Authorization flow initiation using short-range wireless communication

• US 10,110,598 B2
• Filed: 11/20/2017
• Issued: 10/23/2018
• Est. Priority Date: 02/05/2013
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google LLC (Alphabet Inc.)
• Inventors: Vongsouvanh, Alain, Cherubino, Claudio
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): Chao, Michael W
• Application Number:
  US15/817,923
• Publication Number:
  US 20180077140A1
• Time in Patent Office: 337 Days
• Field of Search: None
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol

Abstract

In general, aspects of the disclosure are directed towards techniques for initiating an authorization flow with a user to enable a user interface-limited client computing device to obtain access to protected resources hosted by a resource service. In some aspects, a computing device comprises at least one processor. The computing device also comprises a short-range wireless communication module operable by the at least one processor to receive, using short-range wireless communication, an authentication request from a client device. The computing device also comprises an authorization module operable by the at least one processor to receive authorization to provide at least one security credential to the client device, wherein the authorization module is further configured to, responsive to receiving the authorization, send an indication of the authorization to an authentication service.

Claims

1. A method comprising:

executing, by a computing device including a display, an application provided by an entity that also provides a client device;

receiving, by the computing device and via the application, a request to permit the client device to access a digital music service;

receiving, by the computing device, a uniform resource identifier for an authorization service of the digital music service;

responsive to receiving the uniform resource identifier for the authorization service of the digital music service, displaying via the display a webpage identified by the uniform resource identifier associated with the authorization service, the webpage including a request for a username and password for a user account at the digital music service that hosts digital music;

receiving, by the computing device, the username and password for the digital music service;

sending, by the computing device, the username and password for the digital music service to the authorization service of the digital music service;

responsive to sending the username and password for the digital music service, receiving, by the computing device and from the authorization service, at least one access token that provides access to the digital music hosted by the digital music service;

sending, by the computing device and to the client device via a network connection between the computing device and the client device, the at least one access token, wherein the client device does not provide a user interface enabling a user to directly enter the username and password for the music service at the client device, or rendering and input capabilities associated with a web browser;

sending, by the client device and to the digital music service, the at least one access token as part of an invocation of an application programming interface hosted by the digital music service; and

responsive to sending the at least one access token to the digital music service, receiving, by the client device and from the digital music service, access to the digital music hosted by the digital music service.

2. The method of claim 1, wherein:

the digital music includes a subset of a plurality of protected resources hosted by the digital music service, and

the at least one access token specifies a duration for which access to the digital music is granted and identifies the subset of the plurality of protected resources to which the client device is granted access.

3. The method of claim 1, further comprising:

after receiving access to the protected resource, receiving, by the client device, at least a portion of the digital music hosted by the digital music service.

4. The method of claim 1, wherein the access token is a token the enables the client device to access to the digital music without requiring further resource owner credentials.

5. The method of claim 1, wherein the access token is a token that includes a string of data and a cryptographic signature.

6. The method of claim 1, further comprising, after sending the access token to the digital music service:

receiving, by the client device and from the authorization service, a refresh token, wherein the refresh token modifies the access to the digital music enabled by the access token.

7. The method of claim 1, further comprising:

revoking access to the digital music by the client device.

8. The method of claim 1, further comprising:

displaying, by the computing device and via the application, an option to delete the access token.

9. The method of claim 1, further comprising:

sending, by the client device and to the digital music service, a refresh token;

responsive to sending the refresh token, receiving, by the client device and from the digital music service, a second access token to replace the at least one access token when the at least one access token has expired;

sending, by the client device and to the digital music service, the second access token as part of an invocation of the application programming interface hosted by the digital music service; and

responsive to sending the second access token to the digital music service, receiving, by the client device and from the digital music service, access to the digital music hosted by the digital music service.

10. A system comprising:

a client device; and

a computing device comprising;

at least one processor;

a communication unit;

a display device; and

a storage device that stores one or more modules and an application provided by an entity that also provides the client device, wherein the application is executable by the at least one processor of the computing device and the one or more modules are executable by the at least one processor of the computing device to;

receive, via the application, a request to permit the client device to access a digital music service;

receive a uniform resource identifier for an authorization service of the digital music service;

responsive to receiving the uniform resource identifier for the authorization service of the digital music service, output, for display at the display device, a request for username and password for a user account at the digital music service that hosts digital music;

receive the username and password for the digital music service;

send, via the communication unit, the username and password for the digital music service to the authorization service of the digital music service;

responsive to sending the username and password for the digital music service, receive, from the authorization service and via the communication unit, at least one access token that provides access to the digital music hosted by the digital music service; and

send, to a client device via the communication unit, the at least one access token, wherein the client device does not provide a user interface enabling a user to directly enter the username and password for the music service at the client device, or rendering and input capabilities associated with a web browser,

wherein the client device comprises;

at least one processor;

a communication unit; and

a storage device that stores one or more modules executable by the at least one processor of the client device to;

send, to the digital music service via the communication unit, the at least one access token as part of an invocation of an application programming interface hosted by the digital music service; and

responsive to sending the at least one access token to the digital music service, receive, from the digital music service and via the communication unit, access to the digital music hosted by the digital music service.

11. The system of claim 10, wherein:

the digital music includes a subset of a plurality of protected resources hosted by the digital music service, and

the at least one access token specifies a duration for which access to the digital music is granted and identifies the subset of the plurality of protected resources to which the client device is granted access.

12. The system of claim 10,

wherein the one or more modules of the client device are further operable by the at least one processor of the client device to access at least a portion of the digital music hosted by the digital music service.

13. The system of claim 10, wherein the access token is a token the enables the client device to access to the digital music without requiring further resource owner credentials.

14. The system of claim 10, wherein the access token is a token that includes a string of data and a cryptographic signature.

15. The system of claim 10, wherein the one or more modules of the client device are further operable by the at least one processor of the client device to:

after sending the access token to the digital music service, receive, from the authorization service, a refresh token, wherein the refresh token modifies the access to the digital music enabled by the access token.

16. The computing system of claim 10, wherein the one or more modules stored at the storage device of the computing device are further executable by the at least one processor of the computing device to:

output, for display by the display device and via the application, an option to delete the access token.

17. The computing system of claim 10, wherein the one or more modules stored at the storage device of the client device are further executable by the at least one processor of the client device to

send, to the digital music service, a refresh token;

responsive to sending the refresh token, receive, from the digital music service, a second access token to replace the at least one access token when the at least one access token has expired;

send, to the digital music service, the second access token as part of an invocation of the application programming interface hosted by the digital music service; and

responsive to sending the second access token to the digital music service, receive, from the digital music service, access to the digital music hosted by the digital music service.