Granted Patent B2

US 12,476,961 · App. 18/470,198 · Granted Nov 18, 2025

Inventors: Alan Vangpat (Pittsburgh, PA); Koson Thambundit (San Francisco, CA)

H04L63/083H04L63/10

Abstract

Claims (72)

1 . A method for generating a digital access token consumable by a piggy-back service system, the method comprising:

receiving a request for the digital access token for a client, the digital access token being associated with a tenant;

generating at least one standard claim associated with a client attribute of the client;

generating the digital access token comprising a header, a payload, and a signature, wherein the payload includes the at least one standard claim associated with the client attribute and the digital access token enables the piggy-back service system to independently authorize access by the client to at least one service at the piggy-back service system based on the at least one standard claim; and

transmitting the digital access token to a first device associated with the client.

2 . The method of claim 1 , wherein the method further comprises:

determining a first client attribute, the first client attribute being a tenant identifier for the tenant;

generating a first standard claim comprising the tenant identifier for inclusion in the payload; and

generating the signature based on the header and the payload using a tenant specific private key associated with the tenant wherein the first standard claim in the payload enables the piggy-back service system to fetch a tenant specific public key associated with the tenant identifier to validate the signature.

3 . The method of claim 1 , wherein the method further comprises:

generating a digital token type of the digital access token, the digital token type defining a format and a version of the digital access token including the at least one standard claim in the payload; and

generating the header to include the digital token type to enable the piggy-back service system to assess the digital access token for authorization in accordance with the digital token type.

4 . The method of claim 1 , wherein the method further comprises:

determining a second client attribute, the second client attribute being a role with respect to the tenant; and

generating a second standard claim comprising the role for inclusion in the payload, wherein the second standard claim in the payload enables the piggy-back service system to authorize at least one permission associated with the access by the client to the at least one service at the piggy-back service system based on the role.

5 . The method of claim 4 , further comprising:

receiving a first token scope handler tied to a first open authorization scope, the first open authorization scope being associated with the inclusion of the role in the payload as the second standard claim; and

injecting the role as the second standard claim in the payload of the digital access token in accordance with the first open authorization scope using the first token scope handler.

6 . The method of claim 1 , wherein the method further comprises:

determining a third client attribute, the third client attribute being tenant level access provided to the client by the tenant; and

generating a third standard claim comprising the tenant level access for inclusion in the payload, wherein the third standard claim in the payload enables the piggy-back service system to authorize at least one permission associated with the access by the client to the at least one service at the piggy-back service system based on the tenant level access.

7 . The method of claim 6 , further comprising:

receiving a second token scope handler tied to a second open authorization scope, the second open authorization scope being associated with the inclusion of the tenant level access in the payload as the third standard claim; and

injecting the tenant level access as the third standard claim in the payload of the digital access token in accordance with the second open authorization scope using the second token scope handler.

8 . The method of claim 1 , wherein the payload includes a standard subject claim and the method further comprises:

receiving an identity of the client;

determining a fourth client attribute, the fourth client attribute being an identity type based on one of the identity of the client and a user authorizing the request for the digital access token; and

generating the standard subject claim to including the identity and the identity type for inclusion in the payload, wherein the standard subject claim in the payload enables the piggy-back service system to authorize permissions associated with the access by the client to the at least one service at the piggy-back service system based on the identify type.

9 . The method of claim 8 , further comprising:

receiving a third token scope handler tied to a third open authorization scope, the third open authorization scope being associated with the inclusion of the identity type in the standard subject claim of the payload; and

injecting the identity and the identity type as the standard subject claim in the payload of the digital access token in accordance with the third open authorization scope using the third token scope handler.

10 . The method of claim 1 , further comprising:

identifying at least one tenant specific token setting for association with the digital access token; and

enabling the at least one tenant specific token setting of the digital access token prior to transmission of the digital access token to the first device.

11 . The method of claim 10 , further comprising:

receiving a fourth token scope handler tied to a fourth open authorization scope, the fourth open authorization scope being associated with the at least one tenant specific setting; and

associating the at least one tenant specific token setting with the digital access token in accordance with the fourth open authorization scope using the fourth token scope handler.

12 . A system for generating a digital access token consumable by a piggy-back service system, the system comprising:

at least one processor; and

at least one non-transitory machine-readable storage medium that stores instructions configurable to be executed by the at least one processor to:

receive a request for the digital access token for a client, the digital access token being associated with a tenant;

generate at least one standard claim associated with a client attribute of the client;

generate the digital access token comprising a header, a payload, and a signature, wherein the payload includes the at least one standard claim associated with the client attribute and the digital access token enables the piggy-back service system to independently authorize access by the client to at least one service at the piggy-back service system based on the at least one standard claim; and

transmit the digital access token to a first device associated with the client.

13 . The system of claim 12 , wherein the instructions are configurable to be executed by the at least one processor to

determine a first client attribute, the first client attribute being a tenant identifier associated with the tenant;

generate a first standard claim comprising the tenant identifier for inclusion in the payload; and

generate the signature based on the header and the payload using a tenant specific private key associated with the tenant, wherein the first standard claim in the payload enables the piggy-back service system to fetch a tenant specific public key associated with the tenant identifier to validate the signature.

14 . The system of claim 12 , wherein the instructions are configurable to be executed by the at least one processor to:

determine a second client attribute, the first second client attribute being a role with respect to the tenant; and

generate a second standard claim comprising the role for inclusion in the payload, wherein the second standard claim in the payload enables the piggy-back service system to authorize at least one permission associated with the access by the client to the at least one service at the piggy-back service system based on the role.

15 . The system of claim 12 , wherein the instructions are configurable to be executed by the at least one processor to:

determine a third client attribute, the third client attribute being tenant level access provided to the client by the tenant; and

generate a third standard claim comprising the tenant level access for inclusion in the payload, wherein the third standard claim in the payload enables the piggy-back service system to authorize at least one permission associated with the access by the client to the at least one service at the piggy-back service system based on the tenant level access.

16 . A non-transitory machine-readable storage medium that stores instructions executable by at least one processor, the instructions configurable to cause the at least one processor to perform operations comprising:

receiving a request for a digital access token for a client, the digital access token being associated with a tenant;

generating at least one standard claim associated with a client attribute of the client;

generating the digital access token comprising a header, a payload, and a signature, wherein the payload includes the at least one standard claim associated with the client attribute and the digital access token enables a piggy-back service system to independently authorize access by the client to at least one service at the piggy-back service system based on the at least one standard claim; and

transmitting the digital access token to a first device associated with the client.

17 . The non-transitory machine-readable storage medium of claim 16 , wherein the instructions are configurable to cause the at least one processor to further perform operations comprising:

determining a first client attribute, the first client attribute being a tenant identifier of the tenant;

generating a first standard claim comprising the tenant identifier for inclusion in the payload; and

generating the signature based on the header and the payload using a tenant specific private key associated with the tenant, wherein the first standard claim in the payload enables the piggy-back service system to fetch a tenant specific public key associated with the tenant identifier to validate the signature.

18 . The non-transitory machine-readable storage medium of claim 16 , wherein the instructions are configurable to cause the at least one processor to further perform operations comprising:

generating at least one tenant specific token setting for association with the digital access token; and

enabling the at least one tenant specific token setting of the digital access token prior to transmission of the digital access token to the first device.

19 . The non-transitory machine-readable storage medium of claim 16 , wherein the instructions are configurable to cause the at least one processor to further perform operations comprising:

determining a second client attribute, the first second client attribute being a role with respect to the tenant; and

generating a second standard claim comprising the role for inclusion in the payload, wherein the second standard claim in the payload enables the piggy-back service system to authorize at least one permission associated with the access by the client to the at least one service at the piggy-back service system based on the role.

20 . The non-transitory machine-readable storage medium of claim 16 , wherein the instructions are configurable to cause the at least one processor to further perform operations comprising:

determining a third client attribute, the third client attribute being tenant level access provided to the client by the tenant; and

generating a third standard claim comprising the tenant level access for inclusion in the payload, wherein the third standard claim in the payload enables the piggy-back service system to authorize at least one permission associated with the access by the client to the at least one service at the piggy-back service system based on the tenant level access.

Assignments (1)

Continuity (1)

References Cited (154)