# US 10,873,583 B2 · Extensible framework for authentication

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,873,583 B2
- Document ID: US10873583B2
- Status: Granted
- Kind: B2
- Application number: 15/866,130
- Filed: 2018-01-09
- Published: 2019-03-21
- Granted: 2020-12-22
- Earliest claimed: 2017-09-20
- Assignees: Microsoft Technology Licensing, LLC
- Applicants: Microsoft Technology Licensing, LLC
- Inventors: Alexander T. Weinert; Caleb G. Baker; Pui-Yin Winfred Wong; Carlos Adrian Lopez Castro; Yordan I. Rouskov; Laurentiu B. Cristofor; Michael V. McLaughlin
- Web page: https://patentgrep.com/patent/US10873583B2

## CPC

- H04L 63/102: {Entity profiles}
- G06F 21/31: User authentication
- G06F 21/32: using biometric data, e.g. fingerprints, iris scans or voiceprints
- G06F 21/34: involving the use of external additional devices, e.g. dongles or smart cards
- G06F 21/40: by quorum, i.e. whereby two or more security principals are required
- G06Q 10/10: Office automation; Time management
- G06Q 20/32: using wireless devices
- G06Q 20/3226: {Use of secure elements separate from M-devices}
- G06Q 20/40: Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q 20/40145: {Biometric identity checks}
- G06Q 50/18: Legal services
- H04L 9/3215: {using a plurality of channels (network architectures or network communication protocols using different networks H04L63/18)}
- H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)}
- H04L 9/3231: {Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861)}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)}
- H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)}
- H04W 12/06: Authentication
- G06Q 40/08: Insurance
- H04L 2463/082: applying multi-factor authentication
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Methods, systems, and apparatuses in a computing device enable user access to a resource. The method includes receiving, from a user, a request for access to a resource; accessing an authentication flow for granting access to the resource; obtaining first claims for a user from a first claims provider in the authentication flow; determining a second claims provider in the authentication flow, the second claims provider having a trust relationship with the claims facilitator; directing the user to the second claims provider; receiving second claims for the user from the second claims provider; and enabling the user to access the resource in response to at least the received first and second claims.

## Claims

### Claim 1

A claims facilitator implemented in a computing device and configured to enable access to a resource, the claims facilitator comprising:
an authentication flow manager configured to:
receive, from an administration user interface, an authentication flow that comprises a selection and ordering of a first claims provider and a second claims provider by which authentication should be performed to access the resource;
receive, from a user, a request for access to the resource;
access the authentication flow for granting access to the resource;
obtain first claims for the user from the first claims provider in the authentication flow,
determine the second claims provider in the authentication flow, the second claims provider having a trust relationship with the claims facilitator,
direct the user to a uniform resource locator (URL) of the second claims provider to complete an authentication procedure requested by the second claims provider, and
receive second claims for the user from the second claims provider; and
a resource access controller configured to enable the user to access the resource in response to at least the first and second claims.

### Claim 2 (depends on 1)

The claims facilitator of claim 1, wherein the first claims provider is implemented in the computing device and is configured to perform a procedure to generate the first claims.

### Claim 3 (depends on 1)

The claims facilitator of claim 1, wherein, to obtain the first claims, the authentication flow manager is configured to:
determine the first claims provider in the authentication flow, the first claims provider external to the computing device and having a trust relationship with the claims facilitator;
direct the user to the first claims provider; and
receive the first claims from the first claims provider.

### Claim 4 (depends on 1)

The claims facilitator of claim 1, wherein:
the authentication flow manager is further configured to:
determine at least one additional claims provider in the authentication flow, the at least one additional claims provider having a trust relationship with the claims facilitator;
direct the user to the at least one additional claims provider; and
receive from the at least one additional claims provider additional claims corresponding to the at least one additional claims provider; and
the resource access controller is further configured to:
enable the user to access the resource in response to the received first claims, the second claims, and the additional claims corresponding to the at least one additional claims provider.

### Claim 5 (depends on 1)

The claims facilitator of claim 1, wherein the claims facilitator further comprises:
a trust relationship manager configured to:
prior to receiving the request for access to the resource, establish a trust relationship with at least the second claims provider; and
store for the second claims provider:
an identifier for the second claims provider;
an address for accessing the second claims provider;
one or more controls that enable one or more claims to be requested from the second claims provider; and
expected values for the one or more claims.

### Claim 6 (depends on 5)

The claims facilitator of claim 5, wherein the resource access controller is configured to compare the first claims to stored expected values for the first claims, and to compare the received second claims to the stored expected values for the second claims, to determine whether to enable the user to access the resource.

### Claim 7 (depends on 1)

The claims facilitator of claim 1, wherein the authentication flow manager is further configured to:
receive the authentication flow defined by an administrator.

### Claim 8

A method performed by a computing device, comprising:
receiving, from an administration user interface, an authentication flow that comprises a selection and ordering of a first claims provider and a second claims provider by which authentication should be performed to access the resource;
receiving, from a user, a request for access to the resource;
accessing the authentication flow for granting access to the resource;
obtaining first claims for the user from the first claims provider in the authentication flow;
determining the second claims provider in the authentication flow, the second claims provider having a trust relationship with a claims facilitator;
directing the user to a uniform resource locator (URL) of the second claims provider;
receiving second claims for the user from the second claims provider to complete an authentication procedure requested by the second claims provider; and
enabling the user to access the resource in response to at least the received first and second claims.

### Claim 9 (depends on 8)

The method of claim 8, wherein the first claims provider is implemented in the computing device, and said obtaining first claims for the user from the first claims provider in the authentication flow comprises:
performing a procedure in the first claims provider to generate the first claims.

### Claim 10 (depends on 8)

The method of claim 8, wherein said obtaining first claims for the user from the first claims provider in the authentication flow comprises:
determining the first claims provider in the authentication flow, the first claims provider external to the computing device and having a trust relationship with the claims facilitator;
directing the user to the first claims provider; and
receiving the first claims from the first claims provider.

### Claim 11 (depends on 8)

The method of claim 8, further comprising:
determining at least one additional claims provider in the authentication flow, the at least one additional claims provider having a respective trust relationship with the claims facilitator;
directing the user to the at least one additional claims provider; and
receiving from the at least one additional claims provider additional claims corresponding to the at least one additional claims provider; and
wherein said enabling the user to access the resource in response to at least the received first and second claims comprises:
enabling the user to access the resource in response to the received first claims, the second claims, and the additional claims corresponding to the at least one additional claims provider.

### Claim 12 (depends on 8)

The method of claim 8, further comprising:
prior to receiving the request for access to the resource, establishing a respective trust relationship with at least the second claims provider; and
storing for the second claims provider:
an identifier for the second claims provider;
an address for accessing the second claims provider;
one or more controls that enable one or more claims to be requested from the second claims provider; and
expected values for the one or more claims.

### Claim 13 (depends on 12)

The method of claim 12, wherein said enabling the user to access the resource in response to at least the received first and second claims comprises:
first comparing the first claims to stored expected values for the first claims;
second comparing the received second claims to the stored expected values for the second claims; and
determining whether to enable the user to access the resource based on results of said first comparing and said second comparing.

### Claim 14 (depends on 8)

The method of claim 8, further comprising:
enabling an administrator to define the authentication flow.

### Claim 15

A computer-readable medium having computer program logic recorded thereon that when executed by at least one processor causes the at least one processor to perform a method, the method comprising:
receiving, from an administration user interface, an authentication flow that comprises a selection and ordering of a first claims provider and a second claims provider by which authentication should be performed to access the resource;
receiving, from a user, a request for access to the resource;
accessing the authentication flow for granting access to the resource;
obtaining first claims for the user from the first claims provider in the authentication flow;
determining the second claims provider in the authentication flow, the second claims provider having a trust relationship with a claims facilitator;
directing the user to a uniform resource locator (URL) of the second claims provider to complete an authentication procedure requested by the second claims provider;
receiving second claims for the user from the second claims provider; and
enabling the user to access the resource in response to at least the received first and second claims.

### Claim 16 (depends on 15)

The computer-readable medium of claim 15, wherein the first claims provider is implemented in the computing device, and said obtaining first claims for the user from the first claims provider in the authentication flow comprises:
performing a procedure in the first claims provider to generate the first claims.

### Claim 17 (depends on 16)

The computer-readable medium of claim 16, wherein said obtaining first claims for the user from the first claims provider in the authentication flow comprises:
determining the first claims provider in the authentication flow, the first claims provider external to the computing device and having a respective trust relationship with the claims facilitator;
directing the user to the first claims provider; and
receiving the first claims from the first claims provider.

### Claim 18 (depends on 15)

The computer-readable medium of claim 15, wherein the method further comprises:
determining at least one additional claims provider in the authentication flow, the at least one additional claims provider having a trust relationship with the claims facilitator;
directing the user to the at least one additional claims provider; and
receiving from the at least one additional claims provider additional claims corresponding to the at least one additional claims provider; and
wherein said enabling the user to access the resource in response to at least the received first and second claims comprises:
enabling the user to access the resource in response to the received first claims, the second claims, and the additional claims corresponding to the at least one additional claims provider.

### Claim 19 (depends on 15)

The computer-readable medium of claim 15, wherein the method further comprises:
prior to receiving the request for access to the resource, establishing a respective trust relationship with at least the second claims provider; and
storing for the second claims provider:
an identifier for the second claims provider;
an address for accessing the second claims provider;
one or more controls that enable one or more claims to be requested from the second claims provider; and
expected values for the one or more claims.

### Claim 20 (depends on 19)

The computer-readable medium of claim 19, said enabling the user to access the resource in response to at least the received first and second claims comprises:
first comparing the generated first claims to stored expected values for the first claims;
second comparing the received second claims to the stored expected values for the second claims; and
determining whether to enable the user to access the resource based on results of said first comparing and said second comparing.