USER DEVICE SECURITY MANAGER

• US 20140020070A1
• Filed: 12/10/2012
• Published: 01/16/2014
• Est. Priority Date: 07/16/2012
• Status: Active Grant

• Current Assignee: eBay Inc.
• Original Assignee: eBay Inc.
• Inventors: Angal, Rajeev
• Granted Patent: US 9,230,089 B2
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

Systems and methods are disclosed to authenticate and authorize a user for web services using user devices. In various embodiments, a method may comprise: identifying, by a user device security manager executing at a user device corresponding to a user of a web service, a first request issued from an application to access remote resources associated with the web service, the application executing at the user device and separate from the user device security manager; acquiring, by the user device security manager, security information of the application in response to the identifying of the first request, the security information including at least one of an application identification, an access scope or a nonce of the application; and transmitting a second request from the user device security manager to the web service to authenticate the application by the web service based, at least in part, on the application identification.

Claims

1. An apparatus comprising:

a processor-implemented identification module to identify a first request issued from an application to access remote resources associated with a web service, the application configured to execute at a user device and separate from the user device security manager;

a processor-implemented acquisition module to acquire security information associated with the application in response to the identifying of the first request, the security information including at least one of an application identification, an access scope or a nonce for the application; and

a processor implemented communication module to transmit a second request to the web service to authenticate the application by the web service at least based on the application identification.

2. The apparatus of claim 1, further comprising:

a processor-implemented artifact module to retrieve at least one user artifact from a security manager identifier (SMID) received from the web service; and

a processor-implemented verification module to perform fingerprinting of the apparatus based on the at least one user artifact.

3. The apparatus of claim 2, wherein the at least one user artifact comprises at least one of an image, color or phrase selected by a user of the apparatus, and wherein the at least one user artifact is previously registered at the web service in relation with the user.

4. The apparatus of claim 2, wherein the SMID comprises a string of symbols, or a quick response (QR) code.

5. The apparatus of claim 2, wherein the artifact module is configured to:

receive the SMID using at least one of QR code submission, redirection, push notification, manual entry or an email communication.

6. The apparatus of claim 2, wherein the artifact module is configured to:

transmit the SMID to the web service to verify the apparatus in response to the identifying of the first request.

7. The apparatus of claim 2, wherein the verification module is configured to:

signal a display associated with the apparatus to present at least one portion of the at least one user artifact based on receiving an indication that the apparatus is verified by the web service.

8. The apparatus of claim 2, wherein the at least one user artifact is to be eliminated from the web service after the apparatus has been verified by the web service.

9. The apparatus of claim 6, wherein the verification module is configured to:

prevent the user device from prompting the user with one or more user authentication pages based on identifying a valid user token associated with the user from the SMID.

10. A method comprising:

identifying, by a user device security manager of a user device corresponding to a user of a web service, a first request issued from an application to access remote resources associated with the web service, the application executing at the user device and separate from the user device security manager;

acquiring, by the user device security manager, security information associated with the application in response to the identifying of the first request, the security information including at least one of an application identification, an access scope or a nonce for the application; and

transmitting, using one or more processors, a second request from the user device security manager to the web service to authenticate the application by the web service based, at least in part, on the application identification.

11. The method of claim 10, further comprising

forwarding the first request to the web service along with the access scope based on receiving an indication from the web service that the application is authenticated by the web service.

12. The method of claim 10, further comprising:

transmitting a user consent to the web service based on an outcome of checking of the access scope of the application by the web service with respect to the requested resources.

13. The method of claim 10, further comprising:

transmitting a third request to the web service to issue an application token for the application.

14. The method of claim 13, further comprising:

encrypting the application token issued from the web service with the nonce of the application; and

forwarding the encrypted token to the application.

15. The method of claim 14, wherein the forwarding of the encrypted token further comprises:

transmitting the nonce to the application.

16. The method of claim 15, wherein the encrypted token is to be decrypted by the application using the nonce transmitted to the application along with the encrypted token.

17. The method of claim 14, further comprising:

preventing the application from accessing the requested resources until the application transmits the token retrieved from the encrypted token to the web service.

18. The method of claim 10, wherein the application comprises a mobile application, and wherein the application identification comprises a mobile application identification separate from an identification of a non-mobile version of the application.

19. The method of claim 10, wherein the security information is provided in the form of a system development kit (SDK) included in the application.

20. A non-transitory machine-readable storage device storing instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

identifying, by a user device security manager of a user device corresponding to a user of a web service, a first request issued from an application to access remote resources associated with the web service, the application executing at the user device and separate from the user device security manager;

acquiring, by the user device security manager, security information associated with the application in response to the identifying of the first request, the security information including at least one of an application identification, an access scope or a nonce for the application; and

transmitting a second request from the user device security manager to the web service to authenticate the application by the web service at least based on the application identification.