Proximity detection for mobile device access to protected resources

• US 20170359339A1
• Filed: 06/09/2017
• Published: 12/14/2017
• Est. Priority Date: 06/09/2016
• Status: Active Grant

• Current Assignee: LastPass US LP
• Original Assignee: LogMeIn, Inc.
• Inventors: Hevizi, Gyorgy, Magyar, Gyula, Pal, Kornel
• Granted Patent: US 10,742,645 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04B 17/318 Received signal strength
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04M 1/72406 by software upgrading or downloading
• CPC Class Codes: H04M 1/72412 using two-way short-range wireless interfaces
• CPC Class Codes: H04W 4/60 Subscription-based services using application servers or record carriers, e.g. SIM application toolkits
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
• CPC Class Codes: H04W 80/12 Application layer protocols, e.g. WAP [Wireless Application Protocol]

Abstract

In a first embodiment, the “one tap” operation of this disclosure enables a user having a mobile device “one tap” mobile application (or “app”) to log-in to the user'"'"'s desktop or laptop computer by bringing the user'"'"'s device in physical proximity to the computer and, while in such proximity, accepting a push notification that is received on the mobile device. In a second embodiment, the user uses the “one tap” functionality to access a cloud-based account that has been set up for the user on a third party web application (e.g., SalesForce.com). The technique seamlessly integrates with third party websites using well-known protocols (e.g., SAML2), and it enables secure cross-origin resource sharing in a highly secure, reliable and available manner. Still another aspect of this disclosure is an enhanced proximity detection routine that is used to facilitate the one tap function when the user'"'"'s mobile device is moved into proximity with the computer.

Claims

1. A network-based access method operative in association with a first device of a user, and a second device of the user, comprising:

upon receipt of an indication that the second device is and remains in physical proximity to the first device that is presently locked, determining whether the user can be verified;

wherein physical proximity of the second device to the first device is determined by the following sub-steps;

determining whether a computed signal strength value is within a given range, the given range indicating that the presence of the second device is indeterminate;

when it is determined that the computed signal strength value is within the given range, determining whether the computed signal strength value has a given first or second relationship with a prior computed signal strength value;

when the computed signal strength value has the given first relationship, accepting the second device as being in physical proximity to the first device; and

when the computed signal strength value has the given second relationship, accepting the second device as being not in physical proximity to the first device; and

unlocking the first device automatically when the physical proximity is established and the user is verified.

2. The method as described in claim 1 wherein the first and second devices communicate over Bluetooth.

3. The method as described in claim 1 wherein determining whether the user can be verified includes causing a notification to be delivered to the second device and evaluating a response to that notification.

4. The method as described in claim 3 further including following delivery of the notification to the second device, determining whether a verification response to the notification has been received.

5. The method as described in claim 4 further including providing a verification to the first device when the verification response to the notification has been received, the verification response having been generated as a result of a valid response to receipt of the notification.

6. The method as described in claim 5 wherein receipt of the verification result at the first device unlocks the first device automatically provided the first and second devices remain in physical proximity.

7. A computer program product in a non-transitory computer-readable medium, the computer program product comprising computer instructions executable by a hardware processor to detect whether a second device is in physical proximity to a first device by:

determining whether a computed signal strength value is within a given range, the given range indicating that the presence of the second device is indeterminate;

when it is determined that the computed signal strength value is within the given range, determining whether the computed signal strength value has a given first or second relationship with a prior computed signal strength value;

when the computed signal strength value has the given first relationship, accepting the second device as being in physical proximity to the first device; and

when the computed signal strength value has the given second relationship, accepting the second device as being not in physical proximity to the first device.

8. The computer program product as described in claim 7 wherein the computed signal strength value is a Bluetooth signal strength value.

9. The computer program product as described in claim 7 wherein the computer program instructions are further operative to establish and maintain a wireless communication link between the first and second devices.