Patent Application
20240250806
One problem encountered with business organizations is how to enable employees to pay for items that employees need to purchase for their work. One solution conventionally used is to issue a credit card to a manager of the business organization. When an employee that the manager manages needs to make a work-related purchase, the employee request the manger to use the credit card to make the purchase or requests to borrow the credit card to make the purchase. One problem with this approach is that the manger may not be available to provide the credit card when it is used. In addition, some employees may make unapproved purchases when lent the credit card. Another complication is that the billing statement for the credit card does not indicate who made each purchase; rather the statement just contains a list of purchases sorted by date.
Another option is to issue each employee a credit card. One difficulty with this option is that some employees may make purchases without getting managerial approval. Further, some employees may use the credit card for personal purchases. Some employees may also spend too much on items. In addition, some employees may lose their credit cards or increase the risk of credit card fraud by not following proper security precautions.
These problems have become more pronounced with many credit card purchases being made online. The credit card holder merely needs to access a website and provide the credit card number online to make a purchase. The employee just needs to know the credit card number, expiration date and security code to make purchases.
In accordance with an inventive aspect, a method is performed by a processor of a computing device. Per the method, with the processor, a primary cryptographic key pair is registered with an account of an online service for user authentication when accessing an online service. The primary cryptographic key pair includes a primary private cryptographic key and a primary public cryptographic key. A secondary cryptographic key pair is derived with the processor from the primary private cryptographic key. The secondary cryptographic key pair is for user authentication when accessing the online service and includes a private secondary cryptographic key and a public secondary cryptographic key. The secondary cryptographic key pair is registered by the processor with a subaccount of the account for the online service. The primary private cryptographic key is registered with the account. With the processor, the secondary private cryptographic key is designated for a mode of access to the online service that is more limited than the mode of access designated for the primary private cryptographic key, and the secondary private cryptographic key is forwarded to a client computing device.
The online service may be a website, and the secondary private cryptographic key may enable access to only a portion of the website, whereas the primary cryptographic key enables access to the full website. The online service may enable a user to purchase goods or services, and the mode of access for the subaccount may limit purchase of items by the user to a subset of less than all of the goods or services that may be purchased via the online service. The method may further include associating a payment mechanism with the account such that goods or services purchased via the online service using the account are paid via the associated payment mechanism. The associated payment mechanism may be one of a credit card account, a debit card account, an online payment account, a bank account a peer-to-peer payment or a cryptocurrency account. The method may further include creating a virtual account payment mechanism from the payment mechanism associated with the account. The virtual account payment mechanism may have an associated identifier and the virtual payment account mechanism may be associated with the subaccount such that good or services purchased via the online service via the subaccount are paid via virtual payment account payment mechanism using the associated identifier. The payment mechanism associated with the account may be a credit card having a credit card number, and the virtual payment account mechanism may be a virtual credit card having a virtual credit card number as the associated identifier.
In accordance with another inventive aspect, a method is performed by a processor of a computing device. The method entails, with the processor, registering a primary cryptographic key pair with an account of an online service for user authentication when accessing an online service. The primary cryptographic key pair includes a primary private cryptographic key and a primary public cryptographic key. With the processor, secondary cryptographic key pairs are derived from the primary private cryptographic key. The secondary cryptographic key pairs are for user authentication when accessing the online service, and each of the secondary cryptographic key pairs includes a public secondary cryptographic key and a private secondary cryptographic key. With the processor, registering at least some of the secondary cryptographic key pairs with respective subaccounts of the account for the online service, wherein the primary private cryptographic key is registered with the account. With the processor, each of the secondary private cryptographic keys of the registered secondary cryptographic key pairs are designated for a respective mode of access to the online service that is more limited than the mode of access designated for the primary private cryptographic key and the registered secondary private cryptographic keys is forwarded to a client computing device.
The method may further include registering a primary payment mechanism with the account for paying for good or services when accessing the online service via the account and deriving virtual payment mechanisms for the subaccounts from the primary payment mechanism that are associated with the primary payment mechanism and registering respective ones of the virtual payment mechanisms with respective ones of the registered subaccounts for payment for goods or services when accessing the online service via the respective subaccounts. The online service may be a website, and a user accessing the website via first of the registered subaccounts may access only a first portion of the website whereas the user accessing the website via a second of the registered subaccounts may access only a second portion of the website that differs at least in part from the first portion. A first of the registered subaccounts may have a first spending limit specifying how much a user may spend when accessing the online service via the first of the registered subaccounts. A second of the registered subaccounts may have a second spending limit that differs from the first spending limit. The method may include deriving a tertiary cryptographic key pair for user authentication for the online service for a child account of one of the subaccounts from one of the secondary cryptographic key pairs.
In accordance with an additional inventive aspect, a method is performed by a processor of a computing device. The method entails receiving a request from a requestor to access an online service via a subaccount of an account of the online service, and based on the receiving of the request, with the processor, issuing a cryptographic challenge to the requestor. The method further includes receiving a response to the challenge, and with the processor, determining if the response was proper by determining if the response was generated using a secondary private cryptographic key that is registered for the subaccount. Where the processor determines that the response was proper, the requestor is granted access to online service via the subaccount in accordance with a mode of access permitted for the subaccount. Where the processor determines that the response was improper, access to the online service via the subaccount is denied.
The mode of access permitted for the subaccount may specify what portions of the online service are accessible. The mode of access permitted for the subaccount may specify what interactions with the online service are permitted. The mode of access permitted for the subaccount may specify what good or services may be purchased via the online service using the subaccount. The mode of access permitted for the subaccount may specify a spending limit for good or services purchased via the online service using the subaccount. A payment mechanism may be associated with the subaccount for payment of goods or services purchased via the online service using the subaccount.
The exemplary embodiments may provide a password-less user authentication mechanism that enables users to be authenticated for accessing an online service. The online service may be, for example, a website that provides a service. More generally, an online service is a service that may be accessed via a computing device over a network connection. The exemplary embodiments use cryptographic key pairs as part of the credentials for user authentication. A user registers an account with the online service and then is given a private cryptographic key that is used to gain access to the online service. A public cryptographic key is also generated for the account (which may be referred to as a “primary account”), which is used by the online service in authenticating the user. The exemplary embodiments enable the creation of subaccounts that are affiliated with the primary account. At least one offspring cryptographic key pair (also referred to as “secondary key pair”) for user authentication may be generated for each subaccount. The offspring cryptographic key pairs are derived from the primary cryptographic key pair for user authentication that is associated with the primary account. The offspring cryptographic key pairs are used to gain access to the online service via a subaccount.
When a user wishes to gain access to the online service via a subaccount, the user may provide a username. The online service has an authenticator that generates a cryptographic challenge for the user based upon the public cryptography key associated with the user and the subaccount. The user generates a response to the cryptographic challenge. The authenticator for the online service determines whether the response was proper or not. If the response was proper, the user is given access to the online service via the subaccount.
Each subaccount may have different modes of access. In other words, each subaccount may have different authorizations relative to use of the online service. For example, a first subaccount may have access to an entire website of the online service, whereas a second subaccount may only access a portion of the website of the online service. As an example, an administrative assistant with an organization may only access a portion of a purchasing website relating to office supplies. In addition, the mode of access may limit what actions a user may take relative to the online service. For instance, a user may be limited in what purchases of goods and services a user may realize through the online service. Similarly, a user may be limited in the amount that the user may spend in making purchases via the online service.
Each subaccount may have an associated virtual payment mechanism (e.g., a virtual account number) that is associated with the payment mechanism for the account. The virtual payment mechanism may have a virtual identifier that is derived from the identifier for the payment mechanism the account. For example, if a credit card is associated with the account for making payments, a derived virtual credit card number may be associated with the subaccount and use to make purchases. The online service knows that the charges are to be levied relative to the credit card for the account but associates the charges with the subaccount. When a statement of account is produced by the online service, the statement of account may detail purchases by subaccount.
The exemplary embodiments thus address some of the concerns detailed above with the conventional approach of lending a credit card to members of an organization or providing each member of an organization with a separate credit card. Limitations can be placed on the mode of access for each subaccount. Limitation such as spending limits and restrictions on what items may be purchased help to address some of the concerns found conventionally. Moreover, purchases may be reported by subaccount and thus, the responsible parties may be identified for the purchases. Still further, the login is secured and lost keys may be easily replaced.
In some embodiments, permissions, access, and/or authorizations for subaccounts and sub-pairs of cryptographic keys may be modified by the primary account. For example, a manager may grant additional privileges to a subaccount associated with an employee who reaches a predetermined tenure (e.g., 3 years, 5 years, etc.) and/or remove privileges for another employee on a performance plan. Furthermore, any granted permissions may be based on predetermined periods of time, predetermined dollar amounts, and/or a predetermined number of purchases (e.g., each new employee may receive a subaccount with a $100 allowance for office supplies that expires 30 days after the employee's date of hire). In some embodiments, multiple different key pairs may be assigned to a subaccount (e.g., to give multiple people shared access to the same pool of privileges, budget, etc. with the ability to manage and/or terminate access individually, e.g., after an employee leaves an organization).
Further still, subaccounts and/or tertiary accounts may be used to provide a similar set of privileges (e.g., a subaccount and any tertiary accounts thereof may have the same set of restrictions and/or rules), but using different tertiary accounts provides additional transparency into which individual made a given purchase. Doing so allows individual users (e.g., tertiary accounts) to be added and/or removed from a subaccount as needed. Furthermore, doing so may subject all purchases made by the tertiary accounts to the budget restrictions or any other restrictions that apply to the subaccount.
Reference is now made to the drawings, wherein like reference numerals are used to refer to like elements throughout. In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding thereof. However, the novel embodiments can be practiced without these specific details. In other instances, well known structures and devices are shown in block diagram form in order to facilitate a description thereof. The intention is to cover all modifications, equivalents, and alternatives consistent with the claimed subject matter.
In the Figures and the accompanying description, the designations “a” and “b” and “c” (and similar designators) are intended to be variables representing any positive integer. Thus, for example, if an implementation sets a value for a=5, then a complete set of components 121 illustrated as components 121-1 through 121-a may include components 121-1, 121-2, 121-3, 121-4, and 121-5. The embodiments are not limited in this context.
Operations for the disclosed embodiments may be further described with reference to the following figures. Some of the figures may include a logic flow. Although such figures presented herein may include a particular logic flow, it can be appreciated that the logic flow merely provides an example of how the general functionality as described herein can be implemented. Further, a given logic flow does not necessarily have to be executed in the order presented unless otherwise indicated. Moreover, not all acts illustrated in a logic flow may be required in some embodiments. In addition, the given logic flow may be implemented by a hardware element, a software element executed by a processor, or any combination thereof. The embodiments are not limited in this context.
In the exemplary embodiments, a user may be required to register with an online service before the user is permitted to access the online service. The registration may create an account that is associated with the user and that may be used to access the online service.
Once the user has obtained a primary private cryptographic key for an account, the user may wish to generate subaccounts and obtained offspring cryptographic key pairs for the subaccounts. For example, suppose that a manager of a corporation opens an account with an online marketplace and wishes to provide access to the online marketplace to a number of the employees that are under his/her management. One way to facilitate such access in the exemplary embodiments is to generate subaccounts and associate offspring cryptographic key pairs with the subaccounts. The offspring cryptographic key pairs may be generated from the public cryptographic key for the account. The offspring cryptographic key pairs may be used to perform user authentication for the subaccounts as will be detailed below.
Once the users are in possession of the offspring private cryptographic keys for subaccounts, the users may wish to login to the online service using the subaccounts.
As was mentioned above, a hierarchy of cryptographic key pairs may be generated for hierarchically organized subaccounts.
Different payment mechanisms 1300 may be associated with accounts and subaccounts. As shown in
As was discussed above, each subaccount may have a specified mode of access. The mode of access may vary amongst subaccounts. For example,
One of the benefits of using subaccounts concerns the ability to display an account for spending on a per subaccount basis.
The components and features of the devices described above may be implemented using any combination of discrete circuitry, application specific integrated circuits (ASICs), logic gates and/or single chip architectures. Further, the features of the devices may be implemented using microcontrollers, programmable logic arrays and/or microprocessors or any combination of the foregoing where suitably appropriate. It is noted that hardware, firmware and/or software elements may be collectively or individually referred to herein as “logic” or “circuit.”
It will be appreciated that the exemplary devices shown in the block diagrams described above may represent one functionally descriptive example of many potential implementations. Accordingly, division, omission or inclusion of block functions depicted in the accompanying figures does not infer that the hardware components, circuits, software and/or elements for implementing these functions would necessarily be divided, omitted, or included in embodiments.
At least one computer-readable storage medium may include instructions that, when executed, cause a system to perform any of the computer-implemented methods described herein.
Some embodiments may be described using the expression “one embodiment” or “an embodiment” along with their derivatives. These terms mean that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. The appearances of the phrase “in one embodiment” in various places in the specification are not necessarily all referring to the same embodiment. Moreover, unless otherwise noted the features described above are recognized to be usable together in any combination. Thus, any features discussed separately may be employed in combination with each other unless it is noted that the features are incompatible with each other.
With general reference to notations and nomenclature used herein, the detailed descriptions herein may be presented in terms of program procedures executed on a computer or network of computers. These procedural descriptions and representations are used by those skilled in the art to most effectively convey the substance of their work to others skilled in the art.
A procedure is here, and generally, conceived to be a self-consistent sequence of operations leading to a desired result. These operations are those requiring physical manipulations of physical quantities. Usually, though not necessarily, these quantities take the form of electrical, magnetic or optical signals capable of being stored, transferred, combined, compared, and otherwise manipulated. It proves convenient at times, principally for reasons of common usage, to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, or the like. It should be noted, however, that all of these and similar terms are to be associated with the appropriate physical quantities and are merely convenient labels applied to those quantities.
Further, the manipulations performed are often referred to in terms, such as adding or comparing, which are commonly associated with mental operations performed by a human operator. No such capability of a human operator is necessary, or desirable in most cases, in any of the operations described herein, which form part of one or more embodiments. Rather, the operations are machine operations. Useful machines for performing operations of various embodiments include general purpose digital computers or similar devices.
Some embodiments may be described using the expression “coupled” and “connected” along with their derivatives. These terms are not necessarily intended as synonyms for each other. For example, some embodiments may be described using the terms “connected” and/or “coupled” to indicate that two or more elements are in direct physical or electrical contact with each other. The term “coupled,” however, may also mean that two or more elements are not in direct contact with each other, but yet still co-operate or interact with each other.
Various embodiments also relate to apparatus or systems for performing these operations. This apparatus may be specially constructed for the required purpose or it may comprise a general purpose computer as selectively activated or reconfigured by a computer program stored in the computer. The procedures presented herein are not inherently related to a particular computer or other apparatus. Various general purpose machines may be used with programs written in accordance with the teachings herein, or it may prove convenient to construct more specialized apparatus to perform the required method steps. The required structure for a variety of these machines will appear from the description given.
What has been described above includes examples of the disclosed architecture. It is, of course, not possible to describe every conceivable combination of components and/or methodologies, but one of ordinary skill in the art may recognize that many further combinations and permutations are possible. Accordingly, the novel architecture is intended to embrace all such alterations, modifications and variations that fall within the spirit and scope of the appended claims.
The various elements of the devices as previously described with reference to
One or more aspects of at least one embodiment may be implemented by representative instructions stored on a machine-readable medium which represents various logic within the processor, which when read by a machine causes the machine to fabricate logic to perform the techniques described herein. Such representations, known as “IP cores” may be stored on a tangible, machine readable medium and supplied to various customers or manufacturing facilities to load into the fabrication machines that make the logic or processor. Some embodiments may be implemented, for example, using a machine-readable medium or article which may store an instruction or a set of instructions that, if executed by a machine, may cause the machine to perform a method and/or operations in accordance with the embodiments. Such a machine may include, for example, any suitable processing platform, computing platform, computing device, processing device, computing system, processing system, computer, processor, or the like, and may be implemented using any suitable combination of hardware and/or software. The machine-readable medium or article may include, for example, any suitable type of memory unit, memory device, memory article, memory medium, storage device, storage article, storage medium and/or storage unit, for example, memory, removable or non-removable media, erasable or non-erasable media, writeable or re-writeable media, digital or analog media, hard disk, floppy disk, Compact Disk Read Only Memory (CD-ROM), Compact Disk Recordable (CD-R), Compact Disk Rewriteable (CD-RW), optical disk, magnetic media, magneto-optical media, removable memory cards or disks, various types of Digital Versatile Disk (DVD), a tape, a cassette, or the like. The instructions may include any suitable type of code, such as source code, compiled code, interpreted code, executable code, static code, dynamic code, encrypted code, and the like, implemented using any suitable high-level, low-level, object-oriented, visual, compiled and/or interpreted programming language.
It will be appreciated that the exemplary devices shown in the block diagrams described above may represent one functionally descriptive example of many potential implementations. Accordingly, division, omission or inclusion of block functions depicted in the accompanying figures does not infer that the hardware components, circuits, software and/or elements for implementing these functions would necessarily be divided, omitted, or included in embodiments.
At least one computer-readable storage medium may include instructions that, when executed, cause a system to perform any of the computer-implemented methods described herein.
Some embodiments may be described using the expression “one embodiment” or “an embodiment” along with their derivatives. These terms mean that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. The appearances of the phrase “in one embodiment” in various places in the specification are not necessarily all referring to the same embodiment. Moreover, unless otherwise noted the features described above are recognized to be usable together in any combination. Thus, any features discussed separately may be employed in combination with each other unless it is noted that the features are incompatible with each other.
It is emphasized that the Abstract of the Disclosure is provided to allow a reader to quickly ascertain the nature of the technical disclosure. It is submitted with the understanding that it will not be used to interpret or limit the scope or meaning of the claims. In addition, in the foregoing Detailed Description, it can be seen that various features are grouped together in a single embodiment for the purpose of streamlining the disclosure. This method of disclosure is not to be interpreted as reflecting an intention that the claimed embodiments require more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive subject matter lies in less than all features of a single disclosed embodiment. Thus the following claims are hereby incorporated into the Detailed Description, with each claim standing on its own as a separate embodiment. In the appended claims, the terms “including” and “in which” are used as the plain-English equivalents of the respective terms “comprising” and “wherein,” respectively. Moreover, the terms “first,” “second,” “third,” and so forth, are used merely as labels, and are not intended to impose numerical requirements on their objects.
The foregoing description of example embodiments has been presented for the purposes of illustration and description. It is not intended to be exhaustive or to limit the present disclosure to the precise forms disclosed. Many modifications and variations are possible in light of this disclosure. It is intended that the scope of the present disclosure be limited not by this detailed description, but rather by the claims appended hereto. Future filed applications claiming priority to this application may claim the disclosed subject matter in a different manner, and may generally include any set of one or more limitations as variously disclosed or otherwise demonstrated herein.
While exemplary embodiments have been described herein, it should be appreciated that various changes to the exemplary embodiments may be made without departing from the intended scope as defined by the appended claims.
