# US 10,484,375 B2 · Systems and methods for authenticating an online user using a secure authorization server > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,484,375 B2 - Document ID: US10484375B2 - Status: Granted - Kind: B2 - Application number: 15/997,510 - Filed: 2018-06-04 - Published: 2018-10-04 - Granted: 2019-11-19 - Earliest claimed: 2015-11-16 - Assignees: Mastercard International Incorporated - Applicants: Mastercard International Incorporated - Inventors: Jenny Qian Zhang; Eric G. Alger; Steven Patrick Bucher - Web page: https://patentgrep.com/patent/US10484375B2 ## CPC - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04L 63/0892: {by using authentication-authorization-accounting [AAA] servers or protocols} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L 63/10: {for controlling access to devices or network resources} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A secure authorization server computer system for verifying an identity of an end-user is provided. The computer system is programmed to receive, from a computing client, an authentication request at an authorization component. The authentication request includes a secure authentication request identifier. The computer system is also programmed to validate the authentication request at the authorization component by validating the secure authentication request identifier. The computer system is further programmed to transmit an authentication response from the authorization component to the computing client. The authentication response includes an authorization code. The authorization code represents a validation of the authentication request. ## Claims ### Claim 1 A secure authorization server for verifying an identity of an end user, said secure authorization server comprising at least one processor in communication with at least one memory, said secure authorization server programmed to: receive, from a computing client, an authentication request including a first redirection uniform resource indicator (URI); transmit, to the end user in response to the authentication request, a login credential request; receive, from the end user in response to the login credential request, end user login credentials; transmit, in response to authenticating the end user login credentials, an authentication response to the computing client via the first redirection URI, wherein the authentication response includes an authorization code; receive, from the computing client, a token request, wherein the token request includes the authorization code and a second redirection URI; and transmit, in response to validating the authorization code and determining that the second redirection URI matches the first redirection URI, a token response to the computing client via the first redirection URI, wherein the token response includes an access token having a lifetime. ### Claim 2 (depends on 1) The secure authorization server in accordance with claim 1, wherein said secure authorization server is further programmed to: receive, from the computing client, a user information request that includes the access token from the token response; and transmit end-user data to the computing client via the first redirection URI in response to a validation of the access token. ### Claim 3 (depends on 1) The secure authorization server in accordance with claim 1, wherein the authentication request includes a secure authentication request identifier, and wherein said secure authorization server is further programmed to validate the authentication request by at least verifying that the secure authentication request identifier is valid. ### Claim 4 (depends on 3) The secure authorization server in accordance with claim 3, wherein said secure authorization server is further programmed to include at least the secure authentication request identifier in the authorization code. ### Claim 5 (depends on 3) The secure authorization server in accordance with claim 3, wherein said secure authorization server is further programmed to include in the token response an identification token including at least the secure authentication request identifier from the authentication request. ### Claim 6 (depends on 1) The secure authorization server in accordance with claim 1, wherein said secure authorization server is further programmed to include in the token response the lifetime of the access token. ### Claim 7 (depends on 1) The secure authorization server in accordance with claim 1, wherein the token response is a second token response, and wherein said secure authorization server is further programmed to transmit, in response to validating the authorization code and determining that the second redirection URI matches the first redirection URI, a first token response to the computing client via the first redirection URI, the first token response including a refresh token usable by the computing client to obtain the access token from said secure authorization server in the second token response. ### Claim 8 A method for verifying an identity of an end user, said method implemented using a secure authorization computing device including at least one processor in communication with a memory, the secure authorization computing device in communication with a computing client, said method comprising: receiving, from the computing client, an authentication request including a first redirection uniform resource indicator (URI); transmitting, to the end user in response to the authentication request, a login credential request; receiving, from the end user in response to the login credential request, end user login credentials; transmitting, in response to authenticating the end user login credentials, an authentication response to the computing client via the first redirection URI, wherein the authentication response includes an authorization code; receiving, from the computing client, a token request, wherein the token request includes the authorization code and a second redirection URI; transmitting, in response to validating the authorization code and determining that the second redirection URI matches the first redirection URI, a token response to the computing client via the first redirection URI, wherein the token response includes an access token having a lifetime. ### Claim 9 (depends on 8) The method in accordance with claim 8, further comprising; receiving, from the computing client, a user information request that includes the access token from the token response; and transmitting end-user data to the computing client in response to a validation of the access token. ### Claim 10 (depends on 8) The method in accordance with claim 8, wherein the authentication request includes a secure authentication request identifier, and wherein said method further comprises validating the authentication request by at least verifying that the secure authentication request identifier is valid. ### Claim 11 (depends on 10) The method in accordance with claim 10, wherein said method further comprises including at least the secure authentication request identifier in the authorization code. ### Claim 12 (depends on 10) The method in accordance with claim 10, wherein said method further comprises including in the token response an identification token including at least the secure authentication request identifier from the authentication request. ### Claim 13 (depends on 8) The method in accordance with claim 8, wherein said method further comprises including in the token response the lifetime of the access token. ### Claim 14 (depends on 8) The method in accordance with claim 8, wherein the token response is a second token response, and wherein said method further comprises transmitting, in response to validating the authorization code and determining that the second redirection URI matches the first redirection URI, a first token response to the computing client via the first redirection URI, the first token response including a refresh token usable by the computing client to obtain the access token from said secure authorization server in the second token response. ### Claim 15 A non-transitory computer-readable storage media having computer-executable instructions embodied thereon for verifying an identity of an end user, wherein when executed by at least one processor, the computer-executable instructions cause the processor to: receive, from a computing client, an authentication request including a first redirection uniform resource indicator (URI); transmit, to the end user in response to the authentication request, a login credential request; receive, from the end user in response to the login credential request, end user login credentials; transmit, in response to authenticating the end user login credentials, an authentication response to the computing client via the first redirection URI, wherein the authentication response includes an authorization code; receive, from the computing client, a token request, wherein the token request includes the authorization code and a second redirection URI; transmit, in response to validating the authorization code and determining that the second redirection URI matches the first redirection URI, a token response to the computing client via the first redirection URI, wherein the token response includes an access token having a lifetime. ### Claim 16 (depends on 15) The non-transitory computer-readable storage media of claim 15, wherein the computer-executable instructions further cause the processor to: receive, from the computing client, a user information request that includes the access token from the token response; and transmit end-user data to the computing client in response to a validation of the access token. ### Claim 17 (depends on 15) The non-transitory computer-readable storage media of claim 15, wherein the authentication request includes a secure authentication request identifier, and wherein the computer-executable instructions further cause the processor to validate the authentication request by at least verifying that the secure authentication request identifier is valid. ### Claim 18 (depends on 17) The non-transitory computer-readable storage media of claim 17, wherein the computer-executable instructions further cause the processor to include at least the secure authentication request identifier in the authorization code. ### Claim 19 (depends on 17) The non-transitory computer-readable storage media of claim 17, wherein the computer-executable instructions further cause the processor to include in the token response an identification token including at least the secure authentication request identifier from the authentication request. ### Claim 20 (depends on 15) The non-transitory computer-readable storage media of claim 15, wherein the computer-executable instructions further cause the processor to include in the token response the lifetime of the access token. ### Claim 21 (depends on 15) The non-transitory computer-readable storage media of claim 15, wherein the token response is a second token response, and wherein the computer-executable instructions further cause the processor to transmit, in response to validating the authorization code and determining that the second redirection URI matches the first redirection URI, a first token response to the computing client via the first redirection URI, the first token response including a refresh token usable by the computing client to obtain the access token from said secure authorization server in the second token response.