US 11,122,048 B2Granted

User profile access from engaging applications with privacy assurance associated with an API

AssigneeInternational Business Machines Corporation

InventorsBen Z. Akselrod, Gal A. Shachor, Anton Aleksandrov, Moty Drimer, Nitzan Nissim

Life of this patent

Estimating the term…

Loading patent…

Abstract

An approach to secure API access for distinct types of users. A request for access to an API from a user is initiated and followed by sending a request for a login credential to the user based on a type of API requested: Data API or Interaction API. The login credential is received along with the network location of the user. Authenticating the login credential and create an API specific token. Assigning the API specific token to a user activity and granting the user access to the specific API.

Claims17

Dependent claims

A computer implemented method for allowing API access for different types of users to an application, the computer implemented method comprising:

receiving, by one of more processors, a request for access to an API (Application Programming Interface) from a user;
sending, by the one of more processors, a request for a login credential to the user based on a type of API requested;
receiving, by the one of more processors, the login credential from the user;
authenticating, by the one of more processors, the login credential, further comprises:
receiving, by the one of more processors, a network location associated with the user;
receiving, by the one of more processors, the login credential;
validating, by the one of more processors, both the login credential and the network location;
determining, by the one of more processors, whether the received network location of the user is associated with a highly secured network location, wherein the highly secured network location is one of a company VPN (virtual private network) and a company intranet network;
responsive to determining the network location of the user is located on the highly secured network location, the user has access to an admin ACL (access control list) and the login and password is valid, assigning, by the one of more processors, a Data API token to the user, wherein the Data API token further comprises of a first REST (Representation Sate Transfer) API that has been configured to allow the user access only to administrator-related attributes of the application and the Interaction API token further comprises of a second REST API that has been configured to allow the user access to only client-related transactions of the application;
and
responsive to determining the network location of the user is not located on the highly secured network location, the user has access to a client ACL (access control list) and the login and password is valid, assigning, by the one of more processors, an Interaction API token to the user;
and
granting, by the one of more processors, the user access to the API based on the API token.

10 more elements

A computer program product for allowing API access for different types of users to an application, the computer program product comprising:

one or more computer readable storage devices and program instructions stored on the one or more computer readable storage devices, the stored program instructions comprising:
program instructions to receive a request for access to an API (Application Programming Interface) from a user;
program instructions to send a request for a login credential to the user based on a type of API requested;
program instructions to receive the login credential from the user;
program instructions to authenticate the login credential, further comprises:
program instructions to receive a network location associated with the user;
program instructions to receive the login credential;
and
program instructions to validate both the login credential and the network location;
program instructions to determine whether the received network location of the user is associated with a highly secured network location, wherein the highly secured network location is one of a company VPN (virtual private network) and a company intranet network;
responsive to determining the network location of the user is located on the highly secured network location, the user has access rights to an admin ACL (access control list) and the login and password is valid, program instructions to assign a Data API token to the user, wherein the Data API token further comprises of a first REST (Representation Sate Transfer) API that has been configured to allow the user access only to administrator-related attributes of the application and the Interaction API token further comprises of a second REST API that has been configured to allow the user access to only client-related transactions of the application;
and
responsive to determining the network location of the user is not located on the highly secured network location, the user has access rights to a client ACL (access control list) and the login and password is valid, program instructions to assign an Interaction API token to the user;
program instructions to grant the user access to the API based on the API token.

11 more elements

A computer system for allowing API access for different types of users to an application, the computer system comprising:

one or more computer processors;
one or more computer readable storage devices;
program instructions stored on the one or more computer readable storage devices for execution by at least one of the one or more computer processors, the stored program instructions comprising:
program instructions to receive a request for access to an API (Application Programming Interface) from a user;
program instructions to send a request for a login credential to the user based on a type of API requested;
program instructions to receive the login credential from the user;
program instructions to authenticate the login credential, further comprises:
program instructions to receive a network location associated with the user;
program instructions to receive the login credential;
and
program instructions to validate both the login credential and the network location;
program instructions to determine whether the received network location of the user is associated with a highly secured network location, wherein the highly secured network location is one of a company VPN (virtual private network) and a company intranet network;
responsive to determining the network location of the user is located on the highly secured network location, the user has access rights to an admin ACL (access control list) and the login and password is valid, program instructions to assign a Data API token to the user, wherein the Data API token further comprises of a first REST (Representation Sate Transfer) API that has been configured to allow the user access only to administrator-related attributes of the application and the Interaction API token further comprises of a second REST API that has been configured to allow the user access to only client-related transactions of the application;
and
responsive to determining the network location of the user is not located on the highly secured network location, the user has access rights to a client ACL (access control list) and the login and password is valid, program instructions to assign an Interaction API token to the user;
program instructions to grant the user access to the API based on the API token.

13 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/142,397Filed 26 Sep 2018
Published: US 2020/0099691 A126 Mar 2020
Granted: 14 Sep 2021
Term ends: Not estimatedThe source records don’t support an estimate.

Classification9 codes

H04L 63/0807
For authentication of entities: using tickets, e.g. Kerberos
H04L 63/102
For controlling access to devices or network resources: entity profiles
H04L 63/083
For authentication of entities: using passwords
H04L 63/107
For controlling access to devices or network resources: wherein the security policies are location-dependent, e.g. entities privileges depend on…

Family

US 2020/0099691 A1Pre-grant publication · published 26 Mar 2020
US 11,122,048 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key