Third-party authorization of user credentials

• US 9,154,303 B1
• Filed: 05/01/2013
• Issued: 10/06/2015
• Est. Priority Date: 03/14/2013
• Status: Active Grant

• Current Assignee: Microstrategy Incorporated
• Original Assignee: Microstrategy Incorporated
• Inventors: Saylor, Michael J.
• Primary Examiner(s): Yalew, Fikremariam A
• Application Number:
  US13/874,721
• Time in Patent Office: 888 Days
• Field of Search: 713/155, 713168-171, 713182-185
• US Class Current: 1/1
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key

Abstract

In one implementation, a client device receives a request from a user to output a representation for a credential of the user. In response to receiving the request from the user to output the representation for the credential of the user, the client device obtains data identifying a third-party having authority to grant the user access to the credential of the user. The client device then obtains a representation of a credential associated with the third-party and validates the representation of the credential associated with the third-party. In response to validating the representation of the credential associated with the third-party, the client device outputs the representation for the credential of the user.

Claims

1. A non-transitory computer-readable medium storing instructions executable by one or more processors which, upon such execution, cause the one or more processors to perform operations comprising:

receiving, at a client device associated with a user, a request from the user to output a representation for a credential of the user;

in response to receiving the request from the user to output the representation for the credential of the user, obtaining, at the client device, data identifying a third-party having authority to grant the user access to the credential of the user;

obtaining, at the client device, a representation of a credential associated with the third-party;

validating, at the client device, the representation of the credential associated with the third-party; and

in response to validating the representation of the credential associated with the third-party, outputting, from the client device, the representation for the credential of the user,

wherein obtaining, at the client device, the representation of the credential associated with the third-party comprises obtaining, at the client device and from the third-party, an alphanumeric code representing the credential of the third-party; and

wherein validating, at the client device, the representation of the credential associated with the third-party comprises;

transmitting, from the client device, a validation request to a server, wherein the validation request includes the alphanumeric code; and

receiving a validation response from the server, the validation response indicating that the credential of the third-party is valid, the validation response being transmitted by the server upon comparison of the alphanumeric code with data associated with the credential of the third-party.

2. The computer-readable medium of claim 1,

wherein obtaining, at the client device, a representation of a credential associated with the third-party comprises obtaining, at the client device of the user from a client device of the third-party, a time-varying representation for a credential of the third-party, the time-varying representation comprising the alphanumeric code representing the credential of the third-party;

wherein validating, at the client device, the representation of the credential associated with the third-party comprises decoding, at the client device of the user, the time-varying representation for the credential to generate a set of alphanumeric characters, the set of alphanumeric characters comprising data corresponding to;

a key, a credential identifier, and a time at the client device of the third-party, wherein the key is associated with the third-party, and wherein the credential identifier identifies the credential of the third-party; and

wherein the validation request includes data corresponding to the key, the credential identifier, and the time.

3. The computer-readable medium of claim 1, wherein obtaining, at the client device of the user and from the third-party, an alphanumeric code representing a credential of the third-party comprises receiving, at a keypad of the client device, an input from the user corresponding to the alphanumeric code.

4. The computer-readable medium of claim 1, wherein the credential is a first credential and the third-party is a first third party;

and

wherein the operations further comprise;

receiving, at the client device, a request from the user to output a representation for a second credential of the user;

in response to receiving the request from the user to output the representation for the second credential of the user, obtaining, at the client device, data identifying a second third-party having authority to grant the user access to the second credential of the user;

obtaining, at the client device, a representation of a credential associated with the second third-party;

validating, at the client device, the representation of the credential associated with the second third-party; and

in response to validating the representation of the credential associated with the second third-party, outputting, from the client device, the representation for the second credential of the user.

5. The computer-readable medium of claim 1, wherein the operations further comprise:

obtaining, at the client device, data indicating a time period during which third-party authorization is required to access the credential; and

wherein, in response to receiving the request from the user to output the representation for the credential of the user, obtaining, at the client device, data identifying a third-party having authority to grant the user access to the credential of the user comprises;

determining that a current time is within the time period, and

in response to receiving the request from the user to output the representation for the credential of the user and having determined that the current time is within the time period, obtaining, at the client device, data identifying a third-party having authority to grant the user access to the credential of the user.

6. The computer-readable medium of claim 1, wherein the data identifying a third-party having authority to grant the user access to the credential of the user comprises data identifying one or more specific individuals having authority to grant the user access to the credential of the user.

7. The computer-readable medium of claim 6, wherein the data identifying one or more specific individuals having authority to grant the user access to the credential of the user further comprises location information for the one or more specific individuals having authority to grant the user access to the credential of the user.

8. The computer-readable medium of claim 1, wherein the data identifying a third-party having authority to grant the user access to the credential of the user comprises data identifying a type of credential to be provided by the third-party to grant the user access to the credential of the user.

9. The computer-readable medium of claim 1, wherein validating, at the client device, the representation of the credential associated with the third-party comprises:

obtaining a confirmation that the third party is a party authorized to grant the user access to the credential of the user; and

receiving, at the client device, confirmation from a client device associated with the third-party that the third-party intends to grant the user access to the credential of the user.

10. The computer-readable medium of claim 1, wherein the operations further comprise initiating recording of information identifying the third-party who granted the user access to the credential of the user.

11. The computer-readable medium of claim 1, wherein validating, at the client device, the representation of the credential associated with the third-party comprises:

decoding, at the client device, a certificate associated with the third-party from the representation of the credential; and

determining, at the client device, that the certificate associated with the third-party is valid.

12. The computer-readable medium of claim 1, wherein the operations further comprise, in response to validating the representation of the credential associated with the third-party, receiving, at the client device of the user from a server, data encoding the credential of the user.

13. The computer-readable medium of claim 1, wherein the alphanumeric code comprises only numbers.

14. The computer-readable medium of claim 1, wherein the alphanumeric code comprises only letters.

15. The computer-readable medium of claim 1, wherein the alphanumeric code comprises at least one number and at least one letter.

16. A computer-implemented method comprising:

receiving, at a client device associated with a user, a request from the user to output a representation for a credential of the user;

in response to receiving the request from the user to output the representation for the credential of the user, obtaining, at the client device, data identifying a third-party having authority to grant the user access to the credential of the user;

obtaining, at the client device, a representation of a credential associated with the third-party;

validating, at the client device, the representation of the credential associated with the third-party; and

in response to validating the representation of the credential associated with the third-party, outputting, from the client device, the representation for the credential of the user,

wherein obtaining, at the client device, the representation of the credential associated with the third-party comprises obtaining, at the client device and from the third-party, an alphanumeric code representing the credential of the third-party; and

wherein validating, at the client device, the representation of the credential associated with the third-party comprises;

transmitting, from the client device, a validation request to a server, wherein the validation request includes the alphanumeric code; and

receiving a validation response from the server, the validation response indicating that the credential of the third-party is valid, the validation response being transmitted by the server upon comparison of the alphanumeric code with data associated with the credential of the third-party.

17. The method of claim 16,

wherein obtaining, at the client device, a representation of a credential associated with the third-party comprises obtaining, at the client device of the user from a client device of the third-party, a time-varying representation for a credential of the third-party, the time-varying representation comprising the alphanumeric code representing the credential of the third-party;

wherein validating, at the client device, the representation of the credential associated with the third-party comprises decoding, at the client device of the user, the time-varying representation for the credential to generate a set of alphanumeric characters, the set of alphanumeric characters comprising data corresponding to;

a key, a credential identifier, and a time at the client device of the third-party, wherein the key is associated with the third-party, and wherein the credential identifier identifies the credential of the third-party; and

wherein the validation request includes data corresponding to the key, the credential identifier, and the time.

20. The method of claim 16, wherein the alphanumeric code comprises only numbers.

18. A device comprising:

one or more processors and one or more storage devices storing instructions that are operable, when executed by the one or more processors, to cause the one or more processors to perform operations comprising;

receiving a request from a user to output a representation for a credential of the user;

in response to receiving the request from the user to output the representation for the credential of the user, obtaining data identifying a third-party having authority to grant the user access to the credential of the user;

obtaining a representation of a credential associated with the third-party;

validating the representation of the credential associated with the third-party; and

in response to validating the representation of the credential associated with the third-party, outputting the representation for the credential of the user,

wherein obtaining the representation of the credential associated with the third-party comprises obtaining, the third-party an alphanumeric code representing the credential of the third-party; and

wherein validating the representation of the credential associated with the third-party comprises;

transmitting a validation request to a server, wherein the validation request includes the alphanumeric code; and

receiving a validation response from the server, the validation response indicating that the credential of the third-party is valid, the validation response being transmitted by the server upon comparison of the alphanumeric code with data associated with the credential of the third-party.

19. The device of claim 18,

wherein obtaining a representation of a credential associated with the third-party comprises obtaining from a client device of the third-party, a time-varying representation for a credential of the third-party, the time-varying representation comprising the alphanumeric code representing the credential of the third-party;

wherein validating the representation of the credential associated with the third-party comprises decoding the time-varying representation for the credential to generate a set of alphanumeric characters, the set of alphanumeric characters comprising data corresponding to;

a key, a credential identifier, and a time at the client device of the third-party, wherein the key is associated with the third-party, and wherein the credential identifier identifies the credential of the third-party; and

wherein the validation request includes data corresponding to the key, the credential identifier, and the time.