Native authentication experience with failover

Patent metadata

Field	Value
Publication number	US-9614828-B1
Application number	US-201514589534-A
Country	US
Kind code	B1
Filing date	Jan 5, 2015
Priority date	Jan 5, 2015
Publication date	Apr 4, 2017
Grant date	Apr 4, 2017

Abstract

Disclosed are various embodiments for providing a native authentication experience with failover. If a particular authentication approach is supported by a network service, an application authenticates with the network service according to the authentication approach using an authentication factor received via a platform-specific interface. If the particular authentication approach is not supported, code-based linking may be employed to authenticate via another application that is authenticated with the network service.

First claim

Therefore, the following is claimed:

1. A non-transitory computer-readable medium embodying a native application executable in at least one computing device, wherein when executed the native application causes the at least one computing device to at least:
request to access an account with a network service;
in response to receiving a request for an authentication factor from the network service, determine whether the authentication factor is supported by the native application;
in response to determining that the authentication factor is supported by the native application, authenticate with the network service to access the account using the authentication factor received via a platform-specific application programming interface that is native to the at least one computing device;
in response to determining that the authentication factor is not supported by the native application due to a change in how authentication is performed by the network service, render a uniform resource identifier (URI) upon a display, the URI including a public code received from the network service; and
after the URI is accessed by a browser-based application that is or becomes authenticated with the network service to access the account, authenticate with the network service to access the account using a private code received from the network service, the private code being paired with the public code.

2. The non-transitory computer-readable medium of claim 1 , wherein the URI is a uniform resource locator (URL) specifying an access mechanism.

3. The non-transitory computer-readable medium of claim 1 , wherein the browser-based application is authenticated with the network service to access the account prior to accessing the URI.

4. The non-transitory computer-readable medium of claim 1 , wherein the browser-based application is authenticated with the network service to access the account after accessing the URI.

5. A system, comprising:
a computing device comprising a processor and a memory; and
a first application, stored in the memory, executable in the computing device, wherein when executed the first application causes the computing device to at least:
determine whether an authentication approach is supported by a network service;
in response to determining that the authentication approach is supported by the network service, authenticate with the network service according to the authentication approach using at least one authentication factor received via a platform-specific application programming interface that is native to the computing device; and
in response to determining that the authentication approach is not supported by the network service due to a change in how authentication is performed by the network service, facilitate code-based linking via a second application that is authenticated with the network service.

6. The system of claim 5 , wherein the code-based linking comprises presenting, by the first application, a code received from the network service, wherein the network service is configured to authenticate the first application in response to receiving the code via the second application.

7. The system of claim 5 , wherein the code-based linking comprises presenting, by the second application, a code received from the network service, wherein the network service is configured to authenticate the first application in response to receiving the code via the first application.

8. The system of claim 5 , wherein the first application is a native application, and the second application is a browser-based application.

9. The system of claim 5 , wherein when executed the first application further causes the computing device to at least launch the second application in response to determining that the authentication approach is not supported by the network service.

10. The system of claim 9 , wherein the second application is configured to load a network page that elicits a code from a user.

11. The system of claim 5 , wherein determining whether the authentication approach is supported is based at least in part on a particular authentication factor requested by the network service.

12. The system of claim 5 , wherein determining whether the authentication approach is supported is based at least in part on a version identifier received from the network service.

13. The system of claim 5 , wherein the first application is executed by a first computing device, and the second application is executed by a second computing device.

14. A method, comprising:
receiving, via at least one of one or more computing devices, an authentication request from a first application;
identifying, via at least one of the one or more computing devices, an authentication factor provided via a platform-specific application programming interface native to a computing device upon which the first application is executed;
determining, via at least one of the one or more computing devices, that the authentication factor is not supported due to a change in how authentication is performed by the one or more computing devices;
providing, via at least one of the one or more computing devices, a code to the first application in response to determining that the authentication factor is not supported; and
authenticating, via at least one of the one or more computing devices, the first application in response to receiving the code from a second application that is authenticated.

15. The method of claim 14 , wherein determining, via at least one of the one or more computing devices, that the authentication factor is not supported further comprises determining that the authentication factor is required by the first application but is not supported by the one or more computing devices.

16. The method of claim 14 , wherein determining, via at least one of the one or more computing devices, that the authentication factor is not supported further comprises the authentication factor is required by the one or more computing devices but is not supported by the first application.

17. The method of claim 14 , further comprising, before determining that the authentication factor is unsupported, receiving another authentication factor supplied via the platform-specific application programming interface from the first application.

18. The method of claim 14 , wherein the code corresponds to a public code, and the method further comprises:
providing, via at least one of the one or more computing device, a private code along with the public code to the first application; and
authenticating, via at least one of the one or more computing devices, the first application in response to receiving the private code from the first application in addition to receiving the public code from the second application.

19. The method of claim 14 , wherein the second application is authenticated via a browser-based authentication before the code is received from the second application.

20. The method of claim 14 , wherein the second application is authenticated via a browser-based authentication after the code received from the second application.

Assignees

• Amazon Tech Inc

Inventors

• Golwalkar Yogesh Vilas
• Joshi Anuj
• Bhimanaik Bharath Kumar
• Millwood Lorne
• Poston Iv Carl Lucian

Classifications

• H04L9/3234

  involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853) · CPC title

• H04L9/321

  involving a third party or a trusted authority · CPC title

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• G06F21/44

  Program or device authentication · CPC title

• G06F2221/2117

  User registration · CPC title