Broadcast-based trust establishment

Patent metadata

Field	Value
Publication number	US-10587617-B2
Application number	US-201715620593-A
Country	US
Kind code	B2
Filing date	Jun 12, 2017
Priority date	Sep 25, 2014
Publication date	Mar 10, 2020
Grant date	Mar 10, 2020

Abstract

A method and apparatus for device authentication are provided. In the method and apparatus, authentication data for a first device is received. The first device is then authenticated based at least in part on demonstrated access to authentication data prior to broadcast of the authentication data. One or more actions may be taken in response to the authentication of the first device based at least in part on the demonstrated access to the authentication data.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
receiving a request for authentication data from a device;
providing, to the device, a response to the request comprising the authentication data and information usable to determine a public communication channel, where the public communication channel is a broadcast channel through which the authentication data is broadcast;
generating a data portion for transmission over the public communication channel that allows the device to determine that the data portion matches the authentication data;
causing the data portion to be transmitted over the public communication channel; and
obtaining, from the device, an indication that the authentication data was provided prior to the data portion being transmitted over the public communication channel.

2. The computer-implemented method of claim 1 , wherein the public communication channel is a printed publication published at a time after the authentication data is provided.

3. The computer-implemented method of claim 1 , wherein the request for the authentication data includes a user name associated with an authenticator device that provides authentication of an entity utilizing the authenticator device.

4. The computer-implemented method of claim 1 , wherein the data portion includes the authentication data.

5. The computer-implemented method of claim 1 , wherein the data portion is used to derive the authentication data.

6. The computer-implemented method of claim 1 , wherein the authentication data is used to derive the data portion.

7. A system, comprising at least one computing device that implements one or more services, wherein the one or more services:
receive a request for authentication data from a user device;
provide, in a response to the request, the authentication data and information indicating a public communication channel, the public communication channel is a broadcast channel through which the authentication data is broadcast;
generate data for transmission over the public communication channel, the data including a data portion allows the user device to verify the authentication data;
cause the data to be transmitted over the public communication channel; and
obtain, from the user device, an indication that the authentication data was provided before the data was transmitted over the public communication channel.

8. The system of claim 7 , wherein the data portion includes the authentication data.

9. The system of claim 7 , wherein the authentication data is provided as part of a payment transaction and is used to determine funds are available to complete the payment transaction.

10. The system of claim 7 , wherein the authentication data is associated with a validity period during which the data portion corresponds to the authentication data.

11. The system of claim 7 , wherein the public communication channel is a broadcast channel through which the data is broadcast.

12. The system of claim 7 , wherein the response to the request further includes a listening key used to obtain access to the public communication channel.

13. The system of claim 7 , wherein the authentication data is provided using a Secure Sockets Layer cryptographic protocol.

14. A non-transitory computer-readable storage medium storing thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:
provide, in response to a request for authentication data, the authentication data and information encoding a public communication channel, where the public communication channel is a broadcast channel through which the authentication data is broadcast;
generate a data portion that, upon receipt by a user device, can be used by the user device to verify the authenticated data;
cause the data portion to be transmitted over the public communication channel, the data portion transmitted after the response to the request for authentication data is provided; and
receive, from the user device, a response indicating that the authentication data was obtained by the user device prior to the data portion being transmitted over the public communication channel.

15. The non-transitory computer-readable storage medium of claim 14 , wherein the public communication channel is a wireless local area network.

16. The non-transitory computer-readable storage medium of claim 14 , wherein the data portion is used to derive the authentication data.

17. The non-transitory computer-readable storage medium of claim 14 , wherein the data portion includes the authentication data.

18. The non-transitory computer-readable storage medium of claim 14 , wherein the data portion is derived from the authentication data.

19. The non-transitory computer-readable storage medium of claim 14 , wherein:
the request for the authentication data includes a username; and
the instructions that cause the computer system to provide the authentication data further cause the computer system to verify that the username corresponds to an entity authorized to obtain the authentication data.

20. The computer-implemented method of claim 1 , wherein the broadcast channel further comprises at least one of: a radio channel, a television channel, a newspaper, a magazine, a blog, a social networking feed, and a voice greeting message for a phone number.

Assignees

• Amazon Tech Inc

Inventors

• Mcclintock Jon Arron
• Canavor Darren Ernest
• Stathakopoulos George Nikolaos

Classifications

• G06Q20/40

  Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists · CPC title

• H04L63/126

  the source of the received data · CPC title

• H04L63/0884

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title

• H04L63/0876 Primary

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title