# US 10,375,054 B2 · Securing user-accessed applications in a distributed computing environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,375,054 B2 - Document ID: US10375054B2 - Status: Granted - Kind: B2 - Application number: 15/584,453 - Filed: 2017-05-02 - Published: 2017-08-17 - Granted: 2019-08-06 - Earliest claimed: 2015-10-06 - Assignees: Netflix, Inc. - Applicants: Netflix, Inc. - Inventors: Raju Uppalapati - Web page: https://patentgrep.com/patent/US10375054B2 ## CPC - H04L 63/0815: {providing single-sign-on or federations} - G06F 16/9574: {of access to content, e.g. by caching} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/101: {Access control lists [ACL]} - H04L 63/105: {Multiple levels of security} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 67/306: User profiles - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Provided herein are systems and methods of controlling access to a web-based application. Such a system may include an access determination server, an authorization control system, and a first web-based application accessible over a network to a first user device of a first user. The processing device of the access determination server receives application request information from the authorization control system, the application request information including an identifier of the first web-based application and an identifier of the first user, determines an access response based on the application request information and access information feed, transmits the access response to the authorization control system, receives an access result from the authorization control system, the access result being based on a response from a second user device to a notification, and stores the access result in an access information feed system. ## Claims ### Claim 1 An application access system comprising: an access determination server having a memory and a processor in communication with one or more additional networked systems; an authorization control system being included in the one or more additional networked systems; and a first web-based application accessible over a network to a first user device of a first user; and wherein the processor of the access determination server: receives application request information from the authorization control system, the application request information including an identifier of the first web-based application and an identifier of the first user, determines an access response based on the application request information and based on an entry in an access information feed, the access information feed comprising a list of attempts by the first user to access the first web-based application, the entry in the access information feed comprising an indication of when a most recent attempt to access the first web-based application was initiated by the first user; determining that the amount of time since the most recent attempt to access the first web-based application is longer than a specified threshold time; based on the determination, transmits the access response to the authorization control system, the access response indicating that, because the first web-based application was not accessed by the first user for longer than the specified threshold time, a notification is to be sent to a second user device of the first user; receives an access result from the authorization control system, the access result being based on a response from the second user device to the notification; and stores the access result in an access information feed system. ### Claim 2 (depends on 1) The application access system of claim 1, wherein the access determination system includes the local store of previous access results. ### Claim 3 (depends on 1) The application access system of claim 1, wherein the access determination system communicates with the remote storage system to access a remote store of previous access results. ### Claim 4 (depends on 1) The application access system of claim 1, wherein the access response is one of: allowing access to the first web-based application; allowing access to the first web-based application when the response from the second user device to the notification is a conforming response; and denying access to the first web-based application. ### Claim 5 (depends on 4) The application access system of claim 4, wherein the conforming response is an affirmative response and is received within a predetermined time. ### Claim 6 (depends on 4) The application access system of claim 4, wherein the authorization control system implements the access response transmitted from the access determination system. ### Claim 7 (depends on 1) The application access system of claim 1, wherein the authorization control system interfaces with a single sign-on service to control access to the first web-based application over the network by the first user device. ### Claim 8 A computer-implemented method of controlling access to a web-based application, the method comprising: receiving resource request information from an authorization control system, the resource request information including an identifier of the web-based application and an identifier of a first user received from a first user device, determining an access response based on the application request information and based on an entry in an access information feed, the access information feed comprising a list of attempts by the first user to access the first web-based application, the entry in the access information feed comprising an indication of when a most recent attempt to access the first web-based application was initiated by the first user; determining that the amount of time since the most recent attempt to access the first web-based application is longer than a specified threshold time; based on the determination, transmitting the access response to the authorization control system, the access response indicating that, because the first web-based application was not accessed by the first user for longer than the specified threshold time, a notification is to be sent to a second user device of the first user; receiving an access result from the authorization control system, the access result being based on a response from the second user device to the notification; and storing the access result in an access information feed system. ### Claim 9 (depends on 8) The method of claim 8, further comprising: receiving an access result from the authorization control system, the access result being based on the response from the second user device to the notification; and storing the access result in an access information feed system. ### Claim 10 (depends on 9) The method of claim 9, wherein storing the access result in the access information feed system comprises storing the access result in the local cache. ### Claim 11 (depends on 10) The method of claim 10, wherein the access information feed system includes the local cache and includes remotely stored access information in a remote storage system. ### Claim 12 (depends on 8) The method of claim 8, further comprising determining that the first user device does not have an authorized session when the resource request information is received from the authorization control system. ### Claim 13 (depends on 8) The method of claim 8, wherein the response from the second user device to the notification is an affirmative response and is received by the authorization control system from the second user device within a predetermined time. ### Claim 14 (depends on 8) The method of claim 8, wherein the resource request information includes an Internet protocol (IP) address associated with the first user device and wherein the access response is further based on the IP address. ### Claim 15 (depends on 8) The method of claim 8, wherein the access information feed comprises a table of access information and collected over a predetermined period. ### Claim 16 (depends on 15) The method of claim 15, wherein the table of access information comprises successful login information associated with the first user for a plurality of web-based applications and times at which the web-based applications were last accessed. ### Claim 17 A computer-implemented method for determining an access response to provide to a first user device requesting access to a first web-based application over a network, the method comprising: receiving an authentication indication from an authentication service, the authentication indication being associated with a request by a first user device to access a protected service, the authentication indication being based on the request and an entry in an access information feed, the entry in the access information feed comprising a previously granted access for the first user device; when the authentication indication indicates successful authentication, requesting an access decision from an access determination service, the access determination service being configured to determine whether the amount of time since a most recent attempt to access the protected service is longer than a specified threshold time; upon determining that the protected service was not accessed by the first user device for longer than the specified threshold time, requesting that a notification system issue a notification to a second user device to perform a second authentication using the second user device; receiving a response to the notification from the second user device; and granting access to the protected service to the first user device. ### Claim 18 (depends on 17) The method of claim 17, wherein the notification is a push notification and wherein a type of the second user device is different than a type of the first user device. ### Claim 19 (depends on 17) The method of claim 17, wherein the authentication service is a third party authentication service requiring a multi-factor interaction for authentication.