Mobile-device-based trust computing

• US 8,918,638 B2
• Filed: 07/03/2012
• Issued: 12/23/2014
• Est. Priority Date: 07/03/2012
• Status: Active Grant

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Inventors: St. Clair, Luke
• Primary Examiner(s): Gergiso, Techane
• Application Number:
  US13/541,212
• Publication Number:
  US 20140013107A1
• Time in Patent Office: 903 Days
• Field of Search: 713/156, 726/5
• US Class Current: 713/156
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/77 Graphical identity

Abstract

In one embodiment, a method includes receiving access data from an application on a mobile device of a particular user. The access data includes authentication data associated with a shared device and a digital credential associated with the mobile device. The shared device is configured for use by at least a number users. The method also includes authenticating the access data based on a comparison of the access data with verification data stored by the verification authority; and transmitting to the shared device a digital certificate signed by the verification authority in response to the authentication. The signed digital certificate provides the particular user access to the shared device.

Claims

1. A method comprising:

by a verification authority, receiving access data from an application on a mobile device of a particular one of a plurality of users, the access data functioning as a digital certificate and comprising authentication data associated with a shared device and a digital credential associated with the mobile device, the shared device being different from the mobile device and configured for use by at least the plurality of users;

by the verification authority, authenticating the access data based on a comparison of the access data with verification data stored by the verification authority; and

by the verification authority, transmitting to the shared device the digital certificate signed by the verification authority in response to the authentication, the signed digital certificate providing the particular user access to the shared device.

2. The method of claim 1, wherein the verification authority comprises an authentication manager of a social-networking system and the mobile device is a smartphone.

3. The method of claim 1, wherein the shared device is registered with the verification authority.

4. The method of claim 3, wherein access to the registered shared device is controlled at least in part by a webpage hosted by the verification authority.

5. The method of claim 1, wherein the digital credential comprises data uniquely identifying the mobile device or the particular user.

6. The method of claim 1, wherein the authentication data is encoded in a quick-response (QR) code displayed on a display of the shared device.

7. The method of claim 1, further comprising:

receiving system-state information associated with the mobile device, the system-state information indicating one or more applications installed on the mobile device; and

comparing the system-state information with a signature of each of one or more of the applications installed on the mobile device.

8. One or more computer-readable non-transitory storage media embodying logic configured when executed to:

receive access data from an application on a mobile device of a particular one of a plurality of users, the access data functioning as a digital certificate and comprising authentication data associated with a shared device and a digital credential associated with the mobile device, the shared device being different from the mobile device and configured for use by at least the plurality of users;

authenticate the access data based on a comparison of the access data with verification data stored by the verification authority; and

transmit to the shared device the digital certificate signed by the verification authority in response to the authentication, the signed digital certificate providing the particular user access to the shared device.

9. The media of claim 8, wherein the verification authority comprises an authentication manager of a social-networking system and the mobile device is a smartphone.

10. The media of claim 8, wherein the shared device is registered with the verification authority.

11. The media of claim 10, wherein access to the registered shared device is controlled at least in part by a webpage hosted by the verification authority.

12. The media of claim 8, wherein the digital credential comprises data uniquely identifying the mobile device or the particular user.

13. The media of claim 8, wherein the authentication data is encoded in a quick-response (QR) code displayed on a display of the shared device.

14. The media of claim 8, wherein the logic is further configured to:

receive system state information associated with the mobile device, the system state information indicating one or more applications installed on the mobile device; and

compare the system state information with a signature of each of the one or more of the applications installed on the mobile device.

15. A device comprising:

a processor coupled to a storage; and

one or more computer-readable non-transitory storage media coupled to the processor and embodying logic configured when executed to;

receive access data from an application on a mobile device of a particular one of a plurality of users, the access data functioning as a digital certificate and comprising authentication data associated with a shared device and a digital credential associated with the mobile device, the shared device being different from the mobile device and configured for use by at least the plurality of users;

authenticate the access data based on a comparison of the access data with verification data stored by the verification authority; and

transmit to the shared device the digital certificate signed by the verification authority in response to the authentication, the signed digital certificate providing the particular user access to the shared device.

16. The device of claim 15, wherein the shared device is registered with the device.

17. The device of claim 16, wherein access to the registered shared device is controlled at least in part by a webpage hosted by the device.

18. The device of claim 15, wherein the digital credential comprises data uniquely identifying the mobile device or the particular user.

19. The device of claim 15, wherein the authentication data is encoded in a quick-response (QR) code displayed on a display of the shared device.

20. The device of claim 15, wherein the logic is further configured to:

receive system state information associated with the mobile device, the system-state information indicating one or more applications installed on the mobile device; and

compare the system-state information with a signature of each of one or more of the applications installed on the mobile device.