Methods and systems for single sign-on while protecting user privacy

• US 9,992,188 B2
• Filed: 10/19/2016
• Issued: 06/05/2018
• Est. Priority Date: 06/07/2013
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Huhn, Derrick S., Werner, Jeremy M., Pattekar, Amol V.
• Primary Examiner(s): Desrosiers, Evans
• Application Number:
  US15/298,190
• Publication Number:
  US 20170104747A1
• Time in Patent Office: 594 Days
• Field of Search: 713168-174, 713182-186, 713202, 726 7
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

A method of enabling applications to reference user information is provided, including receiving a request for a user identifier that references a user of the application and sending a second request for the user identifier to a server. The second request may include a second user identifier that references the user and a second authentication token for the second user identifier. Furthermore, the second user identifier and the second authentication token are not accessible by the user. The method includes receiving the user identifier and an authentication token for the first user identifier. The user identifier corresponds to the second identifier; and providing the user identifier and authentication token to the application. A method of enabling an application to identify users associated with a user of the application is provided; the method may include receiving, from the server, user identifiers that reference one or more users scoped to the application.

Claims

1. A method for identifying common users of a network-based software application, the method comprising, at a daemon executing on a client device:

receiving, from the network-based software application, a request to identify one or more contacts within an address book that are registered with the network-based software application;

providing, to a server device, a first set of information associated with at least one contact from the one or more contacts within the address book;

receiving, from the server device, a unique identifier that corresponds to the at least one contact, wherein the unique identifier indicates that the at least one contact is registered with the network-based software application based at least in part on matching the first set of information with a second set of information stored at the server device; and

providing the unique identifier to the network-based software application, wherein the network-based software application utilizes the unique identifier to provide functionality associated with the at least one contact without exposing both the first and second sets to the network-based software application.

2. The method of claim 1, further comprising, prior to providing the first set of information to the server device:

issuing a prompt to access to the address book; and

receiving an authorization to access the address book.

3. The method of claim 1, wherein the unique identifier is scoped to the network-based software application.

4. The method of claim 1, wherein the at least one contact is registered with the network-based software application when an instance of the network-based software application is installed on a different client device associated with the at least one contact.

5. The method of claim 4, wherein the unique identifier corresponds to the instance of the network-based software application installed on the different client device.

6. The method of claim 1, wherein the first set of information about the at least one contact includes an email address and/or a phone number associated with the at least one contact.

7. The method of claim 6, wherein the unique identifier corresponds to the email address and/or the phone number associated with the at least one contact, but the unique identifier does not reveal the email address and/or the phone number associated with the at least one contact.

8. A non-transitory computer readable storage medium configured to store instructions that, when executed by a processor included in a computing device, cause the computing device to carry out steps that include:

receiving, from a network-based software application, a request to identify one or more contacts within an address book that are registered with the network-based software application;

providing, to a server device, a first set of information associated with at least one contact from the one or more contacts within the address book;

receiving, from the server device, a unique identifier that corresponds to the at least one contact, wherein the unique identifier indicates that the at least one contact is registered with the network-based software application based at least in part on matching the first set of information with a second set of information stored at the server device; and

providing the unique identifier to the network-based software application, wherein the network-based software application utilizes the unique identifier to provide functionality associated with the at least one contact without exposing both the first and second sets to the network-based software application.

9. The non-transitory computer readable storage medium of claim 8, wherein the steps further include, prior to providing the first set of information to the server device:

issuing a prompt to access to the address book; and

receiving an authorization to access the address book.

10. The non-transitory computer readable storage medium of claim 8, wherein the unique identifier is scoped to the network-based software application.

11. The non-transitory computer readable storage medium of claim 8, wherein the at least one contact is registered with the network-based software application when an instance of the network-based software application is installed on a different client device associated with the at least one contact.

12. The non-transitory computer readable storage medium of claim 11, wherein the unique identifier corresponds to the instance of the network-based software application installed on the different client device.

13. The non-transitory computer readable storage medium of claim 8, wherein the first set of information about the at least one contact includes an email address and/or a phone number associated with the at least one contact.

14. The non-transitory computer readable storage medium of claim 13, wherein the unique identifier corresponds to the email address and/or the phone number associated with the at least one contact, but the unique identifier does not reveal the email address and/or the phone number associated with the at least one contact.

15. A computing device, comprising:

a processor; and

a memory configured to store instructions that, when executed by the processor, cause the computing device to carry out steps that include;

receiving, from a network-based software application, a request to identify one or more contacts within an address book that are registered with the network-based software application;

providing, to a server device, a first set of information associated with at least one contact from the one or more contacts within the address book;

receiving, from the server device, a unique identifier that corresponds to the at least one contact, wherein the unique identifier indicates that the at least one contact is registered with the network-based software application based at least in part on matching the first set of information with a second set of information stored at the server device; and

providing the unique identifier to the network-based software application, wherein the network-based software application utilizes the unique identifier to provide functionality associated with the at least one contact without exposing both the first and second sets to the network-based software application.

16. The computing device of claim 15, wherein the steps further include, prior to providing the first set of information to the server device:

issuing a prompt to access to the address book; and

receiving an authorization to access the address book.

17. The computing device of claim 15, wherein the unique identifier is scoped to the network-based software application.

18. The computing device of claim 15, wherein the at least one contact is registered with the network-based software application when an instance of the network-based software application is installed on a different client device associated with the at least one contact.

19. The computing device of claim 18, wherein the unique identifier corresponds to the instance of the network-based software application installed on the different client device.

20. The computing device of claim 15, wherein the first set of information about the at least one contact includes an email address and/or a phone number associated with the at least one contact.