Generation and validation of user credentials having multiple representations

• US 9,860,246 B1
• Filed: 02/10/2016
• Issued: 01/02/2018
• Est. Priority Date: 07/11/2012
• Status: Active Grant

• Current Assignee: Microstrategy Incorporated
• Original Assignee: Microstrategy Incorporated
• Inventors: Saylor, Michael J., Chen, Gang, Vazquez, Hector, Butin, Kirill, Zolin, Roman
• Primary Examiner(s): Brown, Anthony
• Assistant Examiner(s): Corum, Jr., William
• Application Number:
  US15/040,777
• Time in Patent Office: 692 Days
• CPC Class Codes: G06F 16/58 Retrieval characterised by using metadata, e.g. metadata not derived from the content or metadata generated manually
• CPC Class Codes: G06F 16/5854 using shape and object relationship
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 21/46 by designing passwords or checking the strength of passwords
• CPC Class Codes: G06K 7/10544 by scanning of the records by radiation in the optical part of the electromagnetic spectrum
• CPC Class Codes: G10L 17/00 Speaker identification or verification techniques
• CPC Class Codes: G10L 17/24 the user being prompted to utter a password or a predefined phrase
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/77 Graphical identity
• CPC Class Codes: H04W 4/12 Messaging; Mailboxes; Announcements

Abstract

Obtaining and/or validating user credentials at client devices is described. This disclosure describes methods of generating representations of credentials for groups of users or for individuals. Representations for these credentials can be managed by a server or collection of servers, and distributed to appropriate users'"'"' client devices. These representations can then be outputted for evaluation by a credential authority, who confirms that the credential possessed by a given user is valid. A credential authority may be a person and/or a device that validates a credential.

Claims

1. One or more non-transitory computer-readable storage media storing instructions executable by one or more computers which, upon such execution, cause the one or more computers to perform operations comprising:

obtaining, by a client device, a credential identifier that identifies a credential of a user from among of a set of multiple credentials issued to the user by one or more credential authorities;

identifying, by the client device, multiple representations for the credential, each of the multiple representations configured to provide access to the same credential identified by the credential identifier and being a different type of representation selected from the group consisting of an animated graphical representation, a three-dimensional rendering of an object, an image of a fractal, a phrase, a numeric representation, and an optical machine-readable representation;

receiving, by the client device, a request to output a particular number of representations for the credential;

receiving, by the client device, a user input indicating a selection of at least one of the multiple representations for the credential, the at least one of the multiple representations for the credential including a number of representations that is the same as the requested particular number of representations; and

responsive to receiving the user input indicating the selection of at least one of the multiple representations for the credential, outputting, by the client device, the at least one selected representation for the credential to enable access to the credential.

2. The one or more non-transitory computer-readable storage media of claim 1, wherein the operations further comprise:

receiving, by the client device, a request to output a particular number of representations for the credential comprises receiving, at the client device, the request from a credential authority to provide at least one representation for the credential; and

wherein the operations further comprise transmitting, from the client device to the credential authority, one of the selected at least one of the multiple representations for the credential.

3. The one or more non-transitory computer-readable storage media of claim 1, wherein the operations further comprise:

after identifying the multiple representations for the credential;

displaying a first representation of the multiple representations; and

displaying a second representation of the multiple representations, the second representation being different from the first representation.

4. The one or more non-transitory computer-readable storage media of claim 3, wherein the operations further comprise:

receiving a second user input to switch between displaying the first representation and the second representation of the multiple representations, the second user input corresponding to a swiping input.

5. The one or more non-transitory computer-readable storage media of claim 1, further comprising wherein the operations further comprise:

obtaining, by the client device, the multiple representations for the credential; and

encoding, in each of the multiple representations, data derived from credential identifier that identifies the credential.

6. The one or more non-transitory computer-readable storage media of claim 1, wherein outputting, by the client device, the at least one selected representation for the credential to enable access to the credential comprises providing for display, at the client device, at least two representations to enable access to a secured resource based on the credential encoded in the at least one selected representation.

7. The one or more non-transitory computer-readable storage media of claim 1, wherein:

the at least one selected representation for the credential comprises at least two selected representations; and

outputting, by the client device, the at least one selected representation for the credential to enable access to the credential comprises;

providing for display, at the client device, a first representation of the at least two selected representations to enable access to the credential for validation by a credential authority;

rendering a second representation of the at least two selected representations as an audio signal; and

outputting, by the client device, the audio signal corresponding to the second representation of the at least two selected representations for validation by the credential authority.

8. The one or more non-transitory computer-readable storage media of claim 1, wherein identifying, by the client device, the multiple representations for the credential comprises generating, at the client device, the multiple representations for the credential.

9. The one or more non-transitory computer-readable storage media of claim 8, wherein the animated graphical representation, the three-dimensional rendering of the object, the image of the fractal, and the phrase are generated, at least in part, using a time of the client device that is synchronized with a time at a server system connected to the client device.

10. The one or more non-transitory computer-readable storage media of claim 1, wherein identifying, by the client device, the multiple representations for the credential comprises receiving, by the client device from a server system, the multiple representations for the credential.

20. The one or more non-transitory computer-readable storage media of claim 1, wherein the operations further comprise:

receiving, by the client device, a request to output a particular number of representations for the credential comprises receiving the request from a credential authority indicating a number of representations for performing validation; and

wherein the received user input includes a selection of a number of representations for the credential equal to the number of representations indicated in the request received from the credential authority.

11. A method for validating a credential, the method comprising:

obtaining, by a client device, a credential identifier that identifies a credential of a user from among of a set of multiple credentials issued to the user by one or more credential authorities;

identifying, by the client device, multiple representations for the credential, each of the multiple representations configured to provide access to the same credential identified by the credential identifier and being a different type of representation selected from the group consisting of an animated graphical representation, a three-dimensional rendering of an object, an image of a fractal, a phrase, a numeric representation, and an optical machine-readable representation;

receiving, by the client device, a request to output a particular number of representations for the credential;

receiving, by the client device, user input indicating a selection of at least one of the multiple representations for the credential, the at least one of the multiple representations for the credential including a number of representations that is the same as the requested particular number of representations; and

responsive to receiving the user input indicating the selection of at least one of the multiple representations for the credential, outputting, by the client device, the at least one selected representation for the credential to enable access to the credential.

12. The method of claim 11, further comprising:

wherein receiving, by the client device, a request to output a particular number of representations for the credential comprises receiving, at the client device, the request from a credential authority to provide at least one representation for the credential; and

wherein the method further comprises transmitting, from the client device to the credential authority, one of the selected at least one of the multiple representations for the credential.

13. The method of claim 11, further comprising:

after identifying the multiple representations for the credential;

displaying a first representation of the multiple representations; and

displaying a second representation of the multiple representations, the second representation being different from the first representation.

14. The method of claim 13, further comprising:

receiving a second user input to switch between displaying the first representation and the second representation of the multiple representations, the second user input corresponding to a swiping input.

15. The method of claim 11, further comprising:

obtaining, by the client device, the multiple representations for the credential; and

encoding, in each of the multiple representations, data derived from credential identifier that identifies the credential.

16. The method of claim 11, wherein outputting, by the client device, the at least one selected representation for the credential to enable access to the credential comprises providing for display, at the client device, at least two representations to enable access to a secured resource based on the credential encoded in the at least one selected representation.

17. The method of claim 11, wherein:

the at least one selected representation for the credential comprises at least two selected representations; and

outputting, by the client device, the at least one selected representation for the credential to enable access to the credential comprises;

providing for display, at the client device, a first representation of the at least two selected representations to enable access to the credential for validation by a credential authority;

rendering a second representation of the at least two selected representations as an audio signal; and

outputting, by the client device, the audio signal corresponding to the second representation of the at least two selected representations for validation by the credential authority.

18. The method of claim 11, wherein the animated graphical representation, the three-dimensional rendering of the object, the image of the fractal, and the phrase are generated, at least in part, using a time of the client device that is synchronized with a time at a server system connected to the client device.

19. A system comprising:

one or more processors and one or more computer-readable storage media storing instructions that are operable and when executed by the one or more processors, cause the one or more processors to perform operations comprising;

obtaining, by a client device, a credential identifier that identifies a credential of a user from among of a set of multiple credentials issued to the user by one or more credential authorities;

identifying, by the client device, multiple representations for the credential, each of the multiple representations configured to provide access to the same credential identified by the credential identifier and being a different type of representation selected from the group consisting of an animated graphical representation, a three-dimensional rendering of an object, an image of a fractal, a phrase, a numeric representation, and an optical machine-readable representation;

receiving, by the client device, a request to output a particular number of representations for the credential;

receiving, by the client device, user input indicating a selection of at least one of the multiple representations for the credential, the at least one of the multiple representations for the credential including a number of representations that is the same as the requested particular number of representations; and

responsive to receiving the user input indicating the selection of at least one of the multiple representations for the credential, outputting, by the client device, the at least one selected representation for the credential to enable access to the credential.