FIELD OF THE INVENTION

The invention relates to the field of user identification and of performing multifactor authentication to enable authorization to perform services.

BACKGROUND

With the explosion of passwords and the ever increasing threat of online fraud, the need to improve authentication of users and their transactions as well as the usability of relying party applications across multiple sectors (financial institutions, healthcare, retailers, education institutions, government agencies and associated social services, social networks, etc.) is essential to mitigate the occurrence of information security fraud on a global scale. Furthermore, current authentication and authorization schemes provide an all or nothing approach, where the user either has complete control of all the resources provided by the login or none at all.

SUMMARY

Aspects of the embodiments disclosed herein include a method for authorizing a transaction for an entity during an active session, the method comprising: receiving, at a level of assurance (LOA) server, a request from a Relying Party (RP) Services Application for a transaction; determining, at the LOA Server, that the transaction requires a higher level of assurance than a current level of assurance associated with the active session associated with the entity; sending, by the LOA Server, an authorization request for the transaction to an LOA Provider associated with the entity, wherein the authorization request comprises information indicating a higher level of authorization credentials required for elevating the level of assurance of the active session; receiving, at the LOA Server, from the LOA Provider at least one of a plurality of required authorization credentials for elevating the LOA associated with the active session; determining, at the LOA Server, that the at least one of the plurality of authorization credentials received from the LOA Provider are sufficient to elevate the active session to the higher LOA; and sending authorization for servicing of the transaction for the entity to the RP Services Application.

Aspects of the embodiments disclosed herein further include a method comprising: receiving a request for an entity registration of an LOA Provider at an LOA Server, said request for the entity registration including a plurality of attributes and credentials, wherein the attributes are at least a unique identification information associated with an entity and the credentials are at least a unique information associated with the LOA Provider, identifying at the LOA Server the identity of the LOA Provider by performing a plurality of verification steps on the plurality of attributes and credentials; storing verified attributes and verified credentials at the LOA Server with a predetermined time to live value, wherein time to live is a predetermined time that the attributes or verified credentials are valid; performing a refresh to at least some of the verified attributes and the verified credentials based on predetermined policies and on demand from the RP Server; and providing from the LOA Server to the RP Server at least one of a plurality of transaction authorizations for each LOA per session or transactional request.

Aspects of the embodiments disclosed herein further include a method for facilitating an interaction of a Level of Assurance (LOA) Server with a Relying Party (RP) Server in a sequence of transactions with different Levels of Assurance (LOA), said method comprising: enrolling with the LOA Server at least one of a plurality of LOA Provider devices associated with an entity; uniquely identifying each of said entity enrolled LOA Provider devices to the RP Server; receiving at the LOA Server from an entity Client Device authentication of the enrolled LOA Provider devices to approve a secure interaction between the Client Device and the RP Server; authenticating at the LOA Server an entity up to a predetermined LOA using a plurality of contextual factors to be provided on demand from the LOA Provider device and sending real time authorization and authentication to the RP Server; performing selective policy enforcement at the LOA Server on the LOA Provider devices based on criteria received from said entity, a desired LOA, and criteria set by the RP Server; selectively approving or denying interactions at the LOA Server for the RP Server for transactions; and authenticating an entity up to an agreed-upon LOA using a plurality of factors to be provided on demand by the RP Server using the LOA Provider devices and the Client Device that can deliver a plurality of required contextual factors.

Aspects of the embodiments disclosed herein further include a method comprising: authenticating at a Level Of Assurance (LOA) Server from an RP Service Application executing on a Client Device, both the RP Server and an LOA Provider to enable an interaction based on an on-demand LOA desired per transaction; receiving at the LOA Server a request from the Client Device to register the LOA Provider, the request including a first unique identifier; said first unique identifier including at least one of a group consisting of: a unique user identification, a unique identity of the person, an International Mobile Equipment Identity (IMEI), a phone number, and a first secret message; receiving at the LOA Server from the LOA Provider an LOA Provider registration message; and stepping up and down to change the LOA at the LOA Server during the active session.

Aspects of the embodiments disclosed herein include a system for authorizing a transaction for an entity during an active session, the system comprising: a network configured to be communicatively coupled to a network; a processor configured to: receive, at a level of assurance (LOA) server, a request from a Relying Party (RP) Services Application for a transaction; determine, at the LOA Server, that the transaction requires a higher level of assurance than a current level of assurance associated with the active session associated with the entity; send, by the LOA Server, an authorization request for the transaction to an LOA Provider associated with the entity, wherein the authorization request comprises information indicating a higher level of authorization credentials required for elevating the level of assurance of the active session; receive, at the LOA Server, from the LOA Provider at least one of a plurality of required authorization credentials for elevating the LOA associated with the active session; determine, at the LOA Server, that the at least one of the plurality of authorization credentials received from the LOA Provider are sufficient to elevate the active session to the higher LOA; and sending authorization for servicing of the transaction for the entity to the RP Services Application. The authorization may be in real time with the real time period depending on the application.

Aspects of the embodiments disclosed herein further include a system comprising: a network configured to be communicatively coupled to a network; a processor configured to: receive a request for an entity registration of an LOA Provider at an LOA Server, said request for the entity registration including a plurality of attributes and credentials, wherein the attributes are at least a unique identification information associated with an entity and the credentials are at least a unique information associated with the LOA Provider, identify at the LOA Server the identity of the LOA Provider by performing a plurality of verification steps on the plurality of attributes and credentials; store verified attributes and verified credentials at the LOA Server with a predetermined time to live value, wherein time to live is a predetermined time that the attributes or verified credentials are valid; perform a refresh to at least some of the verified attributes and the verified credentials based on predetermined policies and on demand from the RP Server; and provide from the LOA Server to the RP Server at least one of a plurality of transaction authorizations for each LOA per session or transactional request.

Aspects of the embodiments disclosed herein further include a system for facilitating an interaction of a Level of Assurance (LOA) Server with a Relying Party (RP) Server in a sequence of transactions with different Levels of Assurance (LOA), said system comprising: a network configured to be communicatively coupled to a network; a processor configured to: enroll with the LOA Server at least one of a plurality of LOA Provider devices associated with an entity; uniquely identify each of said entity enrolled LOA Provider devices to the RP Server; receive at the LOA Server from an entity Client Device authentication of the enrolled LOA Provider devices to approve a secure interaction between the Client Device and the RP Server; authenticate at the LOA Server an entity up to a predetermined LOA using a plurality of contextual factors to be provided on demand from the LOA Provider device and sending real time authorization and authentication to the RP Server; perform selective policy enforcement at the LOA Server on the LOA Provider devices based on criteria received from said entity, a desired LOA, and criteria set by the RP Server; selective approving or denying interactions at the LOA Server for the RP Server for transactions; and authenticate an entity up to an agreed-upon LOA using a plurality of factors to be provided on demand by the RP Server using the LOA Provider devices and the Client Device that can deliver a plurality of required contextual factors.

Aspects of the embodiments disclosed herein further include a system comprising: a network configured to be communicatively coupled to a network; a processor configured to: authenticate at a Level Of Assurance (LOA) Server from an RP Service Application executing on a Client Device, both the RP Server and an LOA Provider to enable an interaction based on an on-demand LOA desired per transaction; receive at the LOA Server a request from the Client Device to register the LOA Provider, the request including a first unique identifier; said first unique identifier including at least one of a group consisting of: a unique user identification, a unique identity of the person, an International Mobile Equipment Identity (IMEI), a phone number, and a first secret message; receive at the LOA Server from the LOA Provider an LOA Provider registration message; and step up and down to change the LOA at the LOA Server during the active session.

Aspects of the embodiments disclosed herein further include a non-transitory computer readable medium storing a program causing a computer to execute a process for authorizing a transaction for an entity during an active session, the process comprising: receiving, at a level of assurance (LOA) server, a request from a Relying Party (RP) Services Application for a transaction; determining, at the LOA Server, that the transaction requires a higher level of assurance than a current level of assurance associated with the active session associated with the entity; sending, by the LOA Server, an authorization request for the transaction to an LOA Provider associated with the entity, wherein the authorization request comprises information indicating a higher level of authorization credentials required for elevating the level of assurance of the active session; receiving, at the LOA Server, from the LOA Provider at least one of a plurality of required authorization credentials for elevating the LOA associated with the active session; determining, at the LOA Server, that the at least one of the plurality of authorization credentials received from the LOA Provider are sufficient to elevate the active session to the higher LOA; and sending authorization for servicing of the transaction for the entity to the RP Services Application.

Aspects of the embodiments disclosed herein further include a non-transitory computer readable medium storing a program causing a computer to execute a process, the process comprising: receiving a request for an entity registration of an LOA Provider at an LOA Server, said request for the entity registration including a plurality of attributes and credentials, wherein the attributes are at least a unique identification information associated with an entity and the credentials are at least a unique information associated with the LOA Provider, identifying at the LOA Server the identity of the LOA Provider by performing a plurality of verification steps on the plurality of attributes and credentials; storing verified attributes and verified credentials at the LOA Server with a predetermined time to live value, wherein time to live is a predetermined time that the attributes or verified credentials are valid; performing a refresh to at least some of the verified attributes and the verified credentials based on predetermined policies and on demand from the RP Server; and providing from the LOA Server to the RP Server at least one of a plurality of transaction authorizations for each LOA per session or transactional request.

Aspects of the embodiments disclosed herein further include a non-transitory computer readable medium storing a program causing a computer to execute a process for facilitating an interaction of a Level of Assurance (LOA) Server with a Relying Party (RP) Server in a sequence of transactions with different Levels of Assurance (LOA), the process comprising: enrolling with the LOA Server at least one of a plurality of LOA Provider devices associated with an entity; uniquely identifying each of said entity enrolled LOA Provider devices to the RP Server; receiving at the LOA Server from an entity Client Device authentication of the enrolled LOA Provider devices to approve a secure interaction between the Client Device and the RP Server; authenticating at the LOA Server an entity up to a predetermined LOA using a plurality of contextual factors to be provided on demand from the LOA Provider device and sending real time authorization and authentication to the RP Server; performing selective policy enforcement at the LOA Server on the LOA Provider devices based on criteria received from said entity, a desired LOA, and criteria set by the RP Server; selectively approving or denying interactions at the LOA Server for the RP Server for transactions; and authenticating an entity up to an agreed-upon LOA using a plurality of factors to be provided on demand by the RP Server using the LOA Provider devices and the Client Device that can deliver a plurality of required contextual factors.

Aspects of the embodiments disclosed herein further include a non-transitory computer readable medium storing a program causing a computer to execute a process comprising: authenticating at a Level Of Assurance (LOA) Server from an RP Service Application executing on a Client Device, both the RP Server and an LOA Provider to enable an interaction based on an on-demand LOA desired per transaction; receiving at the LOA Server a request from the Client Device to register the LOA Provider, the request including a first unique identifier; said first unique identifier including at least one of a group consisting of: a unique user identification, a unique identity of the person, an International Mobile Equipment Identity (IMEI), a phone number, and a first secret message; receiving at the LOA Server from the LOA Provider an LOA Provider registration message; and stepping up and down to change the LOA at the LOA Server during the active session.

Aspects of the embodiments disclosed herein include a system for authorizing a transaction for an entity during an active session, the system comprising: a means for receiving, at a level of assurance (LOA) server, a request from a Relying Party (RP) Services Application for a transaction; a means for determining, at the LOA Server, that the transaction requires a higher level of assurance than a current level of assurance associated with the active session associated with the entity; a means for sending, by the LOA Server, an authorization request for the transaction to an LOA Provider associated with the entity, wherein the authorization request comprises information indicating a higher level of authorization credentials required for elevating the level of assurance of the active session; a means for receiving, at the LOA Server, from the LOA Provider at least one of a plurality of required authorization credentials for elevating the LOA associated with the active session; a means for determining, at the LOA Server, that the at least one of the plurality of authorization credentials received from the LOA Provider are sufficient to elevate the active session to the higher LOA; and a means for sending authorization for servicing of the transaction for the entity to the RP Services Application.

Aspects of the embodiments disclosed herein further include a system comprising: a means for receiving a request for an entity registration of an LOA Provider at an LOA Server, said request for the entity registration including a plurality of attributes and credentials, wherein the attributes are at least a unique identification information associated with an entity and the credentials are at least a unique information associated with the LOA Provider, a means for identifying at the LOA Server the identity of the LOA Provider by performing a plurality of verification steps on the plurality of attributes and credentials; a means for storing verified attributes and verified credentials at the LOA Server with a predetermined time to live value, wherein time to live is a predetermined time that the attributes or verified credentials are valid; a means for performing a refresh to at least some of the verified attributes and the verified credentials based on predetermined policies and on demand from the RP Server; and a means for providing from the LOA Server to the RP Server at least one of a plurality of transaction authorizations for each LOA per session or transactional request.

Aspects of the embodiments disclosed herein further include a system for facilitating an interaction of a Level of Assurance (LOA) Server with a Relying Party (RP) Server in a sequence of transactions with different Levels of Assurance (LOA), said system comprising: a means for enrolling with the LOA Server at least one of a plurality of LOA Provider devices associated with an entity; a means for uniquely identify each of said entity enrolled LOA Provider devices to the RP Server; receive at the LOA Server from an entity Client Device authentication of the enrolled LOA Provider devices to approve a secure interaction between the Client Device and the RP Server; a means for authenticating at the LOA Server an entity up to a predetermined LOA using a plurality of contextual factors to be provided on demand from the LOA Provider device and sending real time authorization and authentication to the RP Server; a means for performing selective policy enforcement at the LOA Server on the LOA Provider devices based on criteria received from said entity, a desired LOA, and criteria set by the RP Server; a means for selectively approving or denying interactions at the LOA Server for the RP Server for transactions; and a means for authenticating an entity up to an agreed-upon LOA using a plurality of factors to be provided on demand by the RP Server using the LOA Provider devices and the Client Device that can deliver a plurality of required contextual factors.

Aspects of the embodiments disclosed herein further include a system comprising: a means for authenticate at a Level Of Assurance (LOA) Server from an RP Service Application executing on a Client Device, both the RP Server and an LOA Provider to enable an interaction based on an on-demand LOA desired per transaction; a means for receiving at the LOA Server a request from the Client Device to register the LOA Provider, the request including a first unique identifier; said first unique identifier including at least one of a group consisting of: a unique user identification, a unique identity of the person, an International Mobile Equipment Identity (IMEI), a phone number, and a first secret message; a means for receiving at the LOA Server from the LOA Provider an LOA Provider registration message; and a means for stepping up and down to change the LOA at the LOA Server during the active session.

