Context-aware validation

• US 9,444,805 B1
• Filed: 01/23/2015
• Issued: 09/13/2016
• Est. Priority Date: 01/27/2014
• Status: Active Grant

• Current Assignee: Microstrategy Incorporated
• Original Assignee: Microstrategy Incorporated
• Inventors: Saylor, Michael J., Xiao, Peng
• Primary Examiner(s): SCOTT, RANDY A
• Application Number:
  US14/603,429
• Time in Patent Office: 599 Days
• Field of Search: 713/156, 713/173, 713/193, 726/2, 726/5, 726/6, 726/7, 726/12
• US Class Current: 1/1
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/029 Location-based management or tracking services

Abstract

An application executed on a client device displays a user interface that receives input related to outputting credential information, wherein the application is configured to manage credentials that are associated with a validation system. The application receives, through the user interface, first user input to output a representation of a first credential in a manner that enables a credential authority to validate the representation. In response to receiving the first user input, the application identifies a location of the client device. The application determines whether the location of the client device is associated with a first region where the first credential is enabled for validation. In response to determining that the location of the client device is associated with the first region where the first credential is enabled for validation, the application displays, on the user interface, the representation of the first credential.

Claims

1. A computer program product, implemented in a non-transitory computer-readable medium storing instructions that, upon execution by one or more processors, cause the one or more processors to perform operations comprising:

presenting, by an application executed on a client device and on a display coupled to the client device, a user interface that receives input related to outputting credential information, wherein the application is configured to manage credentials that are associated with a validation system;

receiving a first trigger to provide a representation of a first credential;

in response to receiving the first trigger, identifying a first location of the client device;

based on identifying the location of the client device, determining, by the application, that the first location of the client device is associated with a first region where the first credential is enabled for validation;

in response to determining that the first location of the client device is associated with the first region where the first credential is enabled for validation, displaying, on the user interface, the representation of the first credential;

receiving a second trigger to update the representation of the first credential;

in response to receiving the second trigger, identifying an updated second location of the client device;

based on identifying the second location of the client device, determining, by the application, that the second location is associated with a second region where the first credential is not enabled for validation; and

in response to determining that the second location is associated with the second region where the first credential is not enabled for validation, presenting, on the user interface, information indicating that the first credential is not enabled for validation at the second location of the client device.

2. The computer program product of claim 1, wherein determining that the first location of the client device is associated with the first region where the first credential is enabled for validation comprises:

transmitting, by the application and over a network connection through the client device, information corresponding to the first location of the client device to a remote server associated with the validation system;

receiving, at the application and over the network connection through the client device, information from the remote server indicating the first region where the first credential is enabled for validation; and

determining, by the application, whether the first location of the client device is within the first region indicated by the information received from the remote server.

3. The computer program product of claim 2, wherein determining whether the first location of the client device is within the first region indicated by the information received from the remote server comprises:

identifying, based on the information received from the remote server, a reference location associated with the first region; and

determining whether the first location of the client device is within a predefined distance of the reference location.

4. The computer program product of claim 1, wherein determining whether the first location of the client device is associated with the first region where the first credential is enabled for validation comprises:

accessing, by the application, information that defines the first region and that is stored at the client device; and

determining, by the application, whether the first location of the client device is within the first region based on the information that defines the first region and that is stored at the client device.

5. The computer program product of claim 4, wherein accessing the information that defines the first region and that is stored at the client device comprises:

determining, by the application, that a remote server associated with the validation system is inaccessible over a network connection through the client device, wherein the remote server is configured to provide updated information indicating the first region where the first credential is enabled for validation; and

in response to determining that the remote server is inaccessible, accessing the information stored at the client device.

6. The computer program product of claim 1, wherein receiving the second trigger to update the representation of the first credential comprises:

starting, by the application, a counter based on displaying the representation of the first credential on the user interface; and

based on the counter reaching a particular value, identifying the updated second location of the client device.

7. The computer program product of claim 1, wherein presenting the information indicating that the first credential is not enabled for validation at the second location of the client device comprises:

displaying, on the user interface, a notification that provides information descriptive of the first region where the first credential is enabled for validation.

8. The computer program product of claim 1, wherein presenting the information indicating that the first credential is not enabled for validation at the second location of the client device comprises:

obscuring the representation of the first credential that is displayed on the user interface; and

presenting, as an overlay on the obscured representation of the first credential, information indicating that the first credential is restricted at the second location of the client device.

9. The computer program product of claim 8, wherein the instructions cause the one or more processors to perform operations comprising:

receiving, through the user interface displaying the obscured representation of the first credential, an user input to provide further information; and

in response to receiving the user input, displaying, on the user interface, a notification that provides information descriptive of the first region where the first credential is enabled for validation.

10. The computer program product of claim 1, wherein the instructions cause the one or more processors to perform operations comprising:

revoking the first credential based on determining that the second location of the client device is associated with the second region where the first credential is not enabled for validation, wherein revoking the first credential comprises disabling the first credential from future validation.

11. The computer program product of claim 1, wherein the instructions cause the one or more processors to perform operations comprising:

receiving, through the user interface, a new trigger to output a new representation of the first credential in a manner that enables a credential authority to validate the representation of the first credential;

in response to receiving the new trigger, identifying a time at the client device;

based on the time at the client device, determining, by the application, whether the time at the client device is within a predefined time period during which the first credential is enabled for validation; and

in response to determining that the time at the client device is outside the predefined time period during which the first credential is enabled for validation, presenting, on the user interface, information indicating that the first credential is restricted.

12. The computer program product of claim 1, wherein the instructions cause the one or more processors to perform operations comprising:

receiving, through the user interface, a user input to output a representation of a second credential in a manner that enables a credential authority to validate the representation of the second credential;

in response to receiving the user input, identifying an updated third location of the client device;

based on the updated third location of the client device, determining, by the application, whether the updated third location of the client device is associated with a region where the second credential is enabled for validation; and

in response to determining that the updated third location of the client device is not associated with the region where the second credential is enabled for validation, presenting, on the user interface, information indicating that the second credential is not enabled for validation at the updated third location of the client device.

13. The computer program product of claim 1, wherein the instructions cause the one or more processors to perform operations comprising:

receiving, through the user interface, a user input to output a representation of a second credential in a manner that enables a credential authority to validate the representation of the second credential;

in response to receiving the user input, identifying a time at the client device;

based on the time at the client device, determining, by the application, whether the time at the client device is within a predefined time period during which the second credential is enabled for validation; and

in response to determining that the time at the client device is outside the predefined time period during which the second credential is enabled for validation, presenting, on the user interface, information indicating that the second credential is restricted.

14. The computer program product of claim 13, wherein presenting the information indicating that the second credential is restricted comprises:

displaying, on the user interface, a notification that provides information descriptive of the predefined time period during which the second credential is enabled for validation.

15. The computer program product of claim 1, wherein presenting the user interface on the display coupled to the client device comprises:

presenting information about a group of credentials that are associated with a user account that is logged into the application executed on the client device.

16. The computer program product of claim 1, wherein receiving the first trigger comprises:

receiving, through the user interface, a first user input to output a representation of the first credential in a manner that enables a credential authority to validate the representation.

17. The computer program product of claim 1, wherein the second region corresponds to a region outside the first region, and wherein determining that the second location is associated with the second region where the first credential is not enabled for validation comprises:

determining, by the application, that the second location of the client device is not associated with the first region where the first credential is enabled for validation.

22. The computer program product of claim 16, wherein receiving the second trigger comprises:

receiving, through the user interface, a second user input to output a new representation of the first credential in a manner that enables the credential authority to validate the new representation of the first credential.

18. A system comprising:

a client device, storing instructions for execution by a processor coupled to the client device, wherein the instructions, when executed, are operable to cause the processor to perform operations comprising;

presenting, by an application executed on the client device and on a display coupled to the client device, a user interface that receives input related to outputting credential information, wherein the application is configured to manage credentials that are associated with a validation system;

receiving a first trigger to provide a representation of a first credential;

in response to receiving the first trigger, identifying a first location of the client device;

based on identifying the location of the client device, determining, by the application, that the first location of the client device is associated with a first region where the first credential is enabled for validation;

in response to determining that the first location of the client device is associated with the first region where the first credential is enabled for validation, displaying, on the user interface, the representation of the first credential;

receiving a second trigger to update the representation of the first credential;

in response to receiving the second trigger, identifying an updated second location of the client device;

based on identifying the second location of the client device, determining, by the application, that the second location is associated with a second region where the first credential is not enabled for validation; and

in response to determining that the second location is associated with the second region where the first credential is not enabled for validation, presenting, on the user interface, information indicating that the first credential is not enabled for validation at the second location of the client device.

19. The system of claim 18, wherein determining that the first location of the client device is associated with the first region where the first credential is enabled for validation comprises:

transmitting, by the application and over a network connection through the client device, information corresponding to the first location of the client device to a remote server associated with the validation system;

receiving, at the application and over the network connection through the client device, information from the remote server indicating the first region where the first credential is enabled for validation; and

determining, by the application, whether the first location of the client device is within the first region indicated by the information received from the remote server.

20. The system of claim 18, wherein determining that the first location of the client device is associated with the first region where the first credential is enabled for validation comprises:

accessing, by the application, information that defines the first region and that is stored at the client device; and

determining, by the application, whether the first location of the client device is within the first region based on the information that defines the first region and that is stored at the client device.

21. The system of claim 18, wherein receiving the second trigger to update the representation of the first credential comprises:

starting, by the application, a counter based on displaying the representation of the first credential on the user interface; and

based on the counter reaching a particular value, identifying the updated second location of the client device.