Authentication with secondary approver

• US 10,516,997 B2
• Filed: 09/14/2018
• Issued: 12/24/2019
• Est. Priority Date: 09/29/2011
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Cotterill, Stephen Hayden
• Primary Examiner(s): Bhattacharya, Sam
• Application Number:
  US16/131,767
• Publication Number:
  US 20190124510A1
• Time in Patent Office: 466 Days
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

Techniques are provided for giving access to restricted content on a first device from a second device through a wireless network. In one embodiment, the first device transmits an authorization request signal to the second device or to a server in the wireless network. The second device, having received the authorization request, prompts an authorized user to give authorization to the first device by inputting an authentication key such as a password or gesture on the second device. Upon verification of the authentication key, an authorization signal may be wirelessly transmitted to the first device, permitting access to the restricted content or functions on the first device. In some embodiments, the second device may be alerted to an authorization request and may select a request for authorization from a selectable queue of requests.

Claims

1. A first electronic device, comprising:

a display;

one or more processors; and

memory storing one or more programs configured to be executed by the one or more processors, the one or more programs including instructions for;

initiating an authorization request for accessing restricted content; and

in response to initiating the authorization request for accessing the restricted content;

in accordance with a determination that secondary authentication criteria have been met, displaying, on the display, a first user interface with a user interface element that, when activated, results in transmitting, to a second electronic device, a secondary authorization request for accessing the restricted content, wherein the second electronic device is different from the first electronic device, and

in accordance with a determination that secondary authentication criteria have not been met, displaying, on the display, a second user interface with one or more data fields for entering login information.

2. The first electronic device of claim 1, wherein the secondary authentication criteria is met when secondary authorization techniques are available to the first electronic device.

3. The first electronic device of claim 1, the one or more programs further including instructions for:

prior to initiating the authorization request for accessing the restricted content;

determining, based on an authority level of an account associated with the first electronic device, that the first electronic device is not authorized to access the restricted content.

4. The first electronic device of claim 1, wherein the transmitted secondary authorization request is configured to cause the second electronic device to display information about the secondary authorization request.

5. The first electronic device of claim 4, wherein the displayed information about the secondary authorization request includes information about a sender of the secondary authorization request and information about the restricted content.

6. The first electronic device of claim 1, the one or more programs further including instructions:

subsequent to transmitting, to the second electronic device, the secondary authorization request for accessing the restricted content;

receiving an authorization signal from the second electronic device; and

in response to receiving the authorization signal from the second electronic device, accessing the restricted content at the first electronic device.

7. The first electronic device of claim 1, the one or more programs further including instructions for:

while displaying, on the display, the second user interface with one or more data fields for entering login information;

receiving input at the one or more data fields for entering login information; and

in accordance with a determination that the received input corresponds to an account with full authority, accessing the restricted content at the first electronic device.

8. A non-transitory computer-readable storage medium storing one or more programs configured to be executed by one or more processors of a first electronic device with a display, the one or more programs including instructions for:

initiating an authorization request for accessing restricted content; and

in response to initiating the authorization request for accessing the restricted content;

in accordance with a determination that secondary authentication criteria have been met, displaying, on the display, a first user interface with a user interface element that, when activated, results in transmitting, to a second electronic device, a secondary authorization request for accessing the restricted content, wherein the second electronic device is different from the first electronic device, and

in accordance with a determination that secondary authentication criteria have not been met, displaying, on the display, a second user interface with one or more data fields for entering login information.

9. The non-transitory computer-readable storage medium of claim 8, wherein the secondary authentication criteria is met when secondary authorization techniques are available to the first electronic device.

10. The non-transitory computer-readable storage medium of claim 8, the one or more programs further including instructions for:

prior to initiating the authorization request for accessing the restricted content;

determining, based on an authority level of an account associated with the first electronic device, that the first electronic device is not authorized to access the restricted content.

11. The non-transitory computer-readable storage medium of claim 8, wherein the transmitted secondary authorization request is configured to cause the second electronic device to display information about the secondary authorization request.

12. The non-transitory computer-readable storage medium of claim 11, wherein the displayed information about the secondary authorization request includes information about a sender of the secondary authorization request and information about the restricted content.

13. The non-transitory computer-readable storage medium of claim 8, the one or more programs further including instructions:

subsequent to transmitting, to the second electronic device, the secondary authorization request for accessing the restricted content;

receiving an authorization signal from the second electronic device; and

in response to receiving the authorization signal from the second electronic device, accessing the restricted content at the first electronic device.

14. The non-transitory computer-readable storage medium of claim 8, the one or more programs further including instructions for:

while displaying, on the display;

the second user interface with one or more data fields for entering login information, receiving input at the one or more data fields for entering login information; and

in accordance with a determination that the received input corresponds to an account with full authority, accessing the restricted content at the first electronic device.

15. A method, comprising:

at a first electronic device with a display;

initiating an authorization request for accessing restricted content; and

in response to initiating the authorization request for accessing the restricted content;

in accordance with a determination that secondary authentication criteria have been met, displaying, on the display;

a first user interface with a user interface element that, when activated, results in transmitting, to a second electronic device, a secondary authorization request for accessing the restricted content, wherein the second electronic device is different from the first electronic device, and

in accordance with a determination that secondary authentication criteria have not been met, displaying, on the display, a second user interface with one or more data fields for entering login information.

16. The method of claim 15, wherein the secondary authentication criteria is met when secondary authorization techniques are available to the first electronic device.

17. The method of claim 15, further comprising:

prior to initiating the authorization request for accessing the restricted content;

determining, based on an authority level of an account associated with the first electronic device, that the first electronic device is not authorized to access the restricted content.

18. The method of claim 15, wherein the transmitted secondary authorization request is configured to cause the second electronic device to display information about the secondary authorization request.

19. The method of claim 18, wherein the displayed information about the secondary authorization request includes information about a sender of the secondary authorization request and information about the restricted content.

20. The method of claim 15, further comprising:

subsequent to transmitting;

to the second electronic device;

the secondary authorization request for accessing the restricted content;

receiving an authorization signal from the second electronic device; and

in response to receiving the authorization signal from the second electronic device, accessing the restricted content at the first electronic device.

21. The method of claim 15, further comprising:

while displaying, on the display;

the second user interface with one or more data fields for entering login information, receiving input at the one or more data fields for entering login information; and

in accordance with a determination that the received input corresponds to an account with full authority, accessing the restricted content at the first electronic device.