Automatic discovery and retrieval of interoperable applications

Patent metadata

Field	Value
Publication number	US-10469484-B1
Application number	US-201514970922-A
Country	US
Kind code	B1
Filing date	Dec 16, 2015
Priority date	Jan 27, 2015
Publication date	Nov 5, 2019
Grant date	Nov 5, 2019

Abstract

Implementations disclosed herein provide for a third-party application an ability to access a first-party notification interface without receiving credentials linked to a first-party user account. In addition, a device-level permission is established such that each third-party application operating on a client device does not need to seek permission to access the notification interface. A third-party application may request an access code from a client device. The access code may be presented to an authentication server. The authentication server may provide an access token and a refresh token to the third-party application. The third party application may provide the access token and data to be included in a notification to the first-party notification interface.

First claim

The invention claimed is:

1. A computer-implemented method, comprising:
receiving, by a client device associated with a first user account, a single device-level permission setting that grants a plurality of third-party applications permission to access a single first-party notification interface operating on the client device that would otherwise be restricted to use only by first-party applications on the client device, wherein the plurality of third-party applications comprises at least a first and a second third-party application;
receiving, from the first third-party application operating on the client device, a request for an access code that defines a level of access to the client device, wherein the first third-party application is associated with a second user account at a third-party service;
providing, from the client device to the first third-party application, the access code, wherein the access code is exchangeable by the first third party application for a refresh token and an access token provided by an authentication server;
receiving, from the first third-party application, the access token and data from the third-party service to be included in a notification generated by the first-party notification interface, wherein the access token was obtained by the first third-party application in response to a request comprising the access code;
presenting the notification on the client device;
subsequently receiving a request to deny permission for the second third-party application to access the first-party notification interface; and
in response to the request to deny permission, updating a setting of the client device to prevent the second third-party application from presenting notifications through the first-party notification interface.

2. The method of claim 1 , further comprising:
rejecting a notification request from the second third-party application, the notification request including data from a second third-party service to be included in a notification generated by the first-party notification interface.

3. The method of claim 1 , further comprising:
in response to the request to deny permission, revoking an access token that was previously provided to the second third-party application.

4. The method of claim 1 , further comprising:
receiving a revocation of permission for the plurality of third-party applications to access the first-party notification interface, wherein the revocation prevents the plurality of third-party applications from presenting any notifications through the first-party notification interface;
subsequently, receiving, a reinstatement of permission for the plurality of third-party applications to access the first-party notification interface; and
broadcasting to the third-party applications an indication of the reinstatement of permission.

5. The method of claim 1 , further comprising determining that the client device is a primary device for the first user account, wherein the first user account is also linked to a second client device.

6. The method of claim 5 , wherein the determination is based on a type of the client device.

7. The method of claim 5 , wherein the second client device has a third user account for a third third-party application that is not installed on the client device.

8. The method of claim 7 , wherein a third notice for the third third-party application is presented only on the second client device.

9. The method of claim 4 , further comprising:
receiving, from the first third-party application operating on the client device, a request to obtain a second access code for the first-party notification interface, wherein the second access code is exchanged for a new refresh token and a new access token by the authentication server.

10. A system, comprising:
a non-transitory computer-readable memory having program instructions stored thereon; and
a processor of a client device associated with a first user account, the processor configured execute the program instructions to:
receive a single device-level permission setting that grants a plurality of third-party applications permission to access a single first-party notification interface operating on the client device that would otherwise be restricted to use only by first-party applications on the client device, wherein the plurality of third-party applications comprises at least a first and a second third-party application;
receive, from the first third-party application operating on the client device, a first request for an access code that defines a level of access to the client device, wherein the first third-party application is associated with a second user account at a third-party service;
provide, from the client device to the first third-party application, the access code, wherein the access code is exchangeable by the third party application for a refresh token and an access token provided by an authentication server;
receive, from the first third-party application, the access token and data from the third-party service to be included in a notification generated by the first-party notification interface, wherein the access token was obtained by the first third-party application in response to a request comprising the access code;
present the notification on the client device;
subsequently receive a request to deny permission for a second third-party application to access the first-party notification interface; and
in response to the request to deny permission, update a setting of the client device to prevent the second third-party application from presenting notifications through the first-party notification interface.

11. The system of claim 10 , the processor further configured to execute program instructions to:
reject a notification request from the second third-party application, the notification request including data from a second third-party service to be included in a notification generated by the first-party notification interface.

12. The system of claim 11 , the processor further configured to execute program instructions to:
in response to the request to deny permission, revoke an access token that was previously provided to the second third-party application.

13. The system of claim 10 , the processor further configured to execute program instructions to:
receive a revocation of permission for the plurality of third-party applications to access the first-party notification interface, wherein the revocation prevents the plurality of third-party applications from presenting any notifications through the first-party notification interface;
subsequently, receive, a reinstatement of permission for the plurality of third-party applications to access the first-party notification interface; and
broadcast to the plurality of third-party applications an indication of the reinstatement of permission.

14. The system of claim 10 , the processor further configured to execute program instructions to determine that the client device is a primary device for the first user account, wherein the first user account is also linked to a second client device.

15. The system of claim 14 , wherein the determination is based on a type of the client device.

16. The system of claim 14 , wherein the second client device has a third user account for a third third-party application that is not installed on the client device.

17. The system of claim 16 , wherein a third notice for the third third-party application is presented only on the second client device.

18. The system of claim 13 , the processor further conf

Assignees

• Google Llc

Inventors

• Chen Muxing
• Lodha Chandan Gopal
• Shao Jie
• Maarse Jan Willem
• Praun Emil
• Gultekin Gokay Baris

Classifications

• G06F21/44 Primary

  Program or device authentication · CPC title

• H04L63/0807

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• H04L63/104

  Grouping of entities · CPC title

• H04L63/0853 Primary

  using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234) · CPC title

• H04L63/062

  for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819) · CPC title