PREEMPTIVE AUTHORIZATION AUTOMATION

• US 20150382195A1
• Filed: 09/09/2015
• Published: 12/31/2015
• Est. Priority Date: 10/25/2011
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Grim, Evan Tyler, Alexander, Josh
• Granted Patent: US 10,212,588 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/30 Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/64 using geofenced areas
• CPC Class Codes: H04W 12/68 Gesture-dependent or behaviour-dependent

Abstract

Techniques are disclosed relating to automating permission requests, e.g., in the context of multi-factor authentication. In some embodiments, based on a change in one or more automation criteria (e.g., based on a mobile device entering a particular geographic region) a mobile device is configured to preemptively indicate to an authorization system to automatically authorize a subsequent attempt to perform an action, without transmitting the permission request to the mobile device. The mobile device may later revoke the preemptive permission request, e.g., based on another change in automation criteria. Disclosed techniques may increase authorization security while reducing user interaction for multi-factor authentication, in some embodiments.

Claims

1. A non-transitory computer-readable medium having computer instructions stored thereon that are capable of causing a mobile device to perform operations comprising:

receiving a first permission request from an authorization system, wherein the first permission request is to perform an action;

transmitting a response to the first permission request;

detecting a change in one or more automation criteria for the mobile device; and

in response to the detecting, preemptively indicating to the authorization system to automatically authorize a subsequent attempt to perform the action without transmitting a permission request for the action to the mobile device.

2. The non-transitory computer-readable medium of claim 1, wherein at least one of the one or more automation criteria corresponds to a location of the mobile device and wherein detecting is based on signals received from one or more of:

a satellite navigation system, one or more cellular base stations, or one or more wireless access points.

3. The non-transitory computer-readable medium of claim 1, wherein the operations further comprise:

in response to detecting the change in the one or more automation criteria, transmitting information to the authorization system indicating that the authorization system should transmit permission requests for future attempts to perform the action.

4. The non-transitory computer-readable medium of claim 1, wherein the operations further comprise:

in response to detecting the change in the one or more automation criteria, transmitting information to the authorization system that specifies to end an authenticated session for a user of the mobile device.

5. The non-transitory computer-readable medium of claim 1, wherein the action is a login.

6. The non-transitory computer-readable medium of claim 1, wherein the authorization system is configured to cancel the preemptive indication response in response to determining that the mobile device is not in communication with the authorization system.

7. The non-transitory computer-readable medium of claim 1, wherein the operations further comprise sending periodic preemptive indications while the device remains in a particular automation state.

8. The non-transitory computer-readable medium of claim 1, wherein an automation state associated with the change in the one or more automation criteria is associated with one or more previous approval permission responses for the action.

9. The non-transitory computer-readable medium of claim 8, wherein the operations further comprise receiving user input indicating to automate permission responses corresponding to the action when the mobile device is in the automation state.

10. A mobile device, comprising:

at least one antenna;

one or more wireless radios coupled to the at least one antenna;

location circuitry configured to determine a location of the mobile device;

one or more processors; and

one or more memories having program instructions stored thereon that are capable of causing the mobile device to;

receive a first permission request from an authorization system, wherein the first permission request is to perform an action;

transmit a response to the first permission request;

detect a change in one or more automation criteria for the mobile device; and

in response to detecting the change, preemptively indicating to the authorization system to automatically authorize a subsequent attempt to perform the action without transmitting a permission request for the action to the mobile device.

11. The mobile device of claim 10, wherein the program instructions are further capable of causing the mobile device to:

send periodic preemptive indications while the device remains in an automation state associated with the change in the one or more automation criteria.

12. The mobile device of claim 11, wherein the automation state is associated with one or more previous approval permission responses for the action.

13. The mobile device of claim 11, wherein the program instructions are further capable of causing the mobile device to:

receive user input indicating to automate permission responses corresponding to the action when the mobile device is in the automation state.

14. A method, comprising:

storing, by a computer system, an indication to operate in a first mode with respect to a mobile device associated with a user, wherein, in the first mode, the computer system forwards, to the mobile device for authorization, permission requests for the user to perform an action;

receiving, at the computer system from the mobile device, an indication to change from operating in the first mode to operating in a second mode with respect to the mobile device, wherein, in the second mode, the computer system automatically responds to permission requests for the user to perform the action;

receiving, by the computer system, in the second mode, a particular permission request for the user to perform the action; and

responding, by the computing system, to the particular permission request without forwarding the particular permission request to the mobile device for authorization.

15. The method of claim 14, further comprising:

transitioning from the second mode to the first mode in response to an absence of communication from the mobile device over a threshold time interval.

16. The method of claim 14, further comprising:

transitioning from the second mode to the first mode in response to an indication from the mobile device; and

forwarding, in the first mode of and subsequent to the transitioning, one or more additional permission requests to a mobile device for authorization.

17. The method of claim 14, wherein indication to change from operation in the first mode to operating in the second mode is based on a change in geographic location of the mobile device.

18. The method of claim 14, further comprising:

ending an authenticated communication session associated with the mobile device based on an indication from the mobile device, wherein the indication is received based on a change in geographic location of the mobile device.

19. The method of claim 14, wherein the action is a login.

20. The method of claim 14, further comprising:

authenticating the indication from the mobile device based on hardware identification information from the mobile device.