US 12,771,682 B2Granted

Systems and methods for user authentication using subject identifier and/or subject identifier documents

AssigneeAetna Inc.

InventorsAbbie Barbir, Alan Bachmann, Erick Verry, Paul Ivanivsky, Cisa Kurian, Neal Shah, Michael Streuling

Life of this patent

Estimating the term…

Loading patent…

Abstract

In some instances, a method is provided. The method comprises: based on a content request for content from a user device associated with a user, generating a subject identifier for the user, wherein the subject identifier comprises a plurality of elements, wherein at least one of the plurality of elements comprises a subject identifier fragment indicating a unique identifier string for the user; based on generating the subject identifier for the user, providing, to the user device, a request to enroll in secure pass key (SPK) authentication; based on receiving user input indicating approval to enroll in the SPK authentication, generating a SPK for the user based on the subject identifier fragment from the subject identifier; and providing the SPK to the user device, wherein the user device accesses the requested content based on using the SPK.

Claims20

Dependent claims

A system, comprising:

a back-end application system;
an identity broker system;
and
a password manager system,
wherein the back-end application system is associated with a domain and is configured to:
receive a content request for accessing content on the domain from a first user device associated with a user;
and
based on the content request, provide an identification request to the identity broker system,
wherein the identity broker system is configured to:
based on receiving the identification request, determine whether the user is enrolled in subject identifier authentication;
based on determining that the user is not enrolled in the subject identifier authentication, generate a subject identifier for the user, wherein the subject identifier comprises a plurality of elements, wherein at least one of the plurality of elements comprises a subject identifier fragment, wherein the subject identifier fragment indicates a unique identifier string for the user;
based on generating the subject identifier for the user, provide, to the first user device, a request to enroll in secure pass key (SPK) authentication;
based on receiving user input from the first user device indicating approval to enroll in the SPK authentication, generate a SPK for the user based on the subject identifier fragment from the subject identifier;
and
provide the SPK to the first user device and to the password manager system,
wherein the password manager system is configured to:
store the SPK received from the identity broker system;
receive the SPK from the first user device;
and
grant access to the first user device to content on the domain based on comparing the stored SPK with the received SPK, and
wherein the identity broker system is further configured to:
receive a second identification request associated with a second content request for accessing the content on the domain;
in response to receiving the second identification request, determine whether the user is enrolled in the subject identifier authentication by performing identity verification;
and
based on determining that the user is enrolled in the subject identifier authentication by performing the identity verification, determine whether a second user device used for the second content request is enrolled in device verification, and wherein the user is granted access to the content on the domain based on whether the second user device is enrolled in the device verification.

22 more elements

A method, comprising:

based on a content request for content from a user device associated with a user and a determination that the user is not enrolled in subject identifier authentication, generating a subject identifier for the user, wherein the subject identifier comprises a plurality of elements, wherein at least one of the plurality of elements comprises a subject identifier fragment indicating a unique identifier string for the user, wherein the content request is associated with a first identification request;
based on receiving a second identification request from a back-end application system, determine whether the user is enrolled in the subject identifier authentication based on performing identity verification;
based on generating the subject identifier for the user and the second identification request, providing, to the user device, a request to enroll in secure pass key (SPK) authentication;
based on receiving user input indicating approval to enroll in the SPK authentication, generating a SPK for the user based on the subject identifier fragment from the subject identifier;
and
providing the SPK to the user device, wherein the user device accesses the requested content based on using the SPK.

3 more elements

A non-transitory computer-readable medium having processor-executable instructions stored thereon, wherein the processor-executable instructions, when executed, facilitate:

based on a content request for content from a user device associated with a user, generating a subject identifier for the user, wherein the subject identifier comprises a plurality of elements, wherein at least one of the plurality of elements comprises a subject identifier fragment indicating a unique identifier string for the user;
generating a subject identifier document associated with the subject identifier, wherein the subject identifier resolves to a storage location for the subject identifier document;
generating a public and private key pair for the user, wherein a public key of the public and private key pair is included within the subject identifier document;
based on generating the subject identifier for the user, providing, to the user device, a request to enroll in secure pass key (SPK) authentication;
based on receiving user input indicating approval to enroll in the SPK authentication, generating a SPK for the user based on the subject identifier fragment from the subject identifier and a pseudorandom function family (PRF) code based on the public key from the subject identifier document;
and
providing the SPK to the user device, wherein the user device accesses the requested content based on using the SPK and the PRF code.

4 more elements

Dependencies are inferred from the claim text.