System and method for performing an action based upon two-party authorization

Patent metadata

Field	Value
Publication number	US-9602508-B1
Application number	US-201414583501-A
Country	US
Kind code	B1
Filing date	Dec 26, 2014
Priority date	Dec 26, 2013
Publication date	Mar 21, 2017
Grant date	Mar 21, 2017

Abstract

An action is permitted to be performed on a computing device only after the action has been confirmed by two or more authorized and/or authenticated parties. A security component receives a request from to initiate an action on a computing device. Before the action is allowed to be initiated on the computing device the security component requires the authentication of first and second parties or authorizations from first and second parties, or both the authentications of and authorizations from first and second parties. After receiving the required authorizations and/or successfully performing the required authentications, the security component allows the requested action to be initiated on the computing device.

First claim

What is claimed is:

1. A method comprising:
receiving, by a first server running a security component, a notification regarding a computing device different from the first server;
sending at least one instruction to the computing device, by the security component in response to the notification, to deny use of at least one computing device function until the computing device receives at least one instruction from the security component to permit the use of the at least one denied computing device function;
receiving, by the security component, a request from a requesting party to initiate an action on the computing device, the action requiring the use of the at least one denied computing device function;
sending, by the security component in response to the request, a message to a set of designated authorizing parties, the message regarding whether to permit the use of the at least one denied computing device function;
authenticating, by the security component, a first party, the first party being from the set of designated authorizing parties;
authenticating, by the security component, a second party, the second party being from the set of designated authorizing parties, the second party being different from the first party;
receiving, by the security component, authorization from the first party;
receiving, by the security component, authorization from the second party; and
after successful authentications of the first and second parties and receipt of the authorization from the first party and receipt of the authorization from the second party, by the security component running on the first server, sending, by the security component, at least one instruction to the computing device that permits the use of the at least one denied computing device function and permits the action requiring the use of the at least one denied computing device function.

2. The method of claim 1 , the sending, by the security component, at least one instruction to the computing device that permits the action requiring the use of the at least one denied computing device function including sending the request to the computing device.

3. The method of claim 2 , the request to initiate an action being communicated to a secure boot environment on the computing device to initiate the disabling of the computing device.

4. The method of claim 1 , the sending, by the security component, at least one instruction to the computing device that permits the action requiring the use of the at least one denied computing device function including sending notice of the successful authentications of the first and second parties to the computing device.

5. The method of claim 1 , the action disabling at least one function on the computing device.

6. The method of claim 1 , the computing device including a smartphone; the action modifying the smartphone to render inoperable to an unauthorized user functions of the smartphone, the functions including: voice communications, text messaging, the ability to browse a network, and the ability to access and use mobile software applications; and at least a subset of the modifications made to the smartphone after accessing a device environment that provides protection from a hard reset to the subset of modifications.

7. The method of claim 1 , the requesting party, first party, or the second party including: an owner of the computing device, a user of the computing device, a mobile network operator, a carrier, an administrator, an agent of government, or a computing device manufacturer.

8. The method of claim 1 , the authenticating, by the security component, the first party or the second party including the security component receiving notice of authenticity of the first party or the second party from a call center.

9. The method of claim 1 , the authenticating, by the security component, the first party or the second party including the security component receiving notice of authenticity of the first party or the second party from the computing device.

10. The method of claim 1 , the authenticating, by the security component, the first party including the first party providing proof of knowledge of a first secret, the proof not including the first secret; the authenticating, by the security component, the second party including the second party providing proof of knowledge of a second secret, the proof not including the second secret; the method further including provisioning a result of the first secret and a result of the second secret on the first server.

11. The method of claim 10 , the first secret or the second secret including: a password; a biometric measure; a token; or a physical device.

12. The method of claim 10 , the knowledge of a secret, provided by the party being authenticated, including a proof provisioned on the computing device or on a second server accessible by the first server.

13. The method of claim 12 , the proof including a private key.

14. The method of claim 12 , the proof being based on a password.

15. The method of claim 10 , the first party or the second party being a third party identity provider provided with the proof necessary to prove knowledge of the first secret or the second secret by an end user.

16. The method of claim 15 , the proof provided by the end user to the third party identify provider being stored by the third party identity provider in an escrow account.

17. The method of claim 10 , the request received by the security component being from a customer service center, the method further including the security component receiving the proof of knowledge of the first secret or the proof of knowledge of the second secret from the customer service center.

18. The method of claim 17 , the customer service center being operated by a manufacturer of the computing device, a provider of the security component, or a mobile network operator.

19. The method of claim 10 , the first or second secret being an end-user secret and a security program with access to the end-user secret generating the first or second proof using the end-user secret and provisioning the first or second proof on the first server.

20. The method of claim 10 , further including the first secret or the second secret being provisioned on the computing device by a user:
accessing a secure environment on the computing device, the secure environment bypassing a host operating system;
opening in the secure environment a user interface; and
providing, using the user interface, the first secret.

21. The method of claim 1 , the action including updating firmware.

22. The method of claim 1 , the authorization from the first party including the first party presenting a first authorization credential and the authorization from the second party including the second party presenting a second authorization credential.

23. The method of claim 22 , further comprising provisioning the first party with the first authorization credential and provisioning the second party with the second authorization credential.

24. The method of claim 23 , wherein the first party is a mobile communication device and the second party is a server, wherein the first authorization credential includes a password unknown to the second party and wherein the password is used to create the second authorization credential, the second authorization credential unknown to the first party.

25. The method of claim 1 , further comprising:
authenticating, b

Assignees

• Lookout Inc

Inventors

• Mahaffey Kevin Patrick
• Wyatt Timothy Micheal
• Buck Brian James
• Baker Matthew Robert
• Kingsley Danielle Hewson
• Teoh Elaine P
• Rogers Marc William

Classifications

• H04L9/0643

  Hash functions, e.g. MD5, SHA, HMAC or f9 MAC · CPC title

• H04L63/0869 Primary

  for achieving mutual authentication (cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273) · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04L9/3271

  using challenge-response · CPC title

• H04L63/083 Primary

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title