Mobile device access to a protected machine
In a first embodiment, the “one tap” operation of this disclosure enables a user having a mobile device “one tap” mobile application (or “app”) to log-in to the user's desktop or laptop computer by bringing the user's device in physical proximity to the computer and, while in such proximity, accepting a push notification that is received on the mobile device. In a second embodiment, the user uses the “one tap” functionality to access a cloud-based account that has been set up for the user on a third party web application (e.g., SalesForce.com). The technique seamlessly integrates with third party websites using well-known protocols (e.g., SAML2), and it enables secure cross-origin resource sharing in a highly secure, reliable and available manner. Still another aspect of this disclosure is an enhanced proximity detection routine that is used to facilitate the one tap function when the user's mobile device is moved into proximity with the computer.
1. A network-based access method operative in association with a first device of a user, and a second device of the user, comprising:
associating, in a data set, information that binds the first device to the second device, and that binds the first device to a credential enabling access by the user to the first device;
upon receipt of an indication that the second device is and remains in current physical proximity to the first device that is presently locked, determining whether the user can be verified, wherein the determination includes causing a notification to be delivered to the second device and evaluating a response to that notification;
following delivery of the notification to the second device, determining whether a verification response to the notification has been received; and
when the verification response to the notification has been received, the verification response having been generated as a result of a valid response to receipt of the notification, providing a verification result to the first device;
wherein receipt of the verification result at the first device unlocks the first device automatically based on the information in the data set;
wherein current physical proximity is determined by the following sub-steps:
determining whether a computed signal strength value is within a given transitional range indicating that presence of the second device is indeterminate;
when it is determined that the computed signal strength value is within the given transitional range, determining whether the computed signal strength value has a given relationship with a prior computed signal strength value, the given relationship indicating a high confidence that the second device was previously in sufficient physical proximity to the first device; and
when the computed signal strength value has the given relationship, accepting the second device as being in current physical proximity to the first device.
2. The method as described in claim 1 wherein the first device is a computer, and the second device is a mobile device.
3. The method as described in claim 2 wherein the mobile device executes a mobile application that facilitates verification of the user.
4. The method as described in claim 3 wherein the notification is a push notification to the mobile application.
5. The method as described in claim 3 wherein the push notification has a timeout associated therewith.
6. The method as described in claim 1 wherein the first device and the second device communicate over a wireless link.
7. The method as described in claim 6 wherein the wireless link is Bluetooth.
8. The method as described in claim 1 further including configuring the first device and the second device to facilitate generation of the data set.
9. The method as described in claim 1 wherein verification response to the notification is received automatically or via a poll.
10. The method as described in claim 1 wherein one or more operations are carried out in an identity provider (IdP).