System for authenticating and processing service requests

Patent metadata

Field	Value
Publication number	US-9967248-B1
Application number	US-201514980350-A
Country	US
Kind code	B1
Filing date	Dec 28, 2015
Priority date	Dec 28, 2015
Publication date	May 8, 2018
Grant date	May 8, 2018

Abstract

Described are techniques for establishing secure communication channels between user devices and service providing devices. Correspondence between a request received from a user device and security data may be used to determine that the user device has provided a valid access credential. The access credential may be replaced with a subsequent access credential after use. Correspondence between the request and service data may be used to determine that the request may be processed by the receiving service and that the user device has the permissions necessary for the request to be processed. Portions of the request that meet these criteria may be provided to the service. The secure communication channel may also be used to provide the response from the service to the user device.

First claim

What is claimed is:

1. A system comprising:
one or more memories storing computer-executable instructions; and
one or more hardware processors configured to execute the computer-executable instructions to:
receive a first request from a user device, the first request including a device identifier associated with the user device, a service identifier associated with a service, an initial authentication credential, and request data associated with a function to be performed by the service, the function including one or more of providing an application, an update to the application, or an output from executing the application from the service to the user device;
access security data associating device identifiers with authentication credentials;
determine correspondence between the device identifier associated with the user device and a particular device identifier of the security data, the correspondence indicating a first expected authentication credential associated with the particular device identifier;
determine correspondence between the initial authentication credential of the user device and the first expected authentication credential of the security data, wherein the correspondence indicates that the initial authentication credential is valid;
establish a communication channel with the user device based at least in part on the correspondence between the initial authentication credential and the first expected authentication credential, the communication channel configured to provide one or more of the application, the update, or the output from the service to the user device;
access service data associating service identifiers with particular request data;
determine correspondence between the request data associated with the request and the particular request data associated with the service data, the correspondence indicating one or more of: the service being configured to process the request or the user device being authorized to provide the request;
based on the correspondence between the request data and the service data, provide at least a portion of the request to the service;
receive a response from the service, the response including the one or more of the application, the update, or the output;
in response to the correspondence between the initial authentication credential and the first expected authentication credential, generate a second authentication credential;
modify the security data to associate the second authentication credential with the particular device identifier, forming modified security data;
provide at least a portion of the response and the second authentication credential to the user device via the communication channel;
receive a second request, the second request including the device identifier associated with the user device and the initial authentication credential;
determine correspondence between the device identifier associated with the user device and the particular device identifier of the modified security data, the correspondence indicating a second expected authentication credential associated with the particular device identifier;
determine a mismatch between the initial authentication credential and the second expected authentication credential; and
based at least in part on the mismatch, perform a control action associated with the second request.

2. The system of claim 1 , further comprising computer-executable instructions to:
determine an access request associated with the user device;
provide an interface requesting authentication data to the user device;
receive the authentication data from the user device, wherein at least a portion of the authentication data includes data generated external to the system that identifies the user device;
responsive to receipt of the authentication data, generate the initial authentication credential and provide the initial authentication credential to the user device; and
modify the security data to include an indication of the initial authentication credential.

3. The system of claim 1 , further comprising computer-executable instructions to:
determine a first format associated with the request received from the user device;
determine a second format associated with the service by one or more of:
determining the second format based on the service data;
providing a request for data indicative of the second format to the service; or
accessing a directory associating service identifiers with formats;

modify the at least a portion of the request from the first format to the second format prior to providing the at least a portion of the request to the service;
determine the second format associated with the response received from the service; and
modify the at least a portion of the response from the second format associated with the service to the first format associated with the user device prior to providing the at least a portion of the response to the user device.

4. The system of claim 1 , wherein the security data further associates periods of time with the authentication credentials, the system further comprising computer-executable instructions to:
determine expiration of a period of time associated with the second authentication credential;
generate a third authentication credential;
modify the modified security data to associate the third authentication credential with the particular device identifier and disassociate the second authentication credential from the particular device identifier; and
provide the third authentication credential to the user device.

5. A method comprising:
receiving a first request from a user device, the first request including a first authentication credential;
determining correspondence between the first authentication credential and security data indicative of one or more expected authentication credentials, the one or more expected authentication credentials including the first authentication credential, wherein the correspondence between the first authentication credential and the security data indicates that the first authentication credential is valid;
in response to determining that the first authentication credential is valid, modifying the one or more expected authentication credentials to include a second authentication credential;
responsive to receiving the first request, providing the second authentication credential to the user device;
receiving a second request from the user device, the second request including the first authentication credential;
determining correspondence between the first authentication credential and the security data, the correspondence indicating that the one or more expected authentication credentials associated with the user device include the second authentication credential; and
performing a control action based at least in part on the correspondence between the first authentication credential and the security data.

6. The method of claim 5 , further comprising:
requesting confirmation associated with the second authentication credential from the user device; and
responsive to receiving the second request including the first authentication credential, determining that the confirmation associated with the second authentication credential has not been received and that the security data indicates that the first authentication credential is valid;
wherein the control action includes accepting the second request.

7. The method of claim 5 , wherein the security data associates one or more periods of time with the one or more authentication credentials, the method further comprising:
determining an end of a period of time associated with the second authentication credential;
modifying the one or more expected authentication credentials to remove the sec

Assignees

• Amazon Tech Inc
• Amazon Tech Inc

Inventors

• Cheng Yu-Hsiang
• Rao Siddhartha Shankara
• Francis Robert Dale
• Chen Da
• Fei Ruoyu
• Ji Jingyu
• Lake Christopher Chad
• Lau Alan
• Liu Hanyu
• Selvaraj Ajaykumar
• Xu Haifeng

Classifications

• H04L63/0869

  for achieving mutual authentication (cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273) · CPC title

• H04L63/083 Primary

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L63/0876 Primary

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title