# US 2021/0243177 A1 · Cross-domain proof-of-possession > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0243177 A1 - Document ID: US20210243177A1 - Status: Published application - Kind: A1 - Application number: 17/165,516 - Filed: 2021-02-02 - Published: 2021-08-05 - Earliest claimed: 2020-02-03 - Assignees: T-Mobile USA, Inc. - Applicants: T-Mobile USA, Inc. - Inventors: Kendrick BURSON - Web page: https://patentgrep.com/patent/US20210243177A1 ## CPC - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 63/0815: {providing single-sign-on or federations} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04W 12/06: Authentication - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract This disclosure describes techniques for implementing a Single-sign-On Domain-Agnostic Proof-of-Possession (SODA-POP) token (or access token) to solve generation of multiple POPs for authentication of multiple domains that may belong to a single mobile network operator (MNO). The access token may be implemented by a JSON Web Token (JWT) that includes a map of key-value pairs as confirmation claims. The key-value pairs may include multiple domains/sub-domains and their corresponding public keys. These key-value pairs may be registered and added in the confirmation claims to automatically authenticate each one of the domains to access a corresponding service provider. To register a new domain, the new domain redirects a request back to an already registered domain, which updates the access token and then redirects the request back to the new domain. After registration, the updated access token may be used to access services at all registered domains without further reauthentication. ## Claims ### Claim 1 One or more computer-readable storage media collectively storing computer-executable instructions that upon execution cause one or more computers to collectively perform acts comprising: receiving, from a web browser, a first access request associated with a first domain, the first access request associated with an access token, the access token being associated with a map of key-value pairs with each key-value pair corresponding to a domain in a plurality of domains; receiving, from the web browser, a second access request associated with a second domain, the second access request associated with the access token; redirecting the second access request to cause the web browser to request, from the first domain, a registration of the second domain with the access token; adding a new key-value pair corresponding to the second domain to the map of key-value pairs such that the access token is updated for the first domain and the second domain; and granting the second access request based at least in part on the new key-value pair added in the access token. ### Claim 2 (depends on 1) The one or more computer-readable storage media of claim 1, wherein the access token is a JSON Web Token (JWT) with a confirmation claim that includes the map of key-value pairs. ### Claim 3 (depends on 1) The one or more computer-readable storage media of claim 1, wherein the map of key-value pairs include the domains that are authorized to use the access token. ### Claim 4 (depends on 1) The one or more computer-readable storage media of claim 1, wherein a nonce token is used to sign the first access request and the second access request. ### Claim 5 (depends on 4) The one or more computer-readable storage media of claim 4 further comprising: receiving the access token and the nonce token from the first access request; and using a public key from the access token to validate the nonce token. ### Claim 6 (depends on 4) The one or more computer-readable storage media of claim 4, wherein the nonce token is signed using a private key from the web browser. ### Claim 7 (depends on 1) The one or more computer-readable storage media of claim 1, wherein the access token includes an anonymous token or an identification token. ### Claim 8 (depends on 7) The one or more computer-readable storage media of claim 7, wherein the new key-value pair is added to a confirmation claim of the anonymous token. ### Claim 9 (depends on 7) The one or more computer-readable storage media of claim 7, wherein the anonymous token or the identification token are returned in cookies to the web browser. ### Claim 10 A computer system, comprising: one or more servers that, at least: receive from a web browser a first access request associated with a first domain, the first access request associated with an access token, the access token being associated with a map of key-value pairs with each key-value pair corresponding to a domain in a plurality of domains; receive from the web browser a second access request associated with a second domain, the second access request associated with the access token, redirect the second access request to cause the web browser to request, from the first domain, a registration of the second domain with the access token; and grant the second access request based at least in part on the registration of the second domain. ### Claim 11 (depends on 10) The computer system of claim 10, wherein the access token is a JSON Web Token (JWT) with a confirmation claim that includes the map of key-value pairs. ### Claim 12 (depends on 10) The computer system of claim 10, wherein the map of key-value pairs includes the domains that are authorized to use the access token. ### Claim 13 (depends on 10) The computer system of claim 10, wherein the first domain generates a nonce token that is used to sign the first access request. ### Claim 14 (depends on 13) The computer system of claim 13, wherein the one or more servers receive the access token and the nonce token from the first access request and uses a public key from the access token to validate the nonce token. ### Claim 15 (depends on 13) The computer system of claim 13, wherein the nonce token is signed using a private key from the web browser. ### Claim 16 (depends on 10) The computer system of claim 10, wherein the access token includes an anonymous token and an identification token. ### Claim 17 (depends on 16) The computer system of claim 16, wherein a new key-value pair is added to a confirmation claim of the anonymous token and the identification token. ### Claim 18 A computer-implemented method, comprising: receiving a first access request associated with a first domain, the first access request associated with an access token and signed with a nonce token, the access token being associated with a map of key-value pairs with each key-value pair corresponding to a domain in a plurality of domains; receiving a second access request associated with a second domain and signed with the nonce token, the second access request associated with the access token; redirecting the second access request to cause a registration request, from the first domain, for a registration of the second domain with the access token; adding a new key-value pair corresponding to the second domain to the map of key-value pairs such that the access token is updated for the first domain and the second domain; and granting the second access request based at least in part on the new key-value pair added in the access token. ### Claim 19 (depends on 18) The computer-implemented method of claim 18, wherein the access token is a JSON Web Token (JWT) with a confirmation claim that includes the map of key-value pairs. ### Claim 20 (depends on 18) The computer-implemented method of claim 18, wherein the map of key-value pairs includes the domains that are authorized to use the access token.