User credentials

• US 9,264,415 B1
• Filed: 06/10/2013
• Issued: 02/16/2016
• Est. Priority Date: 07/11/2012
• Status: Active Grant

• Current Assignee: Microstrategy Incorporated
• Original Assignee: Microstrategy Incorporated
• Inventors: Saylor, Michael J., Chen, Gang, Vazquez, Hector
• Primary Examiner(s): Pwu, Jeffrey
• Assistant Examiner(s): Corum, Jr., William
• Application Number:
  US13/914,403
• Time in Patent Office: 981 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/58 Retrieval characterised by using metadata, e.g. metadata not derived from the content or metadata generated manually
• CPC Class Codes: G06F 16/5854 using shape and object relationship
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 21/46 by designing passwords or checking the strength of passwords
• CPC Class Codes: G06K 7/10544 by scanning of the records by radiation in the optical part of the electromagnetic spectrum
• CPC Class Codes: G10L 17/00 Speaker identification or verification techniques
• CPC Class Codes: G10L 17/24 the user being prompted to utter a password or a predefined phrase
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/77 Graphical identity
• CPC Class Codes: H04W 4/12 Messaging; Mailboxes; Announcements

Abstract

Obtaining and/or validating user credentials at client devices is described. This disclosure describes methods of generating representations of credentials for groups of users or for individuals. Representations for these credentials can be managed by a server or collection of servers, and distributed to appropriate users'"'"' client devices. These representations can then be outputted for evaluation by a credential authority, who confirms that the credential possessed by a given user is valid. A credential authority may be a person and/or a device that validates a credential.

Claims

1. A non-transitory computer-readable medium storing instructions executable by one or more computers which, upon such execution, cause the one or more computers to perform operations comprising:

receiving, at a server from a user device, a request to provide an optical machine-readable representation for a particular credential of a user of the user device;

generating, at the server, data for the optical machine-readable representation, wherein the optical machine-readable representation encodes one or more values associated with the particular credential, and wherein the optical machine-readable representation expires at the end of a period of time;

transmitting, at the server, the data for the optical machine-readable representation to the user device associated with the user;

receiving, at the server from a processing system that is distinct from the user device, a validation request comprising one or more values that are derived by the processing system from display of the optical machine-readable representation by the user device within the period of time;

responsive to receiving the validation request within the period of time, accessing, at the server, stored information indicative of one or more credentials granted to users;

determining, by the server, that the one or more values in the validation request received from the processing system match one or more values in the stored information; and

responsive to determining that the one or more values received from the processing system match the one or more values in the stored information, transmitting, at the server to the processing system, a validation response indicating that the particular credential is granted to the user.

2. The non-transitory computer-readable medium of claim 1 wherein:

receiving the validation request from the processing system that is distinct from the user device comprises receiving the validation request via short message service (SMS) from the processing system; and

the one or more values associated with the particular credential comprise a particular credential identifier and a user identifier, the user identifier identifying the user of the user device, the particular credential identifier identifying the particular credential.

3. The non-transitory computer-readable medium of claim 1, further comprising:

responsive to determining, at the server, that the one or more values received from the processing system match the one or more values in the stored information;

obtaining, at the server, an image of the user; and

transmitting, from the server to the processing system, the image of the user.

4. The non-transitory computer-readable medium of claim 3,

wherein obtaining the image of the user comprises retrieving, from a memory accessible by the server, the image of the user.

5. The non-transitory computer-readable medium of claim 3, wherein obtaining the image of the user comprises:

querying another server via a network connection; and

receiving, from the other server over the network connection, the image of the user.

6. The non-transitory computer-readable medium of claim 1 wherein accessing, at the server, the stored information indicative of one or more credentials granted to users comprises:

querying a database using the one or more values derived by the processing system from display of the optical machine-readable representation by the user device within the period of time to obtain a record corresponding to the user identifier, the derived one or more values comprising a particular credential identifier and a user identifier, the user identifier identifying the user of the user device, the particular credential identifier identifying the particular credential; and

wherein determining that the one or more values in the validation request received from the processing system match the one or more values in the stored information comprises;

determining that the record includes the particular credential identifier.

11. The non-transitory computer-readable medium of claim 1,

wherein the optical machine-readable representation comprises an arrangement of graphical elements that encode the one or more values associated with the particular credential.

12. The non-transitory computer-readable medium of claim 2, wherein the particular credential identifier identifies one of a plurality of credentials associated with the user.

13. The non-transitory computer-readable medium of claim 1, wherein the particular credential is issued to a group of users, the user being a member of the group of users.

15. The non-transitory computer-readable medium of claim 1, wherein the optical machine-readable representation is a first optical machine-readable representation;

and

wherein the non-transitory computer-readable medium of claim 1 further comprises;

receiving, at the server from the user device, a second request to provide an optical machine-readable representation for the particular credential upon expiration of the period of time;

generating, at the server, data for a second optical machine-readable representation different from the first optical machine-readable representation, wherein the second optical machine-readable representation encodes the one or more values associated with the particular credential and expires at an end of a second period of time; and

transmitting, at the server, the data for the second optical machine-readable representation to the user device.

7. A non-transitory computer-readable medium storing instructions executable by one or more computers which, upon such execution, cause the one or more computers to perform operations comprising:

scanning, at a processing system associated with a credential authority, an optical machine-readable representation for a particular credential from a display of a client device of a user, wherein the optical machine-readable representation expires at the end of a period of time;

decoding the scanned optical machine-readable representation to generate one or more values associated with the particular credential;

transmitting a validation request to a server, wherein the validation request includes the one or more values associated with the particular credential from among a plurality of credentials; and

receiving a validation response indicating that the user is associated with the particular credential in response to a determination, within the period of time, that (i) the one or more values match one or more values stored in a database coupled to the server, and (ii) the validation request is transmitted before expiration of the period of time.

8. The non-transitory computer-readable medium of claim 7, further comprising:

obtaining an image of the user; and

outputting, to a display operatively coupled to the processing system, the image of the user such that the credential authority can authenticate the user.

9. The non-transitory computer-readable medium of claim 8, wherein obtaining the image of the user comprises retrieving, from a memory of the processing system, the image of the user.

10. The non-transitory computer-readable medium of claim 8, wherein obtaining the image of the user comprises:

querying the server via a network connection; and

receiving, from the server over the network connection, the image of the user.

14. A system comprising:

one or more processors and one or more computer storage media storing instructions that are operable and when executed by the one or more processors, cause the one or more processors to perform operations comprising;

obtaining, from a display of a client device of a user, scan data indicating characteristics of an optical machine-readable representation for a particular credential, wherein the optical machine-readable representation expires at the end of a period of time;

decoding the scan data indicating characteristics of the scanned optical machine-readable representation to extract one or more values associated with the particular credential from the scan data;

transmitting, to a server, a validation request that includes the one or more values associated with the particular credential; and

receiving a validation response indicating that the particular credential is granted to the user in response to a determination, within the period of time, that (i) the one or more values match one or more values stored in a database coupled to the server, and (ii) the validation request is transmitted before expiration of the period of time.