated as a hash value that is independent of IP address and header information data of the client making the request.

System for application aware rate-limiting using plug-in

Aspects of the present disclosure relate to techniques for managing transactions, including receiving a first transaction request directed to an account of a first web application. Additionally, initiating, by a rate-limiting engine, a rate-limiting process in response to the first transaction request. The techniques further include obtaining a rate-limiting identifier, where the rate limiting identifier uniquely identifies the first web application, and where the rate-limiting identifier identifies an account owner. The techniques further include determining an alternate notification method exists for the account owner and sending a verification request to the account owner, where the verification request is sent using the alternate notification method. The techniques further include receiving a response to the verification request, performing a risk assessment, and adjusting a first security parameter in response to the risk assessment.

Transaction authentication and risk analysis

A technique to enforce mobile device security policy is based on a 'risk profile' of the individual device, where the risk profile is fine-grained and based on the types of applications installed on the device, the services they are accessing, and the operation(s) the user granted the device authorization to perform. Thus, the approach takes into account not only the actual applications installed on the device (and those actively in use), but also the services those applications are accessing, and the scope of operations the user has granted the device authorization to perform. By combining this information to create the risk profile, a suitable security policy, including one that does not unnecessarily degrade device usability, may then be applied.

Mobile device security policy based on authorized scopes

A credential associated with a username is received from a user. The credential is verified. A key identification and a first one-time password are received from a hardware token device. In response to validating the first one-time password, the username is linked to the key identification. A first access token and a first refresh token are generated. The first access token and the first refresh token are sent to the user.

Second factor authorization via a hardware token device

A biometric server receives, a transmission of a biometric sample and an encrypted enrollment template of the user from a client device, wherein the encrypted enrollment template comprises an encrypted mathematical representation of historical biometric data of the user, and wherein the biometric sample comprises a current snapshot of the biometric data. The biometric server decrypts the encrypted enrollment template to an enrollment template using an enrollment template key. The biometric server converts the biometric sample to a biometric template. The biometric server, based on determining that the biometric template is similar to the enrollment template associated with the user, sends an access token to the client device.

Distributed storage of authentication data

A computer receives a request for protected user data with an access token presented by a client as authorization for the client to access the protected user data in a delegated environment. The computer parses the request to create a device fingerprint identifying the device submitting the request for the client. The computer compares the device fingerprint of the request to a previously stored device fingerprint of an authorized device associated with the access token. The computer automatically determines whether to identify the access token as potentially misappropriated based on the comparison of the device fingerprint of the request to the previously stored device fingerprint.

Identifying and destroying potentially misappropriated access tokens

A confidence-based authentication discovery scheme is implemented at a proxy. The scheme assumes that some level of unauthenticated browsing is allowed prior to enforcing authentication at the proxy. Once a known and trusted set of identity providers has been accessed and the user is required to authenticate at the proxy (e.g., as a result of policy), the proxy initiates Federated Single Sign-On (F-SSO) to one or more (or, preferably, all) known sites accessed by the browser. This F-SSO operation is performed seamlessly, preferably without the user's knowledge (after the user allows an initial trust decision between the proxy acting as a service provider and the external identity provider). The proxy collates the results and, based on the trust it has with those sites, produces a confidence score. That score is then used as input into policy around whether or not a user should be permitted to access a particular site.

Confidence-based authentication discovery for an outbound proxy

An aspect of recovery from rolling security token loss includes storing, in a memory device accessible by a server computer, a token pair (B) transmitted to a client device. The token pair (B) includes an access token (a) and a refresh token (r) and is generated as part of a refresh operation. An aspect also includes storing, in the memory device, a refresh token (r) that was generated by the server computer before generation of the token pair B. The refresh token (r) and the refresh token (r) are each tagged as a valid refresh token. An aspect further includes receiving, at the server computer, a request to access a network resource that includes the access token (a), invalidating the refresh token (r), and providing the client device with access to the network resource.

Recovery from rolling security token loss

A computer implemented method, a computer program product, and a data processing system manage a set of federated log-in authentications at secure web sites. A client logs into a security context using a first alias from a list of existing federated single sign-on authentication aliases associated with an account. Responsive to logging into the security context, the client can receive the list of existing federated single sign-on authentication aliases. The client can then manage the list of authentication aliases.

User management of authentication tokens

A technique for intelligent automated consent is described by which a client may be automatically authorized to access a resource owner's protected information (e.g., a profile) based on the owner's previous authorization decisions and/or other client classifications. Using this approach to granting consent, the resource owner is not required to intervene during the authorization step for each client that is requesting access. Clients may be categorized, and authorization given to individual clients based on the category to which they belong and/or the scope of the access request. The technique may be implemented with user-centric identity protocols, as well as with delegated authorization protocols. The technique provides for policy-based consent grants.

Growing community of inventors

Paradise Point, Australia

Shane Bradley Weeden