Asynchronous step-up authentication for client applications
View Patent ↗Embodiments described herein disclose methods and systems for authorizing transactions received from client applications. The transaction request can include a first access token. After validating the first access token, the system can determine whether additional authentication is needed to authorize the transaction. If additional authentication is needed, the system can determine the authentication requirements. Once the additional authentication is received and verified, the system can generate a second access token and authorize the transaction by releasing the first access token.
1. A computerized method of authorizing a transaction comprising:
receiving, from a client application, a request to authorize a transaction requested by a user of the client application,
wherein the request includes a first access token;
validating, by an authentication service, the first access token;
determining, by the authentication service, whether step-up authentication is required to authorize the transaction;
when the step-up authentication is required:
determining, by a step-up authentication service, authentication requirements to authorize the transaction;
sending an authentication request to the user;
receiving, from the user, a response to the authentication request;
in response to verifying credentials in the response to the authentication request, generating, by the step-up authentication service, a second access token, wherein the second access token is active for a predefined timeframe;
in response to receiving the second access token, authorizing, by the authentication service, the transaction by releasing the first second access token,
receiving a second request to authorize a second transaction requested by the user; and
authorizing the transaction using the second access token when the second transaction is requested within the predefined timeframe,
wherein a third access token is generated and exchanged with the second access token.
2. The computerized method of claim 1 , wherein the client application is a first channel, wherein the authentication request is sent to the user via a second channel that is different from the first channel.
3. The computerized method of claim 2 , wherein the second channel is one of: a text message, an email message, or a push notification.
4. The computerized method of claim 1 , wherein the second request is received from a different form of the client application.
5. The computerized method of claim 1 , wherein the first access token is active for longer than the predefined timeframe.
6. The computerized method of claim 1 , wherein the step-up authentication is required based on at least one of: an amount of funds involved with the transaction, an identity of the user, an identity of the client application, or a device used to request the transaction.
7. A non-transitory computer-readable storage medium containing a set of instructions that, when executed by one or more processors, cause a machine to:
receive, from a client application, a request to authorize a transaction requested by a user of the client application,
wherein the request includes a first access token;
validate, by an authentication service, the first access token;
determine, by the authentication service, whether step-up authentication is required to authorize the transaction;
when the step-up authentication is required:
determine, by a step-up authentication service, authentication requirements to authorize the transaction;
send an authentication request to the user;
receive, from the user, a response to the authentication request;
in response to verifying credentials in the response to the authentication request, generate, by the step-up authentication service, a second access token,
wherein the second access token is active for a predefined timeframe;
in response to receiving the second access token, authorize, by the authentication service, the transaction by releasing the second access token;
receive a second request to authorize a second transaction requested by the user; and
authorize the transaction using the second access token when the second transaction is requested within the predefined timeframe,
wherein a third access token is generated and exchanged with the second access token.
8. The non-transitory computer-readable storage medium of claim 7 , wherein the client application is a first channel, wherein the authentication request is sent to the user via a second channel that is different from the first channel.
9. The non-transitory computer-readable storage medium of claim 8 , wherein the second channel is one of: a text message, an email message, or a push notification.
10. The non-transitory computer-readable storage medium of claim 7 , wherein the second request is received from a second client application that is different from the client application.
11. The non-transitory computer-readable storage medium of claim 7 , wherein the first access token is active for longer than the predefined timeframe.
12. The non-transitory computer-readable storage medium of claim 7 , wherein step-up authentication is required based on at least one of: an amount of funds involved with the transaction, an identity of the user, an identity of the client application, or a device used to request the transaction.
13. An authentication platform, comprising:
one or more processors; and
a computer readable storage medium having instructions stored thereon, which when executed by the one or more processors cause the authentication platform to:
receive, from a client application, a request to authorize a transaction requested by a user of the client application,
wherein the request includes a first access token;
validate, by an authentication service, the first access token;
determine, by the authentication service, whether step-up authentication is required to authorize the transaction;
when the step-up authentication is required:
determine, by a step-up authentication service, authentication requirements to authorize the transaction;
send an authentication request to the user;
receive, from the user, a response to the authentication request;
in response to verifying credentials in the response to the authentication request, generate, by the step-up authentication service, a second access token, wherein the second access token is active for a predefined timeframe; and
in response to receiving the second access token, authorize, by the authentication service, the transaction by releasing the second access token;
receive a second request to authorize a second transaction requested by the user; and
authorize the transaction using the second access token when the second transaction is requested within the predefined timeframe,
wherein a third access token is generated and exchanged with the second access token.
14. The authentication platform of claim 13 , wherein the client application is a first channel, wherein the authentication request is sent to the user via one of: a text message, an email message, or a push notification.