CENTRALIZED AUTHENTICATION FOR GRANTING ACCESS TO ONLINE SERVICES

• US 20160352729A1
• Filed: 05/29/2015
• Published: 12/01/2016
• Est. Priority Date: 05/29/2015
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Malik, Dale W.
• Granted Patent: US 9,736,165 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 4/02 Services making use of location information

Abstract

Methods, apparatus, systems and articles of manufacture (e.g., physical storage media) to implement centralized authentication for granting access to online services are disclosed. Example authentication methods disclosed herein include accessing an identification code included in an authentication request received from an online service for authentication information associated with a first device, wherein the identification code was previously assigned to provide valid identification of the first device during a first time interval. Disclosed example authentication methods also include, in response to determining a profile selected based on the identification code permits the online service to access the authentication information, evaluating activity information associated with the first device based on the profile to determine the authentication information. Disclosed example authentication methods further include transmitting the authentication information to the online service.

Claims

1. An authentication method comprising:

accessing, with a processor, an identification code included in an authentication request received from an online service for authentication information associated with a first device, the identification code previously assigned to provide valid identification of the first device during a first time interval;

in response to determining that a profile selected based on the identification code permits the online service to access the authentication information, evaluating, with the processor, activity information associated with the first device based on the profile to determine the authentication information; and

transmitting the authentication information to the online service.

2. The method of claim 1, wherein evaluating the activity information includes:

accessing mobility information specified for the first device in the profile;

determining a location of the first device from the activity information;

providing a first authentication status in the authentication information when the mobility information specifies that the first device is not mobile and the location of the first device corresponds to a location specified in the profile; and

providing a second authentication status in the authentication information when the mobility information specifies that the first device is not mobile and the location of the first device does not correspond to the location specified in the profile.

3. The method of claim 2, wherein the profile specifies that the first device is associated with a first user, and further including:

when the mobility information specifies that the first device is mobile, determining, based on the location of the first device, whether the first device is co-located with a second device associated with the first user;

providing the first authentication status in the authentication information when the mobility information specifies that the first device is mobile and the first device is determined to be co-located with the second device; and

providing the second authentication status in the authentication information when the mobility information specifies that the first device is mobile and the first device is determined to not be co-located with the second device.

4. The method of claim 2, wherein the first authentication status indicates a higher level of authentication certainty than the second authentication status.

5. The method of claim 1, further including:

in response to determining the identification code is valid and a profile associated with the first device permits the online service to access the authentication information, sending an authentication prompt to the device;

receiving an access code from the device in response to the authentication prompt; and

evaluating the activity information associated with the first device and the access code based on the profile to determine the authentication information.

6. The method of claim 1, further including:

receiving an identification code request from a gateway providing network access to the first device prior to receiving the authentication request from the online service;

in response to the identification code request, determining the identification code and transmitting the identification code to the gateway; and

in response to the authentication request, using the identification code to select the profile associated with the first device.

7. The method of claim 1, further including:

receiving profile information associated with the first device from a gateway providing network access to the first device;

storing the profile information in the profile associated with the first device; and

when authorized by the profile information, storing billing information associated with a location of the gateway in the profile associated with the first device.

8. The method of claim 1, further including:

in response to determining the profile associated with the first device does not permit the online service to access the authentication information, sending an authentication response to the online service indicating the online service is not permitted to access the authentication information;

after sending the authentication response, receiving a permission request from the online service requesting permission to access the authentication information; and

in response to the permission request, sending a profile update request to the first device to obtain updated profile information specifying whether the online service is permitted to access the authentication information.

9. A tangible computer readable storage medium comprising computer readable instructions which, when executed, cause a processor to perform operations comprising:

accessing an identification code included in an authentication request received from an online service for authentication information associated with a first device, the identification code previously assigned to provide valid identification of the first device during a first time interval;

in response to determining that a profile selected based on the identification code permits the online service to access the authentication information, evaluating activity information associated with the first device based on the profile to determine the authentication information; and

transmitting the authentication information to the online service.

10. The tangible computer readable storage medium of claim 9, wherein evaluating the activity information includes:

accessing mobility information specified for the first device in the profile;

determining a location of the first device from the activity information;

providing a first authentication status in the authentication information when the mobility information specifies that the first device is not mobile and the location of the first device corresponds to a location specified in the profile; and

providing a second authentication status in the authentication information when the mobility information specifies that the first device is not mobile and the location of the first device does not correspond to the location specified in the profile.

11. The tangible computer readable storage medium of claim 10, wherein the profile specifies that the first device is associated with a first user, and the operations further include:

when the mobility information specifies that the first device is mobile, determining, based on the location of the first device, whether the first device is co-located with a second device associated with the first user;

providing the first authentication status in the authentication information when the mobility information specifies that the first device is mobile and the first device is determined to be co-located with the second device; and

providing the second authentication status in the authentication information when the mobility information specifies that the first device is mobile and the first device is determined to not be co-located with the second device.

12. The tangible computer readable storage medium of claim 9, wherein the operations further include:

in response to determining the identification code is valid and a profile associated with the first device permits the online service to access the authentication information, sending an authentication prompt to the device;

receiving an access code from the device in response to the authentication prompt; and

evaluating the activity information associated with the first device and the access code based on the profile to determine the authentication information.

13. The tangible computer readable storage medium of claim 9, wherein the operations further include:

receiving an identification code request from a gateway providing network access to the first device prior to receiving the authentication request from the online service;

in response to the identification code request, determining the identification code and transmitting the identification code to the gateway; and

in response to the authentication request, using the identification code to select the profile associated with the first device.

14. The tangible computer readable storage medium of claim 9, wherein the operations further include:

in response to determining the profile associated with the first device does not permit the online service to access the authentication information, sending an authentication response to the online service indicating the online service is not permitted to access the authentication information;

after sending the authentication response, receiving a permission request from the online service requesting permission to access the authentication information; and

in response to the permission request, sending a profile update request to the first device to obtain updated profile information specifying whether the online service is permitted to access the authentication information.

15. An apparatus to perform authentication, the apparatus comprising:

a memory including computer machine readable instructions; and

a processor to execute the instructions to perform operations including;

accessing an identification code included in an authentication request received from an online service for authentication information associated with a first device, the identification code previously assigned to provide valid identification of the first device during a first time interval;

in response to determining that a profile selected based on the identification code permits the online service to access the authentication information, evaluating activity information associated with the first device based on the profile to determine the authentication information; and

transmitting the authentication information to the online service.

16. The apparatus of claim 15, wherein evaluating the activity information includes:

accessing mobility information specified for the first device in the profile;

determining a location of the first device from the activity information;

providing a first authentication status in the authentication information when the mobility information specifies that the first device is not mobile and the location of the first device corresponds to a location specified in the profile; and

providing a second authentication status in the authentication information when the mobility information specifies that the first device is not mobile and the location of the first device does not correspond to the location specified in the profile.

17. The apparatus of claim 16, wherein the profile specifies that the first device is associated with a first user, and the operations further include:

when the mobility information specifies that the first device is mobile, determining, based on the location of the first device, whether the first device is co-located with a second device associated with the first user;

providing the first authentication status in the authentication information when the mobility information specifies that the first device is mobile and the first device is determined to be co-located with the second device; and

providing the second authentication status in the authentication information when the mobility information specifies that the first device is mobile and the first device is determined to not be co-located with the second device.

18. The apparatus of claim 15, wherein the operations further include:

in response to determining the identification code is valid and a profile associated with the first device permits the online service to access the authentication information, sending an authentication prompt to the device;

receiving an access code from the device in response to the authentication prompt; and

evaluating the activity information associated with the first device and the access code based on the profile to determine the authentication information.

19. The apparatus of claim 15, wherein the operations further include:

receiving an identification code request from a gateway providing network access to the first device prior to receiving the authentication request from the online service;

in response to the identification code request, determining the identification code and transmitting the identification code to the gateway; and

in response to the authentication request, using the identification code to select the profile associated with the first device.

20. The apparatus of claim 15, wherein the operations further include:

in response to determining the profile associated with the first device does not permit the online service to access the authentication information, sending an authentication response to the online service indicating the online service is not permitted to access the authentication information;

after sending the authentication response, receiving a permission request from the online service requesting permission to access the authentication information; and

in response to the permission request, sending a profile update request to the first device to obtain updated profile information specifying whether the online service is permitted to access the authentication information.