Device credentialing for network access

• US 9,112,844 B2
• Filed: 12/06/2012
• Issued: 08/18/2015
• Est. Priority Date: 12/06/2012
• Status: Active Grant

• Current Assignee: Audible Incorporated (Amazon.com, Inc.)
• Original Assignee: Audible Incorporated (Amazon.com, Inc.)
• Inventors: Story, Guy A. Jr.
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US13/707,522
• Publication Number:
  US 20140165165A1
• Time in Patent Office: 985 Days
• Field of Search: 726 1- 7, 713/150, 713/155, 713168-170, 713182-186, 709217-219, 709225-229
• US Class Current: 1/1
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

Various embodiments provide techniques for sharing network service access credentials among multiple devices that share a common user or are associated in a device group. After connecting to a network service (e.g., a wireless network, wired network, or web site), a first device can upload the credentials used to access the network service to a cloud-hosted credential service. The credential service can store the credentials and associate them with the first device and/or its user. Later, a second device can log in to the credential service and receive a download of one or more sets of credentials to enable access to one or more network services that are authorized for the second device. Various embodiments include a credential management interface to enable an authorized user to manage device/network service pairings, permissions, and/or restrictions for network service access.

Claims

1. A computer-implemented method comprising:

receiving, at a credential service implemented in a hosted computing environment, a first communication indicating that a first device has connected to a wireless network, the first communication including a set of credentials employed by the first device for connecting to the wireless network and for connecting to another network;

determining, by the credential service implemented in the hosted computing environment, that the first device is associated with a device group, the device group including a plurality of devices;

associating, by the credential service implemented in the hosted computing environment, the set of credentials with the device group, the set of credentials including information describing the first device, the wireless network, and the another network;

receiving, at the credential service implemented in the hosted computing environment, a second communication indicating that a second device has connected to the wireless network, the second communication including information indicating that the second device is associated with the device group;

authenticating, by the credential service implemented in the hosted computing environment, the second device, the authenticating to include verifying that the second device is associated with the device group; and

in response to the second communication;

providing, by the credential service implemented in the hosted computing environment, the set of credentials to the second device to enable the second device to automatically connect to the another network; and

associating the second device with the set of credentials.

2. The computer-implemented method of claim 1, further comprising authenticating, by the credential service implemented in the hosted computing environment, a user of the second device based in part on the information in the second communication.

3. The computer-implemented method of claim 1, further comprising authenticating, by the credential service implemented in the hosted computing environment, the first device based in part on information in the first communication.

4. The computer-implemented method of claim 1, further comprising receiving, at the credential service implemented in the hosted computing environment, a third communication including information indicating that a third device is associated with the device group, wherein the set of credentials associated with the device group enables the third device to automatically connect to the wireless network when the third device is in proximity to the wireless network.

5. The computer-implemented method of claim 1, further comprising storing, by the credential service implemented in the hosted computing environment, the set of credentials as a stored set of credentials, wherein the storing is performed at least one of:

automatically on receiving the first communication;

or

in response to an indication that the set of credentials is to be stored.

6. A system comprising:

a data store configured to store network service credentials; and

a computing device including a processor in communication with the data store, the processor configured to;

receive an indication that a first device has connected to a network service using a set of network service credentials, the first device associated with a device group, wherein the device group comprises a plurality of devices;

associate, in the data store, the set of network service credentials with the device group; and

provide the set of network service credentials to the device group, wherein the set of network service credentials enables at least one second device associated with the device group to automatically connect to the network service.

7. The system of claim 6, wherein the network service comprises at least one of a wired network, a wireless network, or a web site.

8. The system of claim 6, wherein the network service comprises a wireless network, and wherein the set of network service credentials enables the at least one second device associated with the device group to automatically connect to the wireless network when the at least one second device is in proximity to the wireless network.

9. The system of claim 6, wherein the computing device is further configured to store, in the data store, the set of network service credentials as a stored set of network service credentials for the network service.

10. The system of claim 6, wherein the plurality of devices in the device group share at least one of a common user and a common user account, and wherein the set of network service credentials is provided to the at least one second device in response to a communication authenticating the common user or the common user account to the computing device.

11. The system of claim 10, wherein the indication that the first device has connected to the network service further includes data that authenticates at least one of the common user and the common user account to the computing device.

12. The system of claim 6, wherein the processor is further configured to generate instructions for presenting a user interface that enables a user to manage access rights to the network service for the device group.

13. The system of claim 6, wherein the indication indicates that the first device is associated with the device group.

14. A computing device comprising:

a memory configured to store a credential management application;

a network interface; and

at least one processor in communication with the memory and the network interface, the at least one processor configured to execute the credential management application to;

authenticate the computing device to a credential service, following establishment of a connection to a first wireless network via the network interface, wherein the credential service is implemented in a hosted computing environment that is independent of the computing device;

receive, from the credential service, a set of credentials to enable the computing device to automatically connect to a second wireless network via the network interface; and

based at least in part on the network interface detecting the second wireless network, automatically establish a connection to the second wireless network via the network interface using the set of credentials received from the credential service.

15. The computing device of claim 14, wherein the set of credentials is stored by the credential service following an authentication of at least one other computing device to the credential service through the second wireless network.

16. The computing device of claim 15, wherein the computing device and the at least one other computing device are associated in a device group.

17. The computing device of claim 14, wherein the set of credentials are stored in data storage associated with the credential service.

18. One or more non-transitory computer-readable storage media storing instructions that, when executed, instruct at least one processor to perform actions comprising:

receiving, at a credential server, a first communication to a credential service, the first communication indicating that a device has connected to a network service, the first communication including one or more credentials employed by the device for connecting to the network service, the device operating in a computing environment that is independent of the credential server;

storing, by the credential server, the one or more credentials with information describing the network service;

receiving, at the credential server, a second communication authenticating at least one other device to the credential service, the at least one other device operating in a computing environment that is independent of the credential server; and

in response to the second communication, providing the one or more credentials included with the first communication to the at least one other device, the one or more credentials enabling the at least one other device to connect to the network service responsive to detecting the network service.

19. The one or more non-transitory computer-readable storage media of claim 18, wherein the network service comprises at least one of a wired network, a wireless network, a web service, or a web site.

20. The one or more non-transitory computer-readable storage media of claim 18, wherein the device and the at least one other device are in a device group associated with at least one of:

a common user, and

a common user account.

21. The one or more non-transitory computer-readable storage media of claim 18, wherein the first communication further authenticates a user of the device to the credential service, and wherein the second communication further authenticates the user to the credential service.

22. The one or more non-transitory computer-readable storage media of claim 18, wherein the device and at least one other device are mobile devices.

23. The one or more non-transitory computer-readable storage media of claim 18, wherein the one or more credentials include information describing the device, the network service, and another network.

24. The one or more non-transitory computer-readable storage media of claim 23, wherein the one or more credentials are stored in a data storage associated with the credential service, and the actions further comprise associating the at least one other device with the one or more credentials in the data storage on receipt of the second communication authenticating at least one other device to the credential service.

25. A computing device comprising:

a memory;

a processor in communication with the memory and a data store, the processor configured to;

receive an indication that a first device has connected to a network service using a set of credentials, the first device associated with a device group, wherein the device group comprises a plurality of devices;

cause to be stored, in the data store, the set of credentials as a stored set of network service credentials for the network service; and

provide the stored set of network service credentials to the device group, wherein the stored set of network service credentials enables at least one second device associated with the device group to automatically connect to the network service.

26. The computing device of claim 25, wherein the processor is further configured to associate the at least one second device with the stored set of network service credentials.

27. The computing device of claim 25, wherein the processor is further configured to generate instructions for presenting a user interface that enables a user to manage access rights to the network service for the device group.