Sharing keys

Patent metadata

Field	Value
Publication number	US-9923879-B1
Application number	US-201514599162-A
Country	US
Kind code	B1
Filing date	Jan 16, 2015
Priority date	Jan 16, 2014
Publication date	Mar 20, 2018
Grant date	Mar 20, 2018

Abstract

The subject matter described herein can be embodied in a computer-readable medium storing instructions that cause one or more processors to perform operations including receiving, from a client device associated with a user account of a first user, a request to grant a second user access to a key associated with a credential. The credential is associated with the user account of the first user, the request includes an address of the second user, and the key permits access to a resource. The operations include accessing, at a server, a second user account based on the address of the second user, and associating, by the server, the key with the second user account, such that the second user is enabled to access the resource. The operations further include communicating, to the address of the second user, a message indicating that the second user account has been associated with the key.

First claim

What is claimed is:

1. A non-transitory computer-readable storage medium including instructions, which upon execution by one or more processors, cause the one or more processors to perform operations comprising:
receiving, from a client device associated with a user account of a first user, a request to grant a second user access to a key associated with a credential, the credential being associated with the user account of the first user, and the request including an address of the second user, wherein the key permits access to a resource;
in response to receiving the request, accessing, at a server system, a second user account based on the address of the second user;
before granting the second user access to the key:
sending, by the server system, a message to the address of the second user, the message identifying the key;
before authenticating the second user for access to the key and before modifying one or more permissions or authorizations to grant the second user access to the key, receiving, by the server system from a device associated with the second user, (i) a second message that requests access to the key and (ii) a third message that includes authentication information for the second user; and
authenticating, by the server system, the second user based on the received authentication information;

in response to authenticating the second user, granting, by the server system, the second user access to the key by modifying one or more permissions or authorizations such that the second user is enabled to obtain, from the server system and using the second user account, a representation of the key that allows access to the resource;
communicating, to the address of the second user, a message indicating that the second user account has been associated with the key;
after the communicating, receiving, by the server system, a second request associated with the second user account; and
in response to receiving the second request, providing, by the server system, (i) credential information indicating a set of credentials associated with the second user account, (ii) key information indicating a set of keys associated with the second user account, or (iii) both the credential information and the key information.

2. The non-transitory computer-readable storage medium of claim 1 , wherein the operations further comprise:
determining, at the server system, that the user account of the first user is authorized to provide the second user access to the key associated with the credential.

3. The non-transitory computer-readable storage medium of claim 1 , wherein the operations further comprise:
in response to receiving the authentication information for the second user, retrieving the second user account based on the authentication information.

4. The non-transitory computer-readable storage medium of claim 1 , wherein the operations further comprise:
determining that the second user does not have an account;
sending an invitation to the to the address of the second user to invite the second user to create the second user account upon determining that the second user does not have a user account;
receiving a response to the invitation; and
generating the second user account based on the response.

5. The non-transitory computer-readable storage medium of claim 4 , wherein the invitation includes a uniform resource locator (URL) that permits the second user to provide authentication information for generating the second user account.

6. The non-transitory computer-readable storage medium of claim 1 , wherein the address of the second user is one of an e-mail address, a social network account address, a phone number, and an instant messaging account address.

7. The non-transitory computer-readable storage medium of claim 1 , wherein:
the request to grant the second user access to the key includes one or more constraints on access for the second user to the key; and
the third message is received after the second message.

8. The non-transitory computer-readable storage medium of claim 7 , wherein the one or more constraints include at least one of a time, a location, and a presence of the first user.

9. A computer-implemented method comprising:
receiving, from a client device associated with a user account of a first user, a request to grant a second user access to a key associated with a credential, the credential being associated with the user account of the first user, and the request including an address of the second user, wherein the key permits access to a resource;
in response to receiving the request, accessing, at a server system, a second user account based on the address of the second user;
before granting the second user access to the key:
sending, by the server system, a message to the address of the second user, the message identifying the key;
before authenticating the second user for access to the key and before modifying one or more permissions or authorizations to grant the second user access to the key, receiving, by the server system from a device associated with the second user, (i) a second message that requests access to the key and (ii) a third message that includes authentication information for the second user; and
authenticating, by the server system, the second user based on the received authentication information;

in response to authenticating the second user, granting, by the server system, the second user access to the key by modifying one or more permissions or authorizations such that the second user is enabled to obtain, from the server system and using the second user account, a representation of the key that allows access to the resource;
communicating, to the address of the second user, a message indicating that the second user account has been associated with the key;
after the communicating, receiving, by the server system, a second request associated with the second user account; and
in response to receiving the second request, providing, by the server system, (i) credential information indicating a set of credentials associated with the second user account, (ii) key information indicating a set of keys associated with the second user account, or (iii) both the credential information and the key information.

10. The computer-implemented method of claim 9 , further comprising:
determining, at the server system, that the user account of the first user is authorized to provide the second user access to the key associated with the credential.

11. The computer-implemented method of claim 9 , further comprising:
in response to receiving the authentication information for the second user, retrieving the second user account based on the authentication information.

12. The computer-implemented method of claim 9 , further comprising:
determining that the second user does not have an account; sending an invitation to the to the address of the second user to invite the second user to create the second user account upon determining that the second user does not have a user account;
receiving a response to the invitation; and
generating the second user account based on the response.

13. The computer-implemented method of claim 12 , wherein the invitation includes a uniform resource locator (URL) that permits the second user to provide authentication information for generating the second user account; and
wherein the address of the second user is one of an e-mail address, a social network account address, a phone number, and an instant messaging account address.

14. The computer-implemented method of claim 9 , wherein:
the request to grant the second user access to the

Assignees

• Microstrategy Inc

Inventors

• Ziraknejad Siamak
• Jung Hanna
• Gehret John

Classifications

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/06 Primary

  for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08) · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L63/108

  when the policy decisions are valid for a limited amount of time · CPC title

• H04L63/107

  wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals · CPC title