Sharing keys

• US 9,608,970 B1
• Filed: 01/16/2015
• Issued: 03/28/2017
• Est. Priority Date: 01/16/2014
• Status: Active Grant

• Current Assignee: Microstrategy Incorporated
• Original Assignee: Microstrategy Incorporated
• Inventors: Gehret, John, Ziraknejad, Siamak
• Primary Examiner(s): Shaw, Brian
• Application Number:
  US14/599,042
• Time in Patent Office: 802 Days
• Field of Search: 713/168, 713/185, 726/5, 726/18, 726/4, 726/9
• US Class Current: 1/1
• CPC Class Codes: G06K 19/06037 multi-dimensional coding
• CPC Class Codes: G07C 9/22 in combination with an identity check of the pass holder
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/61 Time-dependent
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent

Abstract

The subject matter described in this specification includes a computer-readable medium storing instructions that cause one or more processors to perform various operations including receiving, from a first client device associated with a user account of a first user, a request for sharing a key. The key is associated with the user account of the first user, and permits access to a resource. The operations include generating, at a server, one or more representations of the key, transmitting the representations of the key to the first client device, and receiving, from a second client device associated with a user account of a second user, a request to access the key. The request to access the key is derived from one of the one or more representations of the key. The operations further include communicating, to the second client device, a message indicating whether access to the key has been granted.

Claims

1. One or more non-transitory computer-readable storage media including instructions, which upon execution by one or more processors, cause the one or more processors to perform operations comprising:

receiving, by one or more servers and from a first client device associated with a user account of a first user, a request to share a key associated with the user account of the first user, wherein the key permits access to a resource;

in response to receiving the request to share the key, determining, by the one or more servers, whether the first user is authorized to share, with another user, the key associated with the user account of the first user;

in response to determining that the first user is authorized to share, with another user, the key associated with the user account of the first user, generating, by the one or more servers, one or more representations of the key;

transmitting the one or more representations of the key from the one or more servers to the first client device;

receiving, by the one or more servers and from a second client device associated with a user account of a second user, a request to access the key, the request being derived from one of the one or more representations of the key; and

communicating, from the one or more servers to the second client device, a message indicating whether access to the key has been granted.

2. The one or more non-transitory computer-readable storage media of claim 1, wherein the one or more representations of the key comprise one or more of a Quick Response (QR) code, an acoustic code, and an alphanumeric code.

3. The one or more non-transitory computer-readable storage media of claim 1, wherein the key is linked to a first credential associated with the user account of the first user.

4. The one or more non-transitory computer-readable storage media of claim 3, wherein a second credential is associated with the user account of the second user.

5. The one or more non-transitory computer-readable storage media of claim 4, wherein the operations further comprise:

determining whether the first credential and second credential are issued by the same organization; and

granting the access to the key upon determining that the first and second credentials are issued by the same organization.

6. The one or more non-transitory computer-readable storage media of claim 4, wherein communicating the message includes communicating an indication that access to the key has been denied, upon determining that the first credential and second credential are issued by different organizations.

7. The one or more non-transitory computer-readable storage media of claim 1, wherein the one or more representations of the key are configured according to one or more constraints on accessing the resource using the representations of the key.

8. The one or more non-transitory computer-readable storage media of claim 7, wherein the one or more constraints include at least one of a time, a location, and a presence of the first user.

9. The one or more non-transitory computer-readable storage media of claim 8, wherein communicating the message includes communicating an indication that access to the key has been denied upon determining that the request to access the key is received outside the time identified by the one or more constraints.

10. The one or more non-transitory computer-readable storage media of claim 7, wherein the one or more constraints comprise an identification of a predetermined number of times the resource can be accessed using the representations of the key.

11. The one or more non-transitory computer-readable storage media of claim 10, wherein communicating the message includes communicating an indication that access to the key has been denied, upon determining that the key has been accessed the predetermined number of times.

12. The one or more non-transitory computer-readable storage media of claim 1, wherein the operations further comprise:

communicating, to the first client device, a message indicating that the user account of the second user has been granted access to the key.

13. The one or more non-transitory computer-readable storage media of claim 1, wherein the operations further comprise:

receiving, from within the user account of the second user, a request to access the resource; and

allowing an access to the resource based on verifying that the user account of the second user is granted access to the key.

14. The one or more non-transitory computer-readable storage media of claim 1,

wherein determining whether the first user is authorized to share, with another user, the key associated with the user account of the first user includes determining whether the first user has an administrative privilege to share the key with another user, the administrative privilege being issued by a credential issuing authority that issues the key;

and

wherein determining that the first user is authorized to share, with another user, the key associated with the user account of the first user includes determining that the first user has the administrative privilege to share the key with another user.

15. The one or more non-transitory computer-readable storage media of claim 1,

wherein determining whether the first user is authorized to share, with another user, the key associated with the user account of the first user includes determining whether the first user is an owner of the key;

and

wherein determining that the first user is authorized to share, with another user, the key associated with the user account of the first user includes determining that the first user is the owner of the key.

16. The one or more non-transitory computer-readable storage media of claim 1, further comprising:

in response to receiving the request to access the key from the second client device, determining that the one of the one or more representations used to derive the request are valid,

wherein deriving the request from one of the one or more representations of the key includes extracting data from one of an audio signal, an image, and a wireless signal that includes data representing the key and generating the request based on the extracted data.

17. The one or more non-transitory computer-readable storage media of claim 16, wherein determining that the one of the one or more representations used to derive the request are valid comprises one or more of:

determining that the one of the one or more representations used to derive the request have not expired; and

determining that one or more constraints that control access to the resource are satisfied, the one or more constraints including a threshold number of times the resource is allowed to be accessed, a threshold number of times the key is allowed to be shared, a time period during which the resource is allowed to be accessed, and the user account of the second user including a particular registered credential.

18. A computer-implemented method comprising:

receiving, by one or more servers and from a first client device associated with a user account of a first user, a request to share a key associated with the user account of the first user, wherein the key permits access to a resource;

in response to receiving the request to share the key, determining, by the one or more servers, whether the first user is authorized to share, with another user, the key associated with the user account of the first user;

in response to determining that the first user is authorized to share, with another user, the key associated with the user account of the first user, generating, by the one or more servers, one or more representations of the key;

transmitting the one or more representations of the key from the one or more servers to the first client device;

receiving, by the one or more servers and from a second client device associated with a user account of a second user, a request to access the key, the request being derived from one of the one or more representations of the key; and

communicating, from the one or more servers to the second client device, a message indicating whether access to the key has been granted.

19. The computer-implemented method of claim 18, wherein the one or more representations of the key comprise one or more of a Quick Response (QR) code, an acoustic code, and an alphanumeric code.

20. The computer-implemented method of claim 18, wherein:

the one or more representations of the key are configured according to one or more constraints on accessing the resource using the representations of the key; and

the one or more constraints include at least one of a time, a location, and a presence of the first user.

21. The computer-implemented method of claim 18, further comprising:

in response to receiving the request to access the key from the second client device, determining that the one of the one or more representations used to derive the request are valid,

wherein deriving the request from one of the one or more representations of the key includes extracting data from one of an audio signal, an image, and a wireless signal that includes data representing the key and generating the request based on the extracted data.

22. A system comprising:

one or more computing devices and one or more storage devices storing instructions which when executed by the one or more computing devices, cause the one or more computing devices to perform operations comprising;

receiving, by one or more servers and from a first client device associated with a user account of a first user, a request to share a key associated with the user account of the first user, wherein the key permits access to a resource;

in response to receiving the request to share the key, determining, by the one or more servers, whether the first user is authorized to share, with another user, the key associated with the user account of the first user;

in response to determining that the first user is authorized to share, with another user, the key associated with the user account of the first user, generating, by the one or more servers, one or more representations of the key;

transmitting the one or more representations of the key from the one or more servers to the first client device;

receiving, by the one or more servers and from a second client device associated with a user account of a second user, a request to access the key, the request being derived from one of the one or more representations of the key; and

communicating, from the one or more servers to the second client device, a message indicating whether access to the key has been granted.

23. The system of claim 22, wherein the one or more representations of the key comprise one or more of a Quick Response (QR) code, an acoustic code, and an alphanumeric code.

24. The system of claim 22, wherein:

the one or more representations of the key are configured according to one or more constraints on accessing the resource using the representations of the key; and

the one or more constraints include at least one of a time, a location, and a presence of the first user.