# US 12,015,607 B2 · System and method for authenticating client devices communicating with an enterprise system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,015,607 B2
- Document ID: US12015607B2
- Status: Granted
- Kind: B2
- Application number: 17/401,602
- Filed: 2021-08-13
- Published: 2023-02-16
- Granted: 2024-06-18
- Earliest claimed: 2021-08-13
- Assignees: The Toronto-Dominion Bank
- Applicants: The Toronto-Dominion Bank
- Inventors: Christian Joseph Bouffard; Saeed Alhajyousef
- Web page: https://patentgrep.com/patent/US12015607B2

## CPC

- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- G06F 21/554: {involving event detection and direct action}
- H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)}
- H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)}
- H04L 63/102: {Entity profiles}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A system and method are provided for authenticating client devices communicating with an enterprise system. The method includes providing a policy enforcement interceptor to intercept API calls and enabling the policy enforcement interceptor to communicate with a policy information point to query the at least one endpoint for entitlements associated with an account. The method also includes intercepting an API call to the application API, communicating with the policy information point to determine entitlements associated with the account by having the policy information point query an entitlements database and, when the entitlements returned to the policy enforcement interceptor are valid, invoking a policy decision point to validate the client device. The method also includes, when the client device is validated, permitting invocation of the API. The method also includes providing an API response to the client device to permit access to the application via the API.

## Claims

### Claim 1

A server device for authenticating client devices communicating with an enterprise system, the server device comprising:
a processor;
a communications module coupled to the processor; and
a memory coupled to the processor, the memory storing computer executable instructions that when executed by the processor cause the processor to:
provide a policy enforcement interceptor to intercept application programming interface (API) calls to an API used to access an application by a client device;
enable the policy enforcement interceptor to communicate with a policy information point connected to at least one endpoint in the enterprise system to query the at least one endpoint for entitlements associated with an account;
intercept, by the policy enforcement interceptor, an API call to the application API comprising an operation for payload elements and account information;
communicate, by the policy enforcement interceptor and via an encrypted channel, with the policy information point to request entitlements associated with the account information;
query, by the policy information point, via the encrypted channel, an entitlements database in the enterprise system to receive the requested entitlements;
communicate, from the policy information point to the policy enforcement interceptor, via the encrypted channel, the received entitlements associated with the account information;
determine, with the policy enforcement interceptor, whether the received entitlements have been altered;
in response to determining the received entitlements are valid, invoke a policy decision point;
validate, with the policy decision point, the client device, that the account has access privileges that permit the requested operation, and that the account has authority to operate against the payload elements;
when the client device is validated, permit invocation of the API; and
provide an API response to the client device to permit access to the application via the API.

### Claim 2 (depends on 1)

The server device of claim 1, wherein the policy enforcement interceptor, the policy information point, and the policy decision point are each provided as modules in a plurality of APIs used to access corresponding ones of a plurality of applications accessible to the client device.

### Claim 3 (depends on 2)

The server device of claim 2, wherein the policy information point is deployed using a software development kit (SDK).

### Claim 4 (depends on 1)

The server device of claim 1, wherein the policy information point is provided as a separate service from the API used to access the application.

### Claim 5 (depends on 4)

The server device of claim 4, wherein the policy information point is configured to serve a plurality of APIs used to access corresponding ones of a plurality of applications accessible to the client device.

### Claim 6 (depends on 1)

The server device of claim 1, wherein communications to and from the policy enforcement interceptor, the policy information point, and the policy decision point are secured by an encrypted communications channel and authorization security token.

### Claim 7 (depends on 1)

The server device of claim 1, wherein the computer executable instructions further cause the processor to:
update the entitlements database.

### Claim 8 (depends on 1)

The server device of claim 1, wherein the policy enforcement interceptor communicates with an API controller for the application to obtain the appropriate API response based on the API call.

### Claim 9 (depends on 1)

The server device of claim 1, wherein the policy information point utilizes a data model that is populated using a set of different views, the set of different views structured to include data elements according to a policy evaluation required.

### Claim 10 (depends on 1)

The server device of claim 1, wherein the entitlements database comprises entitlements for the client device that correspond to a plurality of organizational units.

### Claim 11

A method of authenticating client devices communicating with an enterprise system, the method executed by a server device and comprising:
providing a policy enforcement interceptor to intercept application programming interface (API) calls to an API used to access an application by a client device;
enabling the policy enforcement interceptor to communicate with a policy information point connected to at least one endpoint in the enterprise system to query the at least one endpoint for entitlements associated with an account;
intercepting, by the policy enforcement interceptor, an API call to the application API comprising an operation for payload elements and account information;
communicating, by the policy enforcement interceptor and via an encrypted channel, with the policy information point to request entitlements associated with the account information;
querying, by the policy information point, via the encrypted channel, an entitlements database in the enterprise system to receive the requested entitlements;
communicating, from the policy information point to the policy enforcement interceptor, via the encrypted channel, the received entitlements associated with the account information;
determining, with the policy enforcement interceptor, whether the received entitlements have been altered;
in response to determining the received entitlements are valid, invoking a policy decision point
validating, with the policy decision point, the client device, that the account has access privileges that permit the requested operation, and that the account has authority to operate against the payload elements;
in response to determining the client device is validated, permitting invocation of the API; and
providing an API response to the client device to permit access to the application via the API.

### Claim 12 (depends on 11)

The method of claim 11, wherein the policy enforcement interceptor, the policy information point, and the policy decision point are each provided as modules in a plurality of APIs used to access corresponding ones of a plurality of applications accessible to the client device.

### Claim 13 (depends on 11)

The method of claim 11, wherein the policy information point is provided as a separate service from the API used to access the application.

### Claim 14 (depends on 13)

The method of claim 13, wherein the policy information point is configured to serve a plurality of APIs used to access corresponding ones of a plurality of applications accessible to the client device.

### Claim 15 (depends on 11)

The method of claim 11, wherein communications to and from the policy enforcement interceptor, the policy information point, and the policy decision point are secured by an encrypted communications channel and authorization security token.

### Claim 16 (depends on 11)

The method of claim 11, further comprising:
update the entitlements database.

### Claim 17 (depends on 11)

The method of claim 11, wherein the policy enforcement interceptor communicates with an API controller for the application to obtain the appropriate API response based on the API call.

### Claim 18 (depends on 11)

The method of claim 11, wherein the policy information point utilizes a data model that is populated using a set of different views, the set of different views structured to include data elements according to a policy evaluation required.

### Claim 19 (depends on 11)

The method of claim 11, wherein the entitlements database comprises entitlements for the client device that correspond to a plurality of organizational units.

### Claim 20

A non-transitory computer readable medium for authenticating client devices communicating with an enterprise system, the computer readable medium comprising computer executable instructions for:
providing a policy enforcement interceptor to intercept application programming interface (API) calls to an API used to access an application by a client device;
enabling the policy enforcement interceptor to communicate with a policy information point connected to at least one endpoint in the enterprise system to query the at least one endpoint for entitlements associated with an account;
intercepting, by the policy enforcement interceptor, an API call to the application API comprising an operation for payload elements and account information;
communicating, by the policy enforcement interceptor and via an encrypted channel, with the policy information point to request entitlements associated with the account information;
querying, by the policy information point, via the encrypted channel, an entitlements database in the enterprise system to receive the requested entitlements;
communicating, from the policy information point to the policy enforcement interceptor, via the encrypted channel, the received entitlements associated with the account information;
determining, with the policy enforcement interceptor, whether the received entitlements are valid;
in response to determining the received entitlements are valid, invoking a policy decision point
validating, with the policy decision point, the client device, that the account has access privileges that permit the requested operation, and that the account has authority to operate against the payload elements;
in response to determining the client device is validated, permitting invocation of the API; and
providing an API response to the client device to permit access to the application via the API.