SECONDARY DEVICE AS KEY FOR AUTHORIZING ACCESS TO RESOURCES

• US 20140282846A1
• Filed: 11/19/2013
• Published: 09/18/2014
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: Omnissa, LLC
• Original Assignee: Skysocket LLC
• Inventors: DeWeese, William, Stuntebeck, Erich
• Granted Patent: US 9,401,915 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications

Abstract

A secondary device may be used to provide access to resources to a primary device. Upon receiving an authorization indication at a device, a registration key based on the authorization indication, a user identifier, and a property of the device may be created. Upon determining whether access to at least one resource is permitted according to the registration key the device may be permitted to access the at least one resource.

Claims

1. A method comprising:

receiving an authorization indication at a device;

creating a registration key based on the authorization indication, a user identifier, and a property of the device;

determining whether access to at least one resource is permitted according to the registration key; and

in response to determining that access to the at least one resource is permitted according to the registration key, permitting the device to access the at least one resource.

2. The method of claim 1, wherein the authorization indication is received in response to a user-initiated action.

3. The method of claim 1, wherein the authorization indication is received from a second device operative to transmit the authorization indication.

4. The method of claim 1, further comprising:

receiving the authorization indication in response to determining that a compliance rule associated with the authorization indication has been satisfied.

5. The method of claim 1, wherein determining whether access to the at least one resource is permitted according to the registration key comprises:

retrieving an identifier associated with the at least one resource;

submitting the registration key and the identifier associated with the at least one resource to a verification service; and

determining whether an access key for the at least one resource has been received from the verification service.

6. The method of claim 1, wherein the authorization indication comprises a unique identifier associated with the device.

7. The method of claim 1, wherein the registration key is associated with a plurality of compliance rules.

8. The method of claim 7, wherein at least one of the plurality of compliance rules comprises a required proximity between the device and at least one second device.

9. The method of claim 7, wherein at least one of the plurality of compliance rules comprises an expiration time for the registration key.

10. The method of claim 1, further comprising:

displaying an indication on a user interface of the device associated with the registration key.

11. An apparatus comprising:

a memory storage; and

a processor coupled to the memory storage operative to execute instructions for;

providing an authorization indication to a user device,

receiving a registration key from the user device,

creating a profile for the user device according to the registration key,

associating a plurality of compliance rules with the profile for the user device,

receiving a request to access a resource from the user device,

determining whether the user device is in compliance with the plurality of compliance rules, and

in response to determining that the user device is in compliance with the plurality of compliance rules, providing access to the resource to the user device.

12. The apparatus of claim 11, wherein the processor is further operative to execute instructions for:

detecting an arrival of the user device within a geographic location served by the apparatus; and

providing the authorization indication to the user device automatically.

13. The apparatus of claim 11, wherein the processor is further operative to execute instructions for:

receiving a request from the user device; and

providing the authorization indication to the user device in response to the request.

14. The apparatus of claim 11, wherein the processor is further operative to execute instructions for:

providing at least one restriction on the resource to the user device.

15. A client device comprising:

a network connectivity interface for enabling communication between the client device and an authorization service via a network;

a memory for storing a client side application; and

a processor communicatively coupled to the memory for executing said client side application, wherein said client side application comprises executable instructions for;

receiving an authorization indication associated with a geographic location from a second device located within the geographic region,

creating a registration key based on the authorization indication, a user identifier, and a property of the client device,

providing the registration key to the second device,

determining whether the second device approved the registration key, and

in response to determining that the second device approved the registration key, requesting access to at least one resource.

16. The client device of claim 15, wherein determining whether the second device approved the registration key comprises determining whether the second device provided an access credential to the client device.

17. The client device of claim 16, wherein requesting access to the at least one resource comprises providing the access credential to an authorization service associated with the at least one resource.

18. The client device of claim 16, wherein the access credential comprises at least one compliance restriction.

19. The client device of claim 15, wherein the authorization indication is received as a broadcast signal from the second device.

20. The client device of claim 15, wherein the property of the client device comprises a unique identifier associated with the client device.