Credential manager integration

Patent metadata

Field	Value
Publication number	US-11568039-B2
Application number	US-201816146567-A
Country	US
Kind code	B2
Filing date	Sep 28, 2018
Priority date	Jun 3, 2018
Publication date	Jan 31, 2023
Grant date	Jan 31, 2023

Abstract

Techniques are disclosed relating to credential managers. In some embodiments, a computing device maintains a credential manager that stores, in a protected manner, a set of credentials for authenticating a user and metadata about the credentials. The computing device stores an instance of the metadata externally to the credential manager. The computing device uses the externally stored metadata to determine whether the set of credentials includes a particular credential associated with a service and, in response to determining that the set of credentials includes the particular credential, displays an indication of the particular credential. In some embodiments, the computing device receives a selection of the displayed indication by the user and, in response to the selection, sends a request for the particular credential to the credential manager.

First claim

What is claimed is:

1. A non-transitory computer readable medium having program instructions of a program stored therein that are executable by a computing device to cause the computing device to perform operations comprising:
receiving an indication of an authentication prompt for a credential of a service to which a user of the computing device is to be authenticated, wherein the program is executable to interact with a credential manager, wherein the credential manager stores, in a protected manner, (1) a set of credentials for authenticating the user to a plurality of services and (2) metadata about the set of credentials, wherein the metadata is not accessible to the program;
storing, external to the credential manager, a separate copy of the metadata such that the separate copy is accessible to the program;
querying the separate copy of the metadata to determine whether the set of credentials includes a particular credential associated with the service in order to reduce accesses to the credential manager; and
in response to determining, from the separate copy of the metadata, that the set of credentials includes the particular credential, causing display of an indication of the particular credential on the computing device.

2. The computer readable medium of claim 1 , wherein the operations comprise:
receiving a selection of the displayed indication by the user; and
in response to the selection, sending a request for the particular credential to the credential manager.

3. The computer readable medium of claim 2 , wherein the operations comprise:
receiving the particular credential from the credential manager; and
automatically supplying the particular credential to one or more input fields in the authentication prompt.

4. The computer readable medium of claim 1 , wherein the metadata includes, for the particular credential, a username, a credential type, and a service identifier, wherein the querying includes identifying the particular credential based on the service identifier being associated with the service, and wherein the displayed indication identifies the username for the particular credential and the credential type for the particular credential.

5. The computer readable medium of claim 1 , wherein the metadata includes a first ranking for a first credential associated with the service and a second ranking for a second credential associated with the service, and wherein the querying includes selecting one of the first and second credentials as the particular credential based on the first and second rankings.

6. The computer readable medium of claim 1 , wherein storing the set of credentials and the metadata about the set of credentials in a protected manner includes:
maintaining the credential manager in a container operable to isolate data of the credential manager from other applications executing on the computing device, wherein the container includes the set of credentials and the metadata about the set of credentials.

7. The computer readable medium of claim 6 , wherein the operations comprise:
receiving a request to delete the credential manager; and
in response to the request, deleting the container, including deleting the metadata about the set of credentials.

8. The computer readable medium of claim 1 , wherein the operations comprise:
presenting, by an operating system of the computing device, an application programming interface (API) for communicating with the credential manager; and
receiving the separate copy of the metadata from the credential manager via the API presented by the operating system.

9. The computer readable medium of claim 1 , wherein the operations comprise:
maintaining a plurality of credential managers that store credentials for authenticating the user, wherein the displayed indication identifies a name of the credential manager storing the particular credential.

10. The computer readable medium of claim 1 , wherein the credential manager is a third-party credential manager.

11. A method, comprising:
interacting, by a program executing on a computing device, with a credential manager that stores, in a protected manner, (1) a set of credentials for authenticating a user to a plurality of services, and (2) metadata about the set of credentials, the metadata not being accessible to the program;
storing, external to the credential manager, a separate copy of the metadata such that the separate copy is accessible to the program;
receiving, by the program, an indication that an authentication prompt is being presented for a credential of a service to which the user of the computing device is to be authenticated;
querying, by the program, the separate copy of the metadata stored externally to the credential manager to determine whether the set of credentials includes a particular credential associated with the service, wherein the querying reduces accesses to the credential manager; and
in response to determining, from the separate copy of the metadata, that the set of credentials includes the particular credential, causing display, by the computing device, of an indication of the particular credential, wherein the indication of the particular credential is selectable by the user to populate the authentication prompt with the particular credential on the computing device.

12. The method of claim 11 , wherein the metadata about the set of credentials includes a respective username and a respective service identifier for ones of the set of credentials.

13. The method of claim 12 , wherein a respective one of the service identifiers is associated with a name of an application or a domain of a website.

14. The method of claim 11 , further comprising:
instantiating, by the computing device, a container operable to isolate the credential manager from other applications; and
storing, by the computing device, the credential manager, including the set of credentials and the metadata about the set of credentials, within the container.

15. The method of claim 11 , wherein the method comprises:
presenting, by an operating system of the computing device, an application programming interface (API) for communicating with the credential manager; and
receiving the separate copy of the metadata from the credential manager via the API presented by the operating system.

16. A computing device, comprising:
a processor circuit; and
a memory storing first program instructions executable by the processor circuit to implement a credential manager that stores, in a protected manner, (1) a set of credentials for authenticating a user of the computing device to a plurality of services and (2) metadata about the set of credentials, the memory storing second program instructions executable by the processor circuit to implement a program that:
receives an indication of an authentication prompt for a credential of a service to which the user is to be authenticated, wherein the program is executable to interact with the credential manager, but the metadata is not accessible to the program;
querying a separate copy of the metadata, which is accessible to the program and is stored external to the credential manager, to determine whether the set of credentials includes a particular credential associated with the service in order to reduce accesses to the credential manager; and
in response to determining, from the separate copy of the metadata, that the set of credentials includes the particular credential, causing display of an indication of the particular credential on the computing device.

Assignees

• Apple Inc

Inventors

• Abbasian Reza
• Mondello Richard J
• Quesada David P
• Brogle Kyle C
• Coffman Patrick L

Classifications

• G06F21/45 Primary

  Structures or tools for the administration of authentication · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L63/083 Primary

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• G06F2221/2103

  Challenge-response · CPC title

• G06F2221/2115

  Third party · CPC title