Resolving authenticating issues with a second device

Patent metadata

Field	Value
Publication number	US-9787654-B2
Application number	US-201514927232-A
Country	US
Kind code	B2
Filing date	Oct 29, 2015
Priority date	Oct 29, 2015
Publication date	Oct 10, 2017
Grant date	Oct 10, 2017

Abstract

Authenticating issues involving the re-authenticating of a first device that was previously authenticated are resolved by use of a second device which receives a notification of the failed authentication. The second device sends a response to the notification which is operable to facilitate re-authentication of the primary device and without requiring the user to provide credentials at the first device prior to obtaining the re-authentication at the primary device and/or without requiring the primary device to obtain a code to be entered into the secondary device and/or prior to the primary device being notified of a failure condition associated with the primary device.

First claim

What is claimed is:

1. An identity provider system comprising:
at least one hardware processor configured to execute computer-executable instructions;
a hardware transmitter configured to transmit communications including one or more notifications to a primary device and one or more secondary devices over one or more network channels;
a hardware receiver configured to receive communications including one or more authentication requests and responses from the primary device and one or more secondary device over the one or more network channels;
one or more hardware storage device having one or more stored user account databases and stored computer-executable instructions that are executable by the at least one hardware processor to instantiate the following:
an authentication component configured for:
authenticating the primary device to the service provider in response to receiving a request for authentication from the primary device associated with a user;
receiving a subsequent request for authentication from the primary device to re-authenticate the primary device to the service provider for one or more service or transaction;
failing the subsequent request to re-authenticate the primary device to the service provider; and
re-authenticating the primary device to the service provider responsive to receiving a notification response from the one or more secondary devices which are associated with the user by user account information stored in the one or more user account databases; and

a notification component configured for:
responsive to the failing of the subsequent request, generating a notification regarding the failing of the subsequent request and sending the notification to the one or more secondary devices that associated with the user in the one more stored user account databases or providing the notification to the user in response to the user accessing the service provider through a network interface, the notification being sent or provided after a predetermined time that is designated for permitting the primary device or network interface to self-resolve the failing; and

receiving the notification response from the one or more secondary devices.

2. The identity provider system of claim 1 , wherein the notification response comprises data that distinguished from a code provided to the primary device during authentication.

3. The identity provider system of claim 1 , wherein the notification response includes an indication that an interface object presented in a user interface at the one or more secondary devices was selected by the user.

4. The identity provider system of claim 1 , wherein the notification response includes a biometric indicator received or detected at the one or more secondary devices.

5. The identity provider system of claim 1 , wherein the notification response includes character input entered by a user at the one or more secondary device.

6. The identity provider system of claim 1 , wherein the notification response is provided automatically by the secondary device when a predetermined response condition exists at the secondary device, wherein the predetermined response condition includes at least one of a user biometric condition detectable by the secondary device, a proximity state between the secondary device and the primary device, or a status of connectivity between the secondary device and the primary device.

7. The identity provider system of claim 1 , the authentication component authenticates the primary device to the service provider in response to receiving a code from the one or more secondary devices which was provided to the primary device from the identity provider system in response to the request for authentication.

8. The identity provider system of claim 1 , wherein the notification is provided to the user in response to the user accessing the identity provider through a network interface on a device other than the primary device.

9. The identity provider system of claim 1 , wherein re-authenticating the primary device to the service provider only occurs when the notification response is received within a predetermined time from the notification being sent, based on an expiration parameter associated with the notification.

10. The identity provider system of claim 1 , wherein the notification component is further configured to selectively identify the one or more secondary devices to send the notification to, from a plurality of different secondary devices associated with the user in the one or more user account databases, based on one on more attributes of the one or more service or transaction.

11. The identity provider system of claim 1 , wherein the notification component is further configured to send the notification to a third party through the one or more secondary devices based on the request for re-authentication and based on one on more attributes of the one or more service or transaction.

12. The identity provider system of claim 1 , wherein the notification specifies one or more types of required data to be submitted with the notification response and which must be received from the one more secondary devices prior to re-authenticating the primary device.

13. The identity provider system of claim 1 , wherein failing the subsequent request to re-authenticate the primary device to the service provider occurs in response to detecting one or more of an expiration or other change in user credentials, a security event, or a detected update.

14. The identity provider system of claim 1 , wherein failing the subsequent request to re-authenticate the primary device to the service provider occurs in response to detecting the subsequent request comprises a request for a particular type of one or more service or transaction.

15. The identity provider system of claim 14 , wherein the particular type of the one or more service or transaction comprises a purchase.

16. The identity provider system of claim 14 , wherein the particular type of the one or more service or transaction comprises a request for access to restricted data.

17. The identity provider system of claim 1 , wherein the notification component is further configured to establish a notification channel for communicating with the one or more secondary devices based on user account information stored in the one or more user account database that defines parameters for establishing the notification channel.

18. A secondary computing system configured for facilitating re-authentication of a primary device to an identity provider, the secondary computing system comprising:
at least one hardware processor configured to execute computer-executable instructions;
a hardware transmitter configured to transmit communications including one or more authentication communications and notification responses to an identity provider over one or more network channels;
a hardware receiver configured to receive communications including one or more notifications from the identity provider over the one or more network channels;
one or more hardware storage device having one or more stored computer-executable instructions that are executable by the at least one hardware processor to instantiate the following:
a notification component which:
receives a notification regarding failing of a re-authentication request submitted by a primary device to re-authenticate the primary device with a service provider, the primary device having been previously authenticated with the service provider, and the primary device being associated with the secondary computing system by

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Vincent Benjamin R
• Frei Adrian
• Chou James Shang Kai

Classifications

• G06F21/31 Primary

  User authentication · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• G06F21/32

  using biometric data, e.g. fingerprints, iris scans or voiceprints · CPC title

• H04L63/0853

  using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234) · CPC title

• H04L63/0861

  using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231) · CPC title