TRUSTED STATUS TRANSFER BETWEEN ASSOCIATED DEVICES

• US 20160359848A1
• Filed: 05/27/2016
• Published: 12/08/2016
• Est. Priority Date: 06/07/2015
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: WILSON, James C., ALI, Lestat, ARROMRATANA, Aniwat
• Granted Patent: US 10,063,540 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 2221/2131 Lost password, e.g. recovery of lost or forgotten passwords
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04W 12/065 Continuous authentication
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications

Abstract

The embodiments set forth systems and techniques to authenticate a user device for device services, such as by transferring or extending a trusted device status from a separate and trusted associated user device, which can be paired with the user device. This can be done automatically without requiring the user to sign in at or on behalf of the user device, and the automated process can include verifying a trusted status for the associated user device, receiving data items from both devices, evaluating the data items, and facilitating an authentication of the user device when the evaluating returns a favorable result. Data items can include provisioned machine identifiers, temporally limited one-time user passwords, and a provisioned password reset key. Authentication or trusted device status transfer can be achieved by way of an authentication token that is given to the user device.

Claims

1. A method for authenticating a user device, comprising:

verifying a trusted status for an associated user device, wherein the trusted status includes an existing authentication for the associated user device;

receiving data items from the associated user device and the user device, wherein the data items include an identification of the associated user device, an identification of the user device, and an indicator that the user device is associated with the associated user device;

evaluating the user device data items with the associated user device data items; and

facilitating an authentication of the user device when the evaluating returns a favorable result.

2. The method of claim 1, wherein the authentication of the user device comprises an extension of the existing authentication for the associated user device.

3. The method of claim 1, wherein the data items further include a password reset key that is unique to the associated user device.

4. The method of claim 1, wherein the data items further include a first one-time password from the associated user device and a second one-time password from the user device.

5. The method of claim 4, wherein each one-time password is valid only for a set amount of time after the one-time password is formed.

6. The method of claim 5, wherein the set amount of time is thirty seconds.

7. The method of claim 4, wherein the evaluating includes verifying that the second one-time password was formed while the first one-time password was still valid.

8. The method of claim 1, wherein the user device is paired to the associated user device.

9. The method of claim 8, wherein the user device comprises a smart watch and the associated user device comprises a smart phone.

10. The method of claim 8, wherein the user device comprises a digital media extender.

11. The method of claim 1, wherein the method is performed by a device services manager that is located remotely from both of the user device and the associated user device.

12. The method of claim 11, wherein the identification of the associated user device comprises a unique machine identifier previously provisioned to the associated user device from the device services manager.

13. The method of claim 1, further comprising:

generating a token for the user device when the evaluating returns a favorable result; and

sending the token to the associated user device, wherein use of the token by the user device extends the trusted status for the associated user device to the user device when the associated user device provides the token to the user device.

14. A system adapted to authenticate an electronic device for a user, the system comprising:

a processor configured to implement a device services manager that is configured to;

verify a trusted status for an associated user device, wherein the trusted status includes an existing authentication for the associated user device;

receive data items from both of the associated user device and the electronic device, wherein the associated user device data items include a unique associated user device machine identifier and a first one-time password, and the electronic device data items include a unique electronic device machine identifier and a second one-time password;

evaluating the electronic device data items with the associated user device data items;

generating an authentication token when the evaluating returns a favorable result; and

sending the authentication token to the associated user device, wherein use of the authentication token by the electronic device extends the existing authentication for the associated user device to the electronic device when the associated user device provides the authentication token to the electronic device, such that the user is not required to sign in and authenticate manually on the added user device.

15. The system of claim 14, wherein the associated user device data items further include a unique password reset key that belongs to the associated user device.

16. The system of claim 14, wherein the first one-time password and the second one-time password are both formed using unique password reset keys.

17. The system of claim 14, wherein each one-time password is valid only for a set amount of time after the one-time password is formed.

18. The system of claim 17, wherein the evaluating includes verifying that the second one-time password was formed while the first one-time password was still valid.

19. The system of claim 14, wherein the unique associated user device machine identifier was previously provisioned to the associated user device from the device services manager.

20. A non-transitory computer readable storage medium configured to store instructions that, when executed by a processor included in a computing device, cause the processor to implement a device services manager configured to authenticate an added user device by carrying out steps that include:

verifying a trusted status for an associated user device that is paired with the added user device, wherein the trusted status includes an existing authentication for the associated user device;

receiving data items from both of the associated user device and the added user device, wherein the associated user device data items include a provisioned associated user device machine identifier, a first one-time password that is valid only for a set amount of time after it is formed, and a unique password reset key, and the added user device data items include a provisioned added user device machine identifier, and a second one-time password that is valid only for a set amount of time after it is formed;

evaluating the data items, wherein the evaluating includes determining whether the second one-time password was formed while the first one-time password was still valid; and

facilitating an authentication of the added user device by extending the trusted status for the associated user device to include the added user device when the evaluating returns a favorable result.