Mobile device access to a protected machine

• US 20170359342A1
• Filed: 06/09/2017
• Published: 12/14/2017
• Est. Priority Date: 06/09/2016
• Status: Active Grant

• Current Assignee: LastPass US LP
• Original Assignee: LogMeIn, Inc.
• Inventors: Magyar, Gyula, Hevizi, Gyorgy, Pal, Kornel
• Granted Patent: US 10,742,648 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04W 12/30 Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent

Abstract

In a first embodiment, the “one tap” operation of this disclosure enables a user having a mobile device “one tap” mobile application (or “app”) to log-in to the user'"'"'s desktop or laptop computer by bringing the user'"'"'s device in physical proximity to the computer and, while in such proximity, accepting a push notification that is received on the mobile device. In a second embodiment, the user uses the “one tap” functionality to access a cloud-based account that has been set up for the user on a third party web application (e.g., SalesForce.com). The technique seamlessly integrates with third party websites using well-known protocols (e.g., SAML2), and it enables secure cross-origin resource sharing in a highly secure, reliable and available manner. Still another aspect of this disclosure is an enhanced proximity detection routine that is used to facilitate the one tap function when the user'"'"'s mobile device is moved into proximity with the computer.

Claims

1. A network-based access method operative in association with a first device of a user, and a second device of the user, comprising:

associating, in a data set, information that binds the first device to the second device, and that binds the first device to a credential enabling access by the user to the first device;

upon receipt of an indication that the second device is and remains in physical proximity to the first device that is presently locked, determining whether the user can be verified, wherein the determination includes causing a notification to be delivered to the second device and evaluating a response to that notification;

following delivery of the notification to the second device, determining whether a verification response to the notification has been received; and

when the verification response to the notification has been received, the verification response having been generated as a result of a valid response to receipt of the notification, providing a verification result to the first device;

wherein receipt of the verification result at the first device unlocks the first device automatically based on the information in the data set.

2. The method as described in claim 1 wherein the first device is a computer, and the second device is a mobile device.

3. The method as described in claim 2 wherein the mobile device executes a mobile application that facilitates verification of the user.

4. The method as described in claim 3 wherein the notification is a push notification to the mobile application.

5. The method as described in claim 3 wherein the push notification has a timeout associated therewith.

6. The method as described in claim 1 wherein the first device and the second device communicate over a wireless link.

7. The method as described in claim 6 wherein the wireless link is Bluetooth.

8. The method as described in claim 7 wherein determining whether the second device is in physical proximity to the first device uses a proximity detection function.

9. The method as described in claim 1 further including configuring the first device and the second device to facilitate generation of the data set.

10. The method as described in claim 1 wherein verification response to the notification is received automatically or via a poll.

11. The method as described in claim 1 wherein one or more operations are carried out in an identity provider (IdP).