Patent Application
20080082626
In order to describe the manner in which the above-recited and other advantages and features can be obtained, a more particular description of the subject matter briefly described above will be rendered by reference to specific embodiments which are illustrated in the appended drawings. Understanding that these drawings depict only typical embodiments and are not therefore to be considered to be limiting in scope, embodiments will be described and explained with additional specificity and detail through the use of the accompanying drawings in which:
Embodiments herein may comprise a special purpose or general-purpose computer including various computer hardware, as discussed in greater detail below.
One embodiment described herein allows for typed information, or information of a given type, to be sent in a security token request. With the typed information is also included information such as source of the information, proof of source of the information, and usage information. This information can be used by the token issuer in the process of providing a token. For example, the typed information may be information conveying a purchase price. The source information may be a service that provides the purchase price to the client. The proof of source information may be some type of cryptographic or tokenized proof that the service sent the purchase price typed information. Some or all of this information may be sent by the client to a token issuer in a token request. The information can then be used by the token issuer to authorize issuance of the token, generate logging information, generate specific information to be included in the token, or for other purposes.
Referring now to
As illustrated and
Additionally, the source does not need to be the direct source. For example, if the service 106 receives the information from an application on the service 106, the source information in the request 108 may indicate the source as the service 106, the application on the service 106 or both the service 106 and the application on the service 106. Similarly, if the service 106 receives the information from another service or external source, information about the external source may be conveyed in the source information in the request 108.
In one embodiment, the client 102 may receive the typed information from an application running directly on the client 102. In this example, the source information in the request 108 will indicate that the source is the application on the client 102. Other sources, although not specifically enumerated here, may also be indicated.
Alternatively, the usage information may indicate that the typed information is to be used for secondary authentication. Specifically, other information may be used as primary authentication, with the typed information being used as secondary authentication. Thus, the usage information may indicate that the typed information is not suitable for primary authentication, but is suitable for secondary authentication when other information is used for primary authentication.
The usage information may indicate that the typed information is to be used for informational purposes only. This can be an indication that the typed information is not to be used for authentication or other security purposes, but rather is provided for various informational purposes. For example, in one embodiment, the usage information may specify that the typed information should be logged. Notably, the usage information may indicate that a combination of uses are appropriate. For example, the usage information may indicate that the information is to be used for authentication purposes, but that the information should or may also be logged.
Other information may be sent with the typed information as well. For example, type information may be sent specifying what the information represents. In one embodiment, format information may be sent specifying how the information is presented.
Referring now to
The method 200 further includes sending a request from the client including the information and at least one of information defining the source of the information, proof of the source of the information; or usage information specifying how the information should be used (act 204).
In one embodiment, as explained previously, the usage information may specify that the information should be used as primary authentication. In an alternative embodiment, the usage information specifies that the information should be used as secondary authentication. In some embodiments, the usage information may specify that the information should be used for information purposes. For example, the usage information may specify that the information should be logged.
In one embodiment, when proof of the source information is included, the proof of source information may include cryptographic proof from the service. Similarly, the proof of source information may include a certificate from the service.
In one embodiment of the method 200, sending a client request (204) from the client to the token issuer for a token may include sending the information in a non-tokenized portion of the request. Specifically, a request may include both tokenized and non-tokenized data. The information, as well as the source, proof of source and/or usage information may be sent in non-tokenized portions of the request.
Referring now to
The method 300 further includes issuing a token to the client based on at least one of the source of the information from the service, proof of the source of the information from the service; or usage information specifying how the information should be used (act 304).
Embodiments may also include computer-readable media for carrying or having computer-executable instructions or data structures stored thereon. Such computer-readable media can be any available media that can be accessed by a general purpose or special purpose computer. By way of example, and not limitation, such computer-readable media can comprise physical media such as RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to carry or store desired program code means in the form of computer-executable instructions or data structures and which can be accessed by a general purpose or special purpose computer. When information is transferred or provided over a network or another communications connection (either hardwired, wireless, or a combination of hardwired or wireless) to a computer, the computer properly views the connection as a computer-readable medium. Thus, any such connection is properly termed a computer-readable medium. Combinations of the above should also be included within the scope of computer-readable media.
Computer-executable instructions comprise, for example, instructions and data which cause a general purpose computer, special purpose computer, or special purpose processing device to perform a certain function or group of functions. Although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.
The present invention may be embodied in other specific forms without departing from its spirit or essential characteristics. The described embodiments are to be considered in all respects only as illustrative and not restrictive. The scope of the invention is, therefore, indicated by the appended claims rather than by the foregoing description. All changes which come within the meaning and range of equivalency of the claims are to be embraced within their scope.
