Granted Patent B2

US 12,634,133 · App. 18/151,737 · Granted May 19, 2026

Inventors: Hao Chen (Palatine, IL); George Mitry (Mundelein, IL)

Assignee: Capital One Financial Corporation

H04L9/32H04L63/083H04L63/0884H04L2463/082

Abstract

Claims (95)

1 . A computing platform comprising:

at least one network interface;

at least one processor;

at least one non-transitory computer-readable medium; and

program instructions stored on the at least one non-transitory computer-readable medium that are executable by the at least one processor such that the computing platform is configured to:

provide a token endpoint for a given application programming interface (API) that is protected by two-factor authentication comprising a first authentication factor and a second authentication factor, wherein the second authentication factor of the two-factor authentication is of a given type that was selected by a provider of the given API during registration of the given API from a set of options for two or more types of authentication factors that were presented to the provider as being available for use as the second authentication factor of the two-factor authentication for the given API, and wherein a given client application has been preregistered to access the given API and preconfigured with (i) first-factor credential information for the given client application that was registered at a first-factor credential manager during the registration of the given client application and (ii) vaultless second-factor credential information for the given client application that was registered at a second-factor credential manager during the registration of the given client application;

receive, from a computing system running the given client application via one or more data networks, an initial request message for an access token that enables the given client application to access one or more resources exposed by the given API, wherein the request message for the access token includes (i) a first authentication factor that encodes the preregistered first-factor credential information for the given client application and (ii) a second authentication factor that encodes the preregistered vaultless second-factor credential information for the given client application;

based on the first authentication factor that encodes the preregistered first-factor credential information for the given client application, perform a first-factor authentication of the given client application by interacting with the first-factor credential manager;

based on the second authentication factor that encodes the preregistered vaultless second-factor credential information for the given client application, perform a second-factor authentication of the given client application by interacting with the second-factor credential manager,

make a determination that both the first-factor authentication and the second-factor authentication are successful;

in response to making the determination that both the first-factor authentication and the second-factor authentication are successful, generate an access token that represents authorization for the given client application to access the one or more resources exposed by the given API, wherein the generated access token is usable by the given client application for an API request to access the one or more resources exposed by the given API; and

transmit the generated access token to the computing system running the given client application via the one or more data networks, wherein the generated access token is thereafter included in an API request and utilized to authorize the API request.

2 . The computing platform of claim 1 , wherein the first-factor credential information comprises a first-factor secret for the given client application and the vaultless second-factor credential information comprises a second-factor secret for the given client application, and wherein the first-factor secret for the given client application is persisted.

3 . The computing platform of claim 1 , wherein the set of options for the two or more types of authentication factors that are available for use as the second authentication factor of the two-factor authentication for the API comprise two or more of (i) a hash of a shared secret for the given client application, (ii) a JSON (JavaScript Object Notation) web token (JWT) that is to be signed using a symmetric signing algorithm and a shared secret for the given client application, or (iii) a JWT that is to be signed using an asymmetric signing algorithm and a private key of a public-private key pair for the given client application.

4 . The computing platform of claim 1 , wherein the second authentication factor comprises a hash that is to encode a preregistered shared secret for the given client application, and wherein the program instructions that are executable by the at least one processor such that the computing platform is configured to perform the second-factor authentication of the given client application comprise program instructions that are executable by the at least one processor such that the computing platform is configured to:

extract the hash from the request;

obtain the preregistered shared secret for the given client application;

generate a hash of the preregistered shared secret; and

compare the extracted hash to the generated hash to determine if they match;

if the extracted hash and the generated hash match, make a determination that the second-factor authentication is successful; and

if the extracted hash and the generated hash do not match, make a determination that the second-factor authentication is not successful.

5 . The computing platform of claim 4 , wherein the program instructions that are executable by the at least one processor such that the computing platform is configured to obtain the preregistered shared secret comprise program instructions that are executable by the at least one processor such that the computing platform is configured to:

request that the second-factor credential manager algorithmically re-generate the preregistered shared secret for the given client application.

6 . The computing platform of claim 1 , wherein the second authentication factor comprises a JSON (JavaScript Object Notation) web token (JWT) having a header segment, a payload segment, and a signature segment that is to be generated using a symmetric signing algorithm and a previously registered preregistered shared secret for the given client application, and wherein the program instructions that are executable by the at least one processor such that the computing platform is configured to perform the second-factor authentication of the given client application comprise program instructions that are executable by the at least one processor such that the computing platform is configured to:

extract the header segment of the JWT, the payload segment of the JWT, and the signature segment of the JWT from the request;

obtain the preregistered shared secret for the given client application;

use the extracted header segment of the JWT, the extracted payload segment of the JWT, and the preregistered shared secret to generate another signature segment; and

compare the extracted signature segment of the JWT to the generated signature segment to determine if they match;

if the extracted signature segment of the JWT and the generated signature segment match, make a determination that the second-factor authentication is successful; and

if the extracted signature segment of the JWT and the generated signature segment do not match, make a determination that the second-factor authentication is not successful.

7 . The computing platform of claim 6 , wherein the program instructions that are executable by the at least one processor such that the computing platform is configured to obtain the preregistered shared secret comprise program instructions that are executable by the at least one processor such that the computing platform is configured to:

request that the second-factor credential manager algorithmically re-generate the preregistered shared secret for the given client application.

8 . The computing platform of claim 1 , wherein the second authentication factor comprises a JSON web token (JWT) having a header segment, a payload segment, and a signature segment that is to be generated using an asymmetric signing algorithm and a private key of a public-private key pair for the given client application, and wherein program instructions that are executable by the at least one processor such that the computing platform is configured to perform the second-factor authentication of the given client application comprise program instructions stored on the at least one non-transitory computer-readable medium that are executable by the at least one processor such that the computing platform is configured to:

extract the header segment of the JWT, the payload segment of the JWT, and the signature segment of the JWT from the request;

obtain a public key of the public-private key pair for the given client application;

use the obtained public key to decrypt the extracted signature segment of the JWT and thereby produce a decrypted signing hash for the JWT;

use the extracted header segment of the JWT, the extracted payload segment of the JWT, and an obtained shared secret to generate another signing hash; and

compare the decrypted signing hash to the generated signing hash to determine if they match;

if the decrypted signing hash and the generated signing hash match, make a determination that the second-factor authentication is successful; and

if the decrypted signing hash and the generated signing hash do not match, make a determination that the second-factor authentication is not successful.

9 . The computing platform of claim 8 , wherein the program instructions that are executable by the at least one processor such that the computing platform is configured to obtain the public key comprise program instructions that are executable by the at least one processor such that the computing platform is configured to:

retrieve the public key from the second-factor credential manager.

10 . At least one non-transitory computer-readable medium, wherein the at least one non-transitory computer-readable medium is provisioned with program instructions that, when executed by at least one processor, cause a computing platform to:

provide a token endpoint for a given application programming interface (API) that is protected by two-factor authentication comprising a first authentication factor and a second authentication factor, wherein the second authentication factor of the two-factor authentication is of a given type that was selected by a provider of the given API during registration of the given API from a set of options for two or more types of authentication factors that were presented to the provider as being available for use as the second authentication factor of the two-factor authentication for the given API, and wherein a given client application has been preregistered to access the given API and preconfigured with (i) first-factor credential information for the given client application that was registered at a first-factor credential manager during the registration of the given client application and (ii) vaultless second-factor credential information for the given client application that was registered at a second-factor credential manager during the registration of the given client application;

receive, from a computing system running the given client application via one or more data networks, an initial request message for an access token that enables the given client application to access one or more resources exposed by the given API, wherein the request message for the access token includes (i) a first authentication factor that encodes the preregistered first-factor credential information for the given client application and (ii) a second authentication factor that encodes the preregistered vaultless second-factor credential information for the given client application;

based on the first authentication factor that encodes the preregistered first-factor credential information for the given client application, perform a first-factor authentication of the given client application by interacting with the first-factor credential manager;

based on the second authentication factor that encodes the preregistered vaultless second-factor credential information for the given client application, perform a second-factor authentication of the given client application by interacting with the second-factor credential manager;

make a determination that both the first-factor authentication and the second-factor authentication are successful;

in response to making the determination that both the first-factor authentication and the second-factor authentication are successful, generate an access token that represents authorization for the given client application to access the one or more resources exposed by the given API, wherein the generated access token is usable by the given client application for an API request to access the one or more resources exposed by the given API; and

transmit the generated access token to the computing system running the given client application via the one or more data networks, wherein the generated access token is thereafter included in an API request and utilized to authorize the API request.

11 . The at least one non-transitory computer-readable medium of claim 10 , wherein the first-factor credential information comprises a first-factor secret for the given client application and the vaultless second-factor credential information comprises a second-factor secret for the given client application, and wherein the first-factor secret for the given client application is persisted.

12 . The at least one non-transitory computer-readable medium of claim 10 , wherein the set of options for the two or more types of authentication factors that are available for use as the second authentication factor of the two-factor authentication for the API comprise two or more of (i) a hash of a shared secret for the given client application, (ii) a JSON (JavaScript Object Notation) web token (JWT) that is to be signed using a symmetric signing algorithm and a shared secret for the given client application, or (iii) a JWT that is to be signed using an asymmetric signing algorithm and a private key of a public-private key pair for the given client application.

13 . The at least one non-transitory computer-readable medium of claim 10 , wherein the second authentication factor comprises a hash that is to encode a preregistered shared secret for the given client application, and wherein the program instructions that, when executed by at least one processor, cause the computing platform to perform the second-factor authentication of the given client application comprise program instructions that, when executed by at least one processor, cause the computing platform to:

extract the hash from the request;

obtain the preregistered shared secret for the given client application;

generate a hash of the preregistered shared secret; and

compare the extracted hash to the generated hash to determine if they match;

if the extracted hash and the generated hash match, make a determination that the second-factor authentication is successful; and

if the extracted hash and the generated hash do not match, make a determination that the second-factor authentication is not successful.

14 . The at least one non-transitory computer-readable medium of claim 10 , wherein the second authentication factor comprises a JSON (JavaScript Object Notation) web token (JWT) having a header segment, a payload segment, and a signature segment that is to be generated using a symmetric signing algorithm and a preregistered shared secret for the given client application, and wherein the program instructions that, when executed by at least one processor, cause the computing platform to perform the second-factor authentication of the given client application comprise program instructions that, when executed by at least one processor, cause the computing platform to:

extract the header segment of the JWT, the payload segment of the JWT, and the signature segment of the JWT from the request;

obtain the preregistered shared secret for the given client application;

use the extracted header segment of the JWT, the extracted payload segment of the JWT, and the preregistered shared secret to generate another signature segment; and

compare the extracted signature segment of the JWT to the generated signature segment to determine if they match;

if the extracted signature segment of the JWT and the generated signature segment match, make a determination that the second-factor authentication is successful; and

if the extracted signature segment of the JWT and the generated signature segment do not match, make a determination that the second-factor authentication is not successful.

15 . The at least one non-transitory computer-readable medium of claim 10 , wherein the second authentication factor comprises a JSON web token (JWT) having a header segment, a payload segment, and a signature segment that is to be generated using an asymmetric signing algorithm and a private key of a public-private key pair for the given client application, and wherein program instructions that, when executed by at least one processor, cause the computing platform to perform the second-factor authentication of the given client application comprise program instructions that, when executed by at least one processor, cause the computing platform to:

extract the header segment of the JWT, the payload segment of the JWT, and the signature segment of the JWT from the request;

obtain a public key of the public-private key pair for the given client application;

use the obtained public key to decrypt the extracted signature segment of the JWT and thereby produce a decrypted signing hash for the JWT;

use the extracted header segment of the JWT, the extracted payload segment of the JWT, and an obtained shared secret to generate another signing hash; and

compare the decrypted signing hash to the generated signing hash to determine if they match;

if the decrypted signing hash and the generated signing hash match, make a determination that the second-factor authentication is successful; and

if the decrypted signing hash and the generated signing hash do not match, make a determination that the second-factor authentication is not successful.

16 . A method carried out by a computing platform, the method comprising:

providing a token endpoint for a given application programming interface (API) that is protected by two-factor authentication comprising a first authentication factor and a second authentication factor, wherein the second authentication factor of the two-factor authentication is of a given type that was selected by a provider of the given API during registration of the given API from a set of options for two or more types of authentication factors that were presented to the provider as being available for use as the second authentication factor of the two-factor authentication for the given API, and wherein a given client application has been preregistered to access the given API and preconfigured with (i) first-factor credential information for the given client application that was registered at a first-factor credential manager during the registration of the given client application and (ii) vaultless second-factor credential information for the given client application that was registered at a second-factor credential manager during the registration of the given client application;

receiving, from a computing system running the given client application via one or more data networks, an initial request message for an access token that enables the given client application to access one or more resources exposed by the given API, wherein the request message for the access token includes (i) a first authentication factor that encodes the preregistered first-factor credential information for the given client application and (ii) a second authentication factor that encodes the preregistered vaultless second-factor credential information for the given client application;

based on the first authentication factor that encodes the preregistered first-factor credential information for the given client application, performing a first-factor authentication of the given client application by interacting with the first-factor credential manager;

based on the second authentication factor that encodes the preregistered vaultless second-factor credential information for the given client application, performing a second-factor authentication of the given client application by interacting with the second-factor credential manager;

making a determination that both the first-factor authentication and the second-factor authentication are successful;

in response to making the determination that both the first-factor authentication and the second-factor authentication are successful, generating an access token that represents authorization for the given client application to access the one or more resources exposed by the given API, wherein the generated access token is usable by the given client application for an API request to access the one or more resources exposed by the given API; and

transmitting the generated access token to the computing system running the given client application via the one or more data networks, wherein the generated access token is thereafter included in an API request and utilized to authorize the API request.

17 . The method of claim 16 , wherein the set of options for the two or more types of authentication factors that are available for use as the second authentication factor of the two-factor authentication for the API comprise two or more of (i) a hash of a shared secret for the given client application, (ii) a JSON (JavaScript Object Notation) web token (JWT) that is to be signed using a symmetric signing algorithm and a shared secret for the given client application, or (iii) a JWT that is to be signed using an asymmetric signing algorithm and a private key of a public-private key pair for the given client application.

18 . The computing platform of claim 1 , wherein the generated access token comprises a JSON (JavaScript Object Notation) web token (JWT) or an opaque access token.

19 . The computing platform of claim 1 , wherein the first-factor authentication and the second-factor authentication are performed at the token endpoint, and wherein performing the first-factor authentication and the second-factor authentication at the token endpoint was an option for implementation of two-factor authentication for protecting the given API that was selected by the provider of the given API from among a set of options comprising (i) performing first-factor authentication and second-factor authentication at the token endpoint and (ii) performing first-factor authentication at a token endpoint and performing second-factor authentication at a resource endpoint.

20 . The computing platform of claim 1 , further comprising program instructions stored on the at least one non-transitory computer-readable medium that are executable by the at least one processor such that the computing platform is configured to:

interact with an API portal to one or more of (i) confirm that the given client application has approval to access the one or more resources exposed by the given API or (ii) obtain a scope of the given client application for the given API.

21 . The computing platform of claim 1 , further comprising program instructions stored on the at least one non-transitory computer-readable medium that are executable by the at least one processor such that the computing platform is configured to:

receive, from the computing system running the given client application, the API request including the generated access token;

authorize the API request; and

send, to the computing system running the given client application, an API response that provides the given client application with access to the one or more resources exposed by the given API.

22 . The computing platform of claim 1 , wherein the first-factor authentication and the second-factor authentication are performed at the token endpoint, and wherein the computing platform further comprises program instructions stored on the at least one non-transitory computer-readable medium that are executable by the at least one processor such that the computing platform is configured to:

provide an API portal for registering APIs and client applications;

cause a second computing system to display an interface for registering the given API; and

during registration of the given API, (i) cause the second computing system to present a set of options for implementation of two-factor authentication for protecting the given API, wherein the set of options comprises (a) performing first-factor authentication and second-factor authentication at the token endpoint and (b) performing first-factor authentication at a token endpoint and performing second-factor authentication at a resource endpoint and (ii) receive a selection of the option of performing the first-factor authentication and the second-factor authentication at the token endpoint.

Assignments (2)

Continuity (1)

References Cited (31)