Time-varying representations of user credentials

• US 10,084,775 B1
• Filed: 05/01/2017
• Issued: 09/25/2018
• Est. Priority Date: 11/30/2012
• Status: Active Grant

• Current Assignee: Microstrategy Incorporated
• Original Assignee: Microstrategy Incorporated
• Inventors: Vazquez, Hector, Chen, Gang, Mironenko, Sergey
• Primary Examiner(s): Zimmerman, Brian
• Assistant Examiner(s): Dorsey, Renee
• Application Number:
  US15/582,892
• Time in Patent Office: 512 Days
• Field of Search: None
• CPC Class Codes: G07B 15/00 Arrangements or apparatus for collecting fares, tolls or entrance fees at one or more control points handling coins or valuable papers, e.g. banknotes, G07D; apparatus for vending or hiring articles or services activated by coins, credit cards, paper currency or the like G07F7/00, G07F17/00
• CPC Class Codes: G07C 9/20 involving the use of a pass
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04W 12/065 Continuous authentication
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/08 Access security

Abstract

Obtaining and/or validating time-varying representations for user credentials at client devices is described.

Claims

1. A method comprising:

receiving, by a server system, a validation request from a processing system associated with a validation entity, the validation request comprising a set of alphanumeric characters, wherein the set of alphanumeric characters were derived from a time-varying representation for a credential, wherein the time-varying representation for the credential comprises at least one from the group consisting of (i) a time-varying optical machine-readable representation for the credential and (ii) a time-varying code rendered as a sound signal, the sound signal having a frequency greater than 20 kHz, the set of alphanumeric characters comprising data corresponding to a key associated with a user, a credential identifier identifying the credential, and a first time by a client device;

determining, by the server system, that the key is associated with the credential identifier;

obtaining, by the server system, a second time from a timing device;

determining, by the server system, that the second time from the timing device is within a predetermined amount of time of the first time by the client device; and

responsive to determining that the key is associated with the credential identifier, and that the second time is within a predetermined amount of time of the first time, communicating, by the server system and to the processing system, a validation response indicating that the credential is validated.

2. The method of claim 1, wherein receiving the validation request from the processing system associated with the validation entity comprises receiving the validation request via SMS from the processing system associated with the validation entity.

3. The method of claim 1, further comprising:

responsive to determining, by the server system, that the key is associated with the credential identifier and that the second time from the timing device is within the predetermined amount of time of the first time by the client device;

obtaining, by the server system, an image of the user; and

transmitting, from the server to the processing system, the image of the user.

4. The method of claim 1, wherein determining, by the server system, that the key is associated with the credential identifier comprises:

querying a database using the credential identifier to obtain a record corresponding to the credential identifier; and

determining that the record includes the key.

5. The method of claim 1, wherein the server is co-located with the processing system associated with the validation entity.

6. The method of claim 1, wherein the time-varying representation for the credential comprises a time-varying optical machine-readable representation for the credential.

7. The method of claim 1, wherein the time-varying representation for the credential comprises a time-varying code rendered as a sound signal, the sound signal having a frequency greater than 20 kHz.

8. The method of claim 1, wherein determining, by the server system, that the second time from the timing device is within a predetermined amount of time of the first time by the client device comprises:

determining, by the server system, that the first time by the client device does not match the second time from the timing device;

adjusting, by the server system, the second time from the timing device by an offset; and

determining, by the server system, that the adjusted second time matches the first time by the client device.

9. The method of claim 1, wherein the credential identifier identifies one of multiple credentials accessible using the client device.

10. The method of claim 1, wherein the credential identifier identifies a credential granted to a group of users that includes the user.

11. The method of claim 1, wherein the credential identifier identifies a credential accessible using any of multiple client devices.

12. A system comprising:

a server system comprising one or more computers; and

one or more computer-readable media storing instructions that, when executed by the one or more computers of the server system, cause the server system to perform operations comprising;

receiving, by the server system, a validation request from a processing system associated with a validation entity, the validation request comprising a set of alphanumeric characters, wherein the set of alphanumeric characters were derived from a time-varying representation for a credential, wherein the time-varying representation for the credential comprises at least one from the group consisting of (i) a time-varying optical machine-readable representation for the credential and (ii) a time-varying code rendered as a sound signal, the sound signal having a frequency greater than 20 kHz, the set of alphanumeric characters comprising data corresponding to a key associated with a user, a credential identifier identifying the credential, and a first time by a client device;

determining, by the server system, that the key is associated with the credential identifier;

obtaining, by the server system, a second time from a timing device;

determining, by the server system, that the second time from the timing device is within a predetermined amount of time of the first time by the client device; and

responsive to determining that the key is associated with the credential identifier, and that the second time is within a predetermined amount of time of the first time, communicating, by the server system and to the processing system, a validation response indicating that the credential is validated.

13. A method comprising:

obtaining, by a processing system associated with a validation entity, a time-varying representation for a credential from a client device of a user, wherein obtaining the time-varying representation comprises at least one from the group consisting of (i) scanning, by the processing system, a time-varying optical machine-readable representation for the credential from the client device and (ii) receiving, at a microphone operatively coupled to the processing system, a sound signal from the client device, the sound signal encoding the time-varying representation for the credential;

decoding, by the processing system, the time-varying representation for the credential to generate a set of alphanumeric characters, wherein the decoding includes decoding at least one from the group consisting of (i) the scanned time-varying optical machine-readable representation to generate the set of alphanumeric characters and (ii) the received sound signal to generate the set of alphanumeric characters, wherein the set of alphanumeric characters comprises data corresponding to;

(i) a key, (ii) a credential identifier, and (iii) a time by the client device, wherein the key is associated with the user, and wherein the credential identifier identifies the credential;

transmitting, from the processing system, a validation request to a server, wherein the validation request includes data corresponding to the key, the credential identifier, and the time; and

receiving a validation response from the server, the validation response indicating that the credential is validated.

14. The method of claim 13, wherein:

obtaining, by a processing system associated with a validation entity, a time-varying representation for a credential from a client device of a user comprises scanning, by a processing system associated with a validation entity, a time-varying optical machine-readable representation for a credential from a client device of a user; and

decoding, by the processing system, the time-varying representation for the credential to generate a set of alphanumeric characters comprises decoding, by the processing system, the scanned time-varying optical machine-readable representation for the credential to generate the set of alphanumeric characters.

15. The method of claim 13, wherein:

obtaining, by a processing system associated with a validation entity, a time-varying representation for a credential from a client device of a user comprises receiving, at a microphone operatively coupled to the processing system associated with a validation entity, a sound signal encoding the set of alphanumeric characters corresponding to the time-varying representation for the credential from a client device of a user; and

decoding, by the processing system, the time-varying representation for the credential to generate a set of alphanumeric characters comprises decoding, by the processing system, the received sound signal to generate a set of alphanumeric characters.

16. The method of claim 13, further comprising:

in response to receiving a validation response from the server;

obtaining, by the processing system, an image of the user; and

outputting, to a display operatively coupled to the processing system, the image of the user.

17. A system comprising:

a processing system associated with a validation entity, the processing system comprising one or more computers; and

one or more computer-readable media storing instructions that, when executed by the one or more computers of the processing system, cause the processing system to perform operations comprising;

obtaining, by the processing system, a time-varying representation for a credential from a client device of a user, wherein obtaining the time-varying representation comprises at least one from the group consisting of (i) scanning, by the processing system, a time-varying optical machine-readable representation for the credential from the client device and (ii) receiving, at a microphone operatively coupled to the processing system, a sound signal from the client device, the sound signal encoding the time-varying representation for the credential;

decoding, by the processing system, the time-varying representation for the credential to generate a set of alphanumeric characters, wherein the decoding includes decoding at least one from the group consisting of (i) the scanned time-varying optical machine-readable representation to generate the set of alphanumeric characters and (ii) the received sound signal to generate the set of alphanumeric characters, wherein the set of alphanumeric characters comprises data corresponding to;

(i) a key, (ii) a credential identifier, and (iii) a time by the client device, wherein the key is associated with the user, and wherein the credential identifier identifies the credential;

transmitting, from the processing system, a validation request to a server, wherein the validation request includes data corresponding to the key, the credential identifier, and the time; and

receiving a validation response from the server, the validation response indicating that the credential is validated.

18. A method comprising:

obtaining, by an electronic device, a key associated with a user of the electronic device;

obtaining, by the electronic device, a credential identifier associated with a credential;

receiving, by the electronic device, a user command to output a representation for the credential, wherein the user command comprises at least one from the group consisting of (i) a user command to display an optical-machine-readable representation for the credential and (ii) a user command to provide a sound signal representing the credential; and

in response to receiving, by the electronic device, the user command to output the representation for the credential;

obtaining, by the electronic device, a time;

generating, by the electronic device, a set of alphanumeric characters based on the credential identifier, the key, and the time;

encoding, by the electronic device, the set of alphanumeric characters to generate a representation for the credential that includes at least one from the group consisting of (i) an optical machine-readable representation representing the set of alphanumeric characters and (ii) a sound signal representing the set of alphanumeric characters; and

outputting, by the electronic device, the representation for the credential in a manner that enables a validation entity to validate the credential, wherein outputting the representation comprises at least one from the group consisting of (i) outputting, to a display of the electronic device, the optical machine-readable representation for the credential and (ii) rendering, at a speaker operatively coupled to the electronic device, the sound signal representing the credential.

19. The method of claim 18, wherein:

encoding, by the electronic device, the set of alphanumeric characters to generate a representation for the credential comprises encoding, by the electronic device, the set of alphanumeric characters to generate an optical-machine readable representation for the credential;

receiving, by the electronic device, a user command to output the representation for the credential comprises receiving, by the electronic device, a user command to display the optical-machine-readable representation for the credential; and

outputting, by the electronic device, the representation for the credential in a manner that enables a validation entity to validate the credential comprises outputting, to a display of the electronic device, the optical machine-readable representation for the credential in a manner that enables a validation entity to validate the credential.

20. The method of claim 18, wherein:

encoding, by the electronic device, the set of alphanumeric characters to generate a representation for the credential comprises encoding, by the electronic device, the set of alphanumeric characters into a sound signal representing the set of alphanumeric characters;

receiving, by the electronic device, a user command to output the representation for the credential comprises receiving, by the electronic device, a user command to render the sound signal representing the credential from a speaker operatively coupled to the electronic device; and

outputting, by the electronic device, the representation for the credential in a manner that enables a validation entity to validate the credential comprises rendering, at a speaker operatively coupled to the electronic device, the sound signal representing the credential.

21. An electronic device comprising:

one or more processors; and

one or more machine-readable storage media storing instructions that, when executed by the one or more processors, cause the electronic device to perform operations comprising;

obtaining, by the electronic device, a key associated with a user of the electronic device;

obtaining, by the electronic device, a credential identifier associated with a credential;

receiving, by the electronic device, a user command to output a representation for the credential, wherein the user command comprises at least one from the group consisting of (i) a user command to display an optical-machine-readable representation for the credential and (ii) a user command to provide a sound signal representing the credential; and

in response to receiving, by the electronic device, the user command to output the representation for the credential;

obtaining, by the electronic device, a time;

generating, by the electronic device, a set of alphanumeric characters based on the credential identifier, the key, and the time;

encoding, by the electronic device, the set of alphanumeric characters to generate a representation for the credential that includes at least one from the group consisting of (i) an optical machine-readable representation representing the set of alphanumeric characters and (ii) a sound signal representing the set of alphanumeric characters; and

outputting, by the electronic device, the representation for the credential in a manner that enables a validation entity to validate the credential, wherein outputting the representation comprises at least one from the group consisting of (i) outputting, to a display of the electronic device, the optical machine-readable representation for the credential and (ii) rendering, at a speaker operatively coupled to the electronic device, the sound signal representing the credential.