Providing credential information

• US 10,021,083 B1
• Filed: 10/08/2015
• Issued: 07/10/2018
• Est. Priority Date: 11/30/2012
• Status: Active Grant

• Current Assignee: Microstrategy Incorporated
• Original Assignee: Microstrategy Incorporated
• Inventors: Saylor, Michael J., Vazquez, Hector, Chen, Gang
• Primary Examiner(s): Hoffman, Brandon S
• Assistant Examiner(s): Salehi, Helai
• Application Number:
  US14/878,365
• Time in Patent Office: 1,006 Days
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 4/023 using mutual or relative location information between multiple location based services [LBS] targets or of distance thresholds

Abstract

A server system maintains data indicative of credentials held by multiple different users. Each of the credentials has been issued by a credential granting authority that is separate from an entity that operates the server system. The server system receives selection data that indicates how credential data of a first user is to be made available to other users. Based on the selection data, the server system stores availability data that indicates how credential data of the first user is to be made available to the other users. The server system also maintains a location of a mobile computing device associated with the first user and, based on the availability data and the location, provides, to at least a second user, information about at least one credential held by the first user in association with an indication of the location.

Claims

1. A computer-implemented method comprising:

maintaining, by a server system, data indicative of electronic credentials held by multiple different users;

receiving, by the server system, selection data that indicates how credential data of a first user included in the multiple different users is to be made available to other users included in the multiple different users and that indicates a location of a mobile device associated with the first user included in the multiple different user identities where the mobile device associated with the first user included in the multiple different user identities is to be located to make available the credential data to the other users included in the multiple different users;

based on the selection data, storing, by the server system, availability data that indicates how credential data of the first user included in the multiple different users is to be made available to the other users included in the multiple different users and that indicates the location of the mobile device associated with the first user included in the multiple different user identities where the mobile device associated with the first user is to be located to make available the credential data to the other users included in the multiple different users;

maintaining, by the server system, a current location of the mobile computing device associated with the first user;

determining that the current location of the mobile device associated with the first user corresponds to the location of the mobile device associated with the first user included in the multiple different user identities where the mobile device associated with the first user is to be located to make available the credential data to the other users included in the multiple different users; and

based on the availability data and on determining that the current location of the mobile device associated with the first user corresponds to the location of the mobile device associated with the first user included in the multiple different user identities where the mobile device associated with the first user is to be located to make available the credential data to the other users included in the multiple different users the location of the mobile computing device associated with the first user, providing, to at least a second user included in the multiple different users, information about at least one credential held by the first user in association with an indication of the current location of the mobile computing device associated with the first user.

2. The method of claim 1, wherein:

receiving selection data comprises receiving user permissions that define users to which the credential data of the first user is available,

storing availability data comprises, based on the user permissions, storing availability data that indicates the users to which the credential data of the first user is available, and

providing information about at least one credential held by the first user in association with an indication of the location of the mobile computing device associated with the first user comprises;

determining, based on the availability data that indicates the users to which the credential data of the first user is available, that the second user is one of the users to which the credential data of the first user is available; and

based on the determination that the second user is one of the users to which the credential data of the first user is available, providing, to the second user, information about at least one credential held by the first user in association with an indication of the current location of the mobile computing device associated with the first user.

3. The method of claim 1, wherein:

receiving selection data comprises receiving destination data that defines one or more locations where the credential data of the first user is available,

storing availability data comprises, based on the destination data, storing availability data that indicates the one or more locations where the credential data of the first user is available, and

providing information about at least one credential held by the first user in association with an indication of the current location of the mobile computing device associated with the first user comprises;

determining a location of the second user;

comparing the location of the second user to the one or more locations where the credential data of the first user is available;

determining, based on the comparison, that the location of the second user corresponds to the one or more locations where the credential data of the first user is available; and

based on the determination that the location of the second user corresponds to the one or more locations where the credential data of the first user is available, providing, to the second user, information about at least one credential held by the first user in association with an indication of the current location of the mobile computing device associated with the first user.

4. The method of claim 1, wherein:

receiving selection data comprises receiving timing data that defines times at which the credential data of the first user is available,

storing availability data comprises, based on the timing data, storing availability data that indicates the times at which the credential data of the first user is available, and

providing information about at least one credential held by the first user in association with an indication of the current location of the mobile computing device associated with the first user comprises;

determining a time when credential data of the first user is requested by the second user;

comparing the time when credential data of the first user is requested by the second user to the times at which the credential data of the first user is available;

determining, based on the comparison, that the time when credential data of the first user is requested by the second user corresponds to the times at which the credential data of the first user is available; and

based on the determination that the time when credential data of the first user is requested by the second user corresponds to the times at which the credential data of the first user is available, providing, to the second user, information about at least one credential held by the first user in association with an indication of the current location of the mobile computing device associated with the first user.

5. The method of claim 1, wherein:

receiving selection data comprises receiving a triggering condition that defines an event that triggers availability of the credential data of the first user;

storing availability data comprises, based on the triggering condition, storing availability data that indicates the event that triggers availability of the credential data of the first user; and

providing information about at least one credential held by the first user in association with an indication of the current location of the mobile computing device associated with the first user comprises;

detecting the event that triggers availability of the credential data of the first user; and

based on the detection of the event that triggers availability of the credential data of the first user, providing, to the second user, information about at least one credential held by the first user in association with an indication of the current location of the mobile computing device associated with the first user.

6. The method of claim 1, wherein maintaining a current location of a mobile computing device associated with the first user comprises:

periodically receiving, from the mobile computing device associated with the first user, an indication of a current location of the mobile computing device associated with the first user; and

storing the received indication of the current location of the mobile computing device associated with the first user.

7. The method of claim 1, wherein maintaining a current location of a mobile computing device associated with the first user comprises:

periodically requesting, from the mobile computing device associated with the first user, an indication of a current location of the mobile computing device associated with the first user;

receiving, responsive to a request, an indication of a current location of the mobile computing device associated with the first user, and

storing the received indication of the current location of the mobile computing device associated with the first user.

8. The method of claim 1, wherein maintaining data indicative of credentials held by multiple different users comprises:

receiving, from the first user, a first request to add a first type of credential to an account of the first user on the server system, the first type of credential being granted by a first credential granting authority;

based on the first request to add the first type of credential to the account of the first user on the server system, verifying with the first credential granting authority that the first credential granting authority has granted the first type of credential to the first user; and

based on verifying with the first credential granting authority that the first credential granting authority has granted the first type of credential to the first user, adding the first type of credential to the account of the first user and enabling the first user to make the first type of credential available to other users.

9. The method of claim 1, wherein maintaining data indicative of credentials held by multiple different users comprises:

receiving, from the first user, a second request to add a second type of credential to the account of the first user on the server system, the second type of credential being granted by a second credential granting authority, the second type of credential being different than the first type of credential, and the second credential granting authority being different from the first credential granting authority;

based on the second request to add the second type of credential to the account of the first user on the server system, verifying with the second credential granting authority that the second credential granting authority has not granted the second type of credential to the first user; and

based on verifying with the second credential granting authority that the second credential granting authority has not granted the second type of credential to the first user, denying the second request to add the second type of credential to the account of the first user and stopping the first user from making the second type of credential available to other users.

10. A system comprising:

one or more computers and one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising;

maintaining, by a server system, data indicative of electronic credentials held by multiple different users;

receiving, by the server system, selection data that indicates how credential data of a first user included in the multiple different users is to be made available to other users included in the multiple different users and that indicates a location of a mobile device associated with the first user included in the multiple different user identities where the mobile device associated with the first user included in the multiple different user identities is to be located to make available the credential data to the other users included in the multiple different users;

based on the selection data, storing, by the server system, availability data that indicates how credential data of the first user included in the multiple different users is to be made available to the other users included in the multiple different users and that indicates the location of the mobile device associated with the first user included in the multiple different user identities where the mobile device associated with the first user is to be located to make available the credential data to the other users included in the multiple different users;

maintaining, by the server system, a current location of the mobile computing device associated with the first user;

determining that the current location of the mobile device associated with the first user corresponds to the location of the mobile device associated with the first user included in the multiple different user identities where the mobile device associated with the first user is to be located to make available the credential data to the other users included in the multiple different users; and

based on the availability data and on determining that the current location of the mobile device associated with the first user corresponds to the location of the mobile device associated with the first user included in the multiple different user identities where the mobile device associated with the first user is to be located to make available the credential data to the other users included in the multiple different users the location of the mobile computing device associated with the first user, providing, to at least a second user included in the multiple different users, information about at least one credential held by the first user in association with an indication of the current location of the mobile computing device associated with the first user.

11. The system of claim 10, wherein:

receiving selection data comprises receiving user permissions that define users to which the credential data of the first user is available,

storing availability data comprises, based on the user permissions, storing availability data that indicates the users to which the credential data of the first user is available, and

providing information about at least one credential held by the first user in association with an indication of the location of the mobile computing device associated with the first user comprises;

determining, based on the availability data that indicates the users to which the credential data of the first user is available, that the second user is one of the users to which the credential data of the first user is available; and

based on the determination that the second user is one of the users to which the credential data of the first user is available, providing, to the second user, information about at least one credential held by the first user in association with an indication of the current location of the mobile computing device associated with the first user.

12. The system of claim 10, wherein:

receiving selection data comprises receiving destination data that defines one or more locations where the credential data of the first user is available,

storing availability data comprises, based on the destination data, storing availability data that indicates the one or more locations where the credential data of the first user is available, and

providing information about at least one credential held by the first user in association with an indication of the current location of the mobile computing device associated with the first user comprises;

determining a location of the second user;

comparing the location of the second user to the one or more locations where the credential data of the first user is available;

determining, based on the comparison, that the location of the second user corresponds to the one or more locations where the credential data of the first user is available; and

based on the determination that the location of the second user corresponds to the one or more locations where the credential data of the first user is available, providing, to the second user, information about at least one credential held by the first user in association with an indication of the current location of the mobile computing device associated with the first user.

13. The system of claim 10, wherein:

receiving selection data comprises receiving timing data that defines times at which the credential data of the first user is available,

storing availability data comprises, based on the timing data, storing availability data that indicates the times at which the credential data of the first user is available, and

providing information about at least one credential held by the first user in association with an indication of the current location of the mobile computing device associated with the first user comprises;

determining a time when credential data of the first user is requested by the second user;

comparing the time when credential data of the first user is requested by the second user to the times at which the credential data of the first user is available;

determining, based on the comparison, that the time when credential data of the first user is requested by the second user corresponds to the times at which the credential data of the first user is available; and

based on the determination that the time when credential data of the first user is requested by the second user corresponds to the times at which the credential data of the first user is available, providing, to the second user, information about at least one credential held by the first user in association with an indication of the current location of the mobile computing device associated with the first user.

14. The system of claim 10, wherein:

receiving selection data comprises receiving a triggering condition that defines an event that triggers availability of the credential data of the first user;

storing availability data comprises, based on the triggering condition, storing availability data that indicates the event that triggers availability of the credential data of the first user; and

providing information about at least one credential held by the first user in association with an indication of the current location of the mobile computing device associated with the first user comprises;

detecting the event that triggers availability of the credential data of the first user; and

based on the detection of the event that triggers availability of the credential data of the first user, providing, to the second user, information about at least one credential held by the first user in association with an indication of the current location of the mobile computing device associated with the first user.

15. The system of claim 10, wherein maintaining a current location of a mobile computing device associated with the first user comprises:

periodically receiving, from the mobile computing device associated with the first user, an indication of a current location of the mobile computing device associated with the first user; and

storing the received indication of the current location of the mobile computing device associated with the first user.

16. The system of claim 10, wherein maintaining a current location of a mobile computing device associated with the first user comprises:

periodically requesting, from the mobile computing device associated with the first user, an indication of a current location of the mobile computing device associated with the first user;

receiving, responsive to a request, an indication of a current location of the mobile computing device associated with the first user, and

storing the received indication of the current location of the mobile computing device associated with the first user.

17. The system of claim 10, wherein maintaining data indicative of credentials held by multiple different users comprises:

receiving, from the first user, a first request to add a first type of credential to an account of the first user on the server system, the first type of credential being granted by a first credential granting authority;

based on the first request to add the first type of credential to the account of the first user on the server system, verifying with the first credential granting authority that the first credential granting authority has granted the first type of credential to the first user; and

based on verifying with the first credential granting authority that the first credential granting authority has granted the first type of credential to the first user, adding the first type of credential to the account of the first user and enabling the first user to make the first type of credential available to other users.

18. The system of claim 10, wherein maintaining data indicative of credentials held by multiple different users comprises:

receiving, from the first user, a second request to add a second type of credential to the account of the first user on the server system, the second type of credential being granted by a second credential granting authority, the second type of credential being different than the first type of credential, and the second credential granting authority being different from the first credential granting authority;

based on the second request to add the second type of credential to the account of the first user on the server system, verifying with the second credential granting authority that the second credential granting authority has not granted the second type of credential to the first user; and

based on verifying with the second credential granting authority that the second credential granting authority has not granted the second type of credential to the first user, denying the second request to add the second type of credential to the account of the first user and stopping the first user from making the second type of credential available to other users.

19. A non-transitory computer-readable medium storing software comprising instructions executable by one or more computers which, upon such execution, cause the one or more computers to perform operations comprising:

maintaining, by a server system, data indicative of electronic credentials held by multiple different users;

receiving, by the server system, selection data that indicates how credential data of a first user included in the multiple different users is to be made available to other users included in the multiple different users and that indicates a location of a mobile device associated with the first user included in the multiple different user identities where the mobile device associated with the first user included in the multiple different user identities is to be located to make available the credential data to the other users included in the multiple different users;

based on the selection data, storing, by the server system, availability data that indicates how credential data of the first user included in the multiple different users is to be made available to the other users included in the multiple different users and that indicates the location of the mobile device associated with the first user included in the multiple different user identities where the mobile device associated with the first user is to be located to make available the credential data to the other users included in the multiple different users;

maintaining, by the server system, a current location of the mobile computing device associated with the first user;

determining that the current location of the mobile device associated with the first user corresponds to the location of the mobile device associated with the first user included in the multiple different user identities where the mobile device associated with the first user is to be located to make available the credential data to the other users included in the multiple different users; and

based on the availability data and on determining that the current location of the mobile device associated with the first user corresponds to the location of the mobile device associated with the first user included in the multiple different user identities where the mobile device associated with the first user is to be located to make available the credential data to the other users included in the multiple different users the location of the mobile computing device associated with the first user, providing, to at least a second user included in the multiple different users, information about at least one credential held by the first user in association with an indication of the current location of the mobile computing device associated with the first user.

20. The medium of claim 19, wherein:

receiving selection data comprises receiving user permissions that define users to which the credential data of the first user is available,

storing availability data comprises, based on the user permissions, storing availability data that indicates the users to which the credential data of the first user is available, and

providing information about at least one credential held by the first user in association with an indication of the location of the mobile computing device associated with the first user comprises;

determining, based on the availability data that indicates the users to which the credential data of the first user is available, that the second user is one of the users to which the credential data of the first user is available; and

based on the determination that the second user is one of the users to which the credential data of the first user is available, providing, to the second user, information about at least one credential held by the first user in association with an indication of the current location of the mobile computing device associated with the first user.