Granted Patent B1

US 10,657,242 · App. 15/954,100 · Granted May 19, 2020

Inventors: Feng Xia (Vienna, VA); Siamak Ziraknejad (Reston, VA); Liang Chen (Fairfax, VA); Quan Jia (Oakton, VA)

Assignee: MicroStrategy Incorporated

G06F21/35H04L9/3226H04L63/083H04L63/0853H04W12/08G06F2221/2111

Abstract

Claims (55)

1. A method performed by a computing device, the method comprising:

detecting, by the computing device, an attempt to access the computing device while the computing device is in a secured state;

in response to detecting the attempt to access the computing device, sending, by the computing device, a first message to a server system over a network;

after sending the first message, receiving, by the computing device, a second message from the server system over the network, the second message comprising authentication data transmitted to the server system by a mobile device that was previously designated as an authentication factor for accessing the computing device, wherein the authentication data is transmitted by the mobile device after the computing device sent the first message to the server system, and wherein the authentication data demonstrates authorization to access the computing device;

determining, by the computing device, that the mobile device that was previously designated as an authentication factor for accessing the computing device is located within a predetermined level of proximity of the computing device; and

in response to determining that the computing device is located within the predetermined level of proximity of the computing device, and based on the received authentication data, granting, by the computing device, access to the computing device.

2. The method of claim 1 , further comprising determining, by the computing device, a password from the authentication data in the second message;

wherein granting access to the computing device comprises providing the password to an operating system of the computing device.

3. The method of claim 1 , wherein the computing device receives the second message before determining that the computing device is located within the predetermined level of proximity of the computing device; and

wherein the method further comprises delaying granting access to the computing device until after determining that the computing device is located within the predetermined level of proximity of the computing device.

4. The method of claim 1 , wherein determining, by the computing device, that the mobile device that was previously designated as an authentication factor for accessing the computing device is located within the predetermined level of proximity of the computing device comprises:

determining that the mobile device that is located within the predetermined level of proximity is the same mobile device that transmitted, to the server system, the authentication data that the server system sent to the computing device.

5. The method of claim 1 , further comprising determining, by the computing device, that detection of the presence of the mobile device within the predetermined level of proximity of the computing device occurs within a predetermined time period from transmission of the first message or receipt of the authentication data;

wherein access to the computing device is granted based on the determination that detection of the presence of the mobile device within the predetermined level of proximity of the computing device occurs within the predetermined time period of the transmission of the first message or the receipt of the authentication data.

6. The method of claim 1 , wherein determining that the mobile device that was previously designated as an authentication factor for accessing the computing device is located within the predetermined level of proximity of the computing device comprises:

receiving, by the computing device, a third message from the mobile device over a direct, wireless radio-frequency communication channel;

determining, by the computing device, that a signal strength with which the third message was received satisfies a signal strength threshold; and

determining, by the computing device, that the third message includes a device identifier for the mobile device that matches a device identifier for a mobile device previously registered with the computing device as an authentication token for accessing the computing device.

7. The method of claim 1 , wherein receiving data indicating an attempt to access the computing device while the computing device is in a secured state comprises receiving data indicating that the computing device has been powered on, woken from a low-power state, or received user input from a locked state.

8. The method of claim 1 , wherein granting access to the computing device comprises unlocking the computing device.

9. The method of claim 1 , receiving, by the computing device, a second message from the server system over the network comprises receiving encrypted data in the second message, wherein the encrypted data was generated by the mobile device and comprises an encrypted form of a password;

wherein the method further comprises decrypting the password; and

wherein granting access to the computing device comprises providing the password to software executing on the computing device to enable access to the computing device.

10. The method of claim 9 , wherein decrypting the password and providing the password are performed by an agent executing on the computing device along with an operating system of the computing device, the agent having permission to provide passwords to the operating system of the computing device; and

wherein providing the password to software executing on the computing device to enable access to the computing device comprises passing, by the agent executing on the computing device, the password to the operating system of the computing device.

11. The method of claim 1 , wherein determining that the mobile device that was previously designated as an authentication factor for accessing the computing device is located within the predetermined level of proximity of the computing device comprises receiving a communication from the mobile device over a direct wireless communication link.

12. The method of claim 11 , wherein the direct wireless communication link is a Bluetooth communication link, and wherein determining that the mobile device that was previously designated as an authentication factor for accessing the computing device is located within the predetermined level of proximity of the computing device comprises determining that the mobile device has previously been paired with the computing device over the Bluetooth communication link.

13. The method of claim 1 , wherein determining that the mobile device that was previously designated as an authentication factor for accessing the computing device is located within the predetermined level of proximity of the computing device comprises:

communicating by the computing device with the mobile device using a link key established during pairing of the mobile device with the computing device using hardware-level Bluetooth pairing managed by an operating system of the computing device.

14. The method of claim 1 , wherein granting access to the computing device comprises unlocking a user interface of the computing device, initiating a new user session on the computing device, resuming an existing user session on the computing device, authenticating a user to the computing device, or logging a user into a user account.

15. The method of claim 1 , wherein granting access to the computing device comprises providing a user access to a user interface of the computing device that was unavailable prior to authentication of the user, the access being provided without user input being entered to the computing device or the mobile device between detecting the attempt to access the computing device and providing access to the user interface.

16. The method of claim 1 , further comprising:

in response to receiving the message from the mobile device, determining a signal strength of a wireless connection between the computing device and the mobile device; and

determining that the signal strength satisfies a threshold level, wherein the threshold level corresponds to sufficient proximity to allow access to the computing device based on proximity of the mobile device;

wherein granting access to the computing device is based at least in part on determining that the signal strength satisfies the threshold level.

17. The method of claim 16 , further comprising:

in response to receiving a wireless message from the mobile device, identifying, based on the wireless message, the mobile device or a user associated with the mobile device; and

accessing data indicating a signal strength threshold designated for the mobile device or a user associated with the mobile device, wherein the signal strength threshold indicates a signal strength that represents a user-selected level of proximity for providing access to the computing device;

wherein determining that the signal strength satisfies the threshold level comprises determining that the signal strength satisfies the signal strength threshold.

18. The method of claim 1 , wherein the authentication data comprises an encrypted password that was encrypted using a public key of the computing device; and

wherein the method comprises decrypting the encrypted password using a private key of the computing device that is stored at the computing device.

19. A computing device comprising:

one or more processors; and

one or more computer-readable media storing instructions that, when executed by the one or more processors, cause the computing device to perform operations comprising:

detecting, by the computing device, an attempt to access the computing device while the computing device is in a secured state;

in response to detecting the attempt to access the computing device, sending, by the computing device, a first message to a server system over a network;

after sending the first message, receiving, by the computing device, a second message from the server system over the network, the second message comprising authentication data transmitted to the server system by a mobile device that was previously designated as an authentication factor for accessing the computing device, wherein the authentication data is transmitted by the mobile device after the computing device sent the first message to the server system, and wherein the authentication data demonstrates authorization to access the computing device;

determining, by the computing device, that the mobile device that was previously designated as an authentication factor for accessing the computing device is located within a predetermined level of proximity of the computing device; and

in response to determining that the computing device is located within the predetermined level of proximity of the computing device, and based on the received authentication data, granting, by the computing device, access to the computing device.

20. One or more non-transitory computer-readable media storing instructions that, when executed by a computing device, cause the computing device to perform operations comprising:

detecting, by the computing device, an attempt to access the computing device while the computing device is in a secured state;

in response to detecting the attempt to access the computing device, sending, by the computing device, a first message to a server system over a network;

after sending the first message, receiving, by the computing device, a second message from the server system over the network, the second message comprising authentication data transmitted to the server system by a mobile device that was previously designated as an authentication factor for accessing the computing device, wherein the authentication data is transmitted by the mobile device after the computing device sent the first message to the server system, and wherein the authentication data demonstrates authorization to access the computing device;

determining, by the computing device, that the mobile device that was previously designated as an authentication factor for accessing the computing device is located within a predetermined level of proximity of the computing device; and

in response to determining that the computing device is located within the predetermined level of proximity of the computing device, and based on the received authentication data, granting, by the computing device, access to the computing device.

Assignments (4)

Continuity (2)

Cited By (9)

US 12,212,564 US 12,273,340 US 12,356,184 US 12,375,916 US 12,401,638 US 12,439,253 US 12,477,469 US 12,598,180 US 12,701,115