Preemptive authorization automation

• US 10,212,588 B2
• Filed: 09/09/2015
• Issued: 02/19/2019
• Est. Priority Date: 10/25/2011
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Grim, Evan Tyler, Alexander, Josh
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): Gyorfi, Thomas A
• Application Number:
  US14/849,352
• Publication Number:
  US 20150382195A1
• Time in Patent Office: 1,259 Days
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/30 Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/64 using geofenced areas
• CPC Class Codes: H04W 12/68 Gesture-dependent or behaviour-dependent

Abstract

Techniques are disclosed relating to automating permission requests, e.g., in the context of multi-factor authentication. In some embodiments, based on a change in one or more automation criteria (e.g., based on a mobile device entering a particular geographic region) a mobile device is configured to preemptively indicate to an authorization system to automatically authorize a subsequent attempt to perform an action, without transmitting the permission request to the mobile device. The mobile device may later revoke the preemptive permission request, e.g., based on another change in automation criteria. Disclosed techniques may increase authorization security while reducing user interaction for multi-factor authentication, in some embodiments.

Claims

1. A non-transitory computer-readable medium having computer instructions stored thereon that are capable of causing a mobile device to perform operations comprising:

storing one or more automation criteria for an action;

receiving a first permission request from an authorization system, wherein the first permission request is generated by the authorization system as a factor in a multi-factor authentication process initiated in response to an attempt, by another device external to the mobile device, to perform the action;

transmitting a response to the first permission request, wherein the response grants or denies the first permission request;

detecting a change in automation state corresponding to the one or more automation criteria for the mobile device; and

in response to the detecting, preemptively indicating to the authorization system to automatically grant or deny a subsequent attempt by another device external to the mobile device to perform the action without communicating with the mobile device as a factor for a multi-factor authentication process initiated in response to the subsequent attempt.

2. The non-transitory computer-readable medium of claim 1, wherein at least one of the one or more automation criteria corresponds to a location of the mobile device and wherein detecting is based on signals received from one or more of:

a satellite navigation system, one or more cellular base stations, or one or more wireless access points.

3. The non-transitory computer-readable medium of claim 1, wherein the operations further comprise:

in response to detecting the change in the one or more automation criteria, transmitting information to the authorization system indicating that the authorization system should transmit permission requests to the mobile device for future attempts to perform the action.

4. The non-transitory computer-readable medium of claim 1, wherein the operations further comprise:

in response to detecting the change in the one or more automation criteria, transmitting information to the authorization system that specifies to end an authenticated session for a user of the mobile device.

5. The non-transitory computer-readable medium of claim 1, wherein the action is a login.

6. The non-transitory computer-readable medium of claim 1, wherein the authorization system is configured to cancel the preemptive indicating in response to determining that the mobile device is not in communication with the authorization system.

7. The non-transitory computer-readable medium of claim 1, wherein the operations further comprise sending periodic preemptive indications while the device remains in a particular automation state.

8. The non-transitory computer-readable medium of claim 1, wherein an automation state associated with the change in the one or more automation criteria is associated with one or more previous approval permission responses for the action.

9. The non-transitory computer-readable medium of claim 8, wherein the operations further comprise receiving user input indicating to automate permission responses corresponding to the action when the mobile device is in the automation state.

10. A mobile device, comprising:

at least one antenna;

one or more wireless radios coupled to the at least one antenna;

location circuitry configured to determine a location of the mobile device;

one or more processors; and

one or more memories having program instructions stored thereon that are capable of causing the mobile device to;

store one or more automation criteria for an action;

receive a first permission request from an authorization system, wherein the first permission request is generated by the authorization system as a factor in a multi-factor authentication process initiated in response to an attempt, by another device, to perform the action;

transmit a response to the first permission request, wherein the response grants or denies the first permission request;

detect a change in automation state corresponding to the one or more automation criteria for the mobile device; and

in response to detecting the change, preemptively indicate to the authorization system to automatically grant or deny a subsequent attempt by another device to perform the action without communicating with the mobile device as a factor for a multi-factor authentication process initiated in response to the subsequent attempt.

11. The mobile device of claim 10, wherein the program instructions are further capable of causing the mobile device to:

send periodic preemptive indications while the device remains in an automation state associated with the change in the one or more automation criteria.

12. The mobile device of claim 10, wherein the automation state is associated with one or more previous approval permission responses for the action.

13. The mobile device of claim 10, wherein the program instructions are further capable of causing the mobile device to:

receive user input indicating to automate permission responses corresponding to the action when the mobile device is in the automation state.

14. A method, comprising:

storing, by a computer system, an indication to operate in a first mode with respect to a mobile device associated with a user, wherein, in the first mode, the computer system forwards permission requests, generated as a factor in a multi-factor authentication process in response to attempts, by other devices, to perform an action for the user, to the mobile device for authorization that grants or denies the permission requests;

receiving, at the computer system from the mobile device, an indication to change from operating in the first mode to operating in a second mode with respect to the mobile device, wherein, in the second mode, the computer system automatically grants or denies permission requests to perform the action for the user;

receiving, by the computer system, in the second mode, a particular permission request that is generated in response to a subsequent attempt, by another device, to perform the action for the user; and

responding, by the computing system, to the particular permission request without communicating with the mobile device as a factor for a multi-factor authentication process initiated in response to the subsequent attempt, wherein the responding grants or denies the subsequent attempt.

15. The method of claim 14, further comprising:

transitioning from the second mode to the first mode in response to an absence of communication from the mobile device over a threshold time interval.

16. The method of claim 14, further comprising:

transitioning from the second mode to the first mode in response to an indication from the mobile device; and

forwarding, in the first mode and subsequent to the transitioning, one or more additional permission requests to the mobile device for authorization.

17. The method of claim 14, wherein indication to change from operation in the first mode to operating in the second mode is based on a change in geographic location of the mobile device.

18. The method of claim 14, further comprising:

ending an authenticated communication session associated with the mobile device based on an indication from the mobile device, wherein the indication is received based on a change in geographic location of the mobile device.

19. The method of claim 14, wherein the action is a login.

20. The method of claim 14, further comprising:

authenticating the indication from the mobile device based on hardware identification information from the mobile device.