US 12,413,575 B2
Authenticating and authorizing api calls with multiple factors
Martin Smolny, Boeblingen (DE); and Marco Pavone, Ehningen (DE)
Assigned to INTERNATIONAL BUSINESS MACHINES CORPORATION, Armonk, NY (US)
Filed by INTERNATIONAL BUSINESS MACHINES CORPORATION, Armonk, NY (US)
Filed on Mar. 23, 2022, as Appl. No. 17/701,861.
Prior Publication US 2023/0308432 A1, Sep. 28, 2023
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/083 (2013.01) [H04L 63/102 (2013.01); H04L 63/166 (2013.01); H04L 63/20 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A computer-implemented method for authenticating and authorizing a user identifier to access a service secured by an identity access management system, wherein said service is activated through a service application programming interface that requires a two-factor authorization to initiate execution of said service for said requesting user identifier, wherein said method comprises:
generating, by an identity access management system, a client certificate, wherein said client certificate corresponds to a client device, and wherein said client certificate constitutes first data;
receiving, by one or more processors, a service request together with said first data for a first authentication method and second data for a second authentication method, wherein said service request connects with an application programming interface of said service;
confirming, by the one or more processors, a correctness of said first data as a first identity pass key using said first authentication method;
generating, by the identity access management system, upon confirming the correctness of said first data, an application programming interface key, wherein said application programming interface key constitutes said second data;
confirming, by the one or more processors, a correctness of said second data as a second identity pass key using said second authentication method, wherein a confirmed first identity pass key is included as input to said second authentication method, and wherein said second authentication method differs from said first authentication method; and
executing, by the one or more processors, said service, in response to receipt of said confirmed correctness of both said first identity pass key and said second identity pass key wherein based on a first policy of the first identity pass key and a second policy of the second identity pass key of the identity access management system said first identity pass key and said second identity pass key authorize a first action based on the first policy and a second action based on the second policy of said service.