Service authentication through a voice assistant

1. A system for authenticating a user with a service account through a voice assistant, comprising:

a computer;

a user authentication service that, when executed by the computer, causes the computer to at least:

receive a request to authenticate the user on behalf of the voice assistant;

authenticate the user based upon a user authentication flow in a client application executing on a client device, the user authentication performed based upon user credentials provided by an identity provider service before initiating a voice assistant authentication flow;

extract a device identifier corresponding to the voice assistant from the request;

generate a secret key associated with the request, the secret key being unique to the voice assistant with respect to other voice assistants and being different from the user credentials;

encrypt the secret key;

generate a sound wave in which the encrypted secret key and an identifier corresponding to the device identifier are embedded;

transmit a payload in response to the request to the voice assistant, the payload comprising the sound wave and a command to play the sound wave using the voice assistant;

receive a token and at least a portion of the payload from the client device separate from the voice assistant, the token being associated with the user, wherein the client device obtains the payload by entering a listening mode and extracting the encrypted secret key from the sound wave played back by the voice assistant;

validate the token and the at least a portion of the payload; and

associate the user with the voice assistant in response to performing the user authentication and then validating the token and the at least a portion of the payload.

2. The system of claim 1 , wherein the secret key and the identifier embedded into the sound wave are encrypted using an encryption key that is unavailable to the voice assistant.

3. The system of claim 1 , wherein the token and the at least a portion of the payload are validated by determining whether the user associated with the client device has been authenticated with the identity provider service.

4. The system of claim 1 , wherein the user authentication service, when executed by the computer, causes the computer to at least obtain a single sign-on (SSO) token from the identity provider service.

5. The system of claim 1 , wherein the user authentication service, when executed by the computer, causes the computer to at least:

receive a request for data from a service associated with the user from the voice assistant;

obtain an authentication token for the service from the identity provider service;

obtain the requested data from the service on behalf of the user in response to the request for data, wherein the requested data is obtained using the authentication token; and

cause at least a portion of the data to be played back through the voice assistant.

6. The system of claim 5 , wherein the at least a portion of the data is played back by the voice assistant by generating a text to speech command in an application implemented within a voice assistant service associated with the voice assistant.

7. The system of claim 1 , wherein the user authentication service causes the computer to at least:

receive a command to suspend or terminate the association between the user and the voice assistant from an application executed by the client device; and

suspend or terminate the association between the user and the voice assistant, and reject a subsequent request for data from a service associated with the user.

8. A non-transitory computer-readable medium comprising machine-readable instructions, wherein the instructions, when executed by at least one processor, cause a computing device to at least:

receive a request to authenticate a user on behalf of a voice assistant;

authenticate the user based upon a user authentication flow in a client application executing on a client device, the user authentication performed based upon user credentials provided by an identity provider service before initiating a voice assistant authentication flow;

extract a device identifier corresponding to the voice assistant from the request;

generate a secret key associated with the request, the secret key being unique to the voice assistant with respect to other voice assistants and being different from the user credentials;

encrypt the secret key;

generate a sound wave in which the encrypted secret key and an identifier corresponding to the device identifier are embedded;

transmit a payload in response to the request to the voice assistant, the payload comprising the sound wave and a command to play the sound wave using the voice assistant;

receive a token and at least a portion of the payload from the client device separate from the voice assistant, the token being associated with the user, wherein the client device obtains the payload by entering a listening mode and extracting the encrypted secret key from the sound wave played back by the voice assistant;

validate the token and the at least a portion of the payload; and

associate the user with the voice assistant in response to performing the user authentication and then validating the token and the at least a portion of the payload.

9. The non-transitory computer-readable medium of claim 8 , wherein the secret key and the identifier embedded into the sound wave are encrypted using an encryption key that is unavailable to the voice assistant.

10. The non-transitory computer-readable medium of claim 8 , wherein the token and the at least a portion of the payload are validated by determining whether the user associated with the client device has been authenticated with the identity provider service.

11. The non-transitory computer-readable medium of claim 8 , wherein the instructions, when executed by the at least one processor, cause the computing device to at least obtain a single sign-on (SSO) token from the identity provider service.

12. The non-transitory computer-readable medium of claim 8 , wherein the instructions, when executed by the at least one processor, cause the computing device to at least:

receive a request for data from a service associated with the user from the voice assistant;

obtain an authentication token for the service from the identity provider service;

obtain the requested data from the service on behalf of the user in response to the request for data, wherein the requested data is obtained using the authentication token; and

cause at least a portion of the data to be played back through the voice assistant.

13. The non-transitory computer-readable medium of claim 12 , wherein the at least a portion of the data is played back by the voice assistant by generating a text to speech command in an application implemented within a voice assistant service associated with the voice assistant.

14. The non-transitory computer-readable medium of claim 8 , wherein the instructions, when executed by the at least one processor, cause the computing device to at least:

receive a command to suspend or terminate the association between the user and the voice assistant from an application executed by the client device; and

suspend or terminate the association between the user and the voice assistant, wherein the instructions reject a subsequent request for data from a service associated with the user.

15. A method comprising:

receiving a request to authenticate a user on behalf of a voice assistant;

authenticating the user based upon a user authentication flow in a client application executing on a client device, the user authentication performed based upon user credentials provided by an identity provider service before initiating a voice assistant authentication flow;

extracting a device identifier corresponding to the voice assistant from the request;

generating a secret key associated with the request, the secret key being unique to the voice assistant with respect to other voice assistants and being different from the user credentials;

encrypting the secret key;

generating a sound wave in which the encrypted secret key and an identifier corresponding to the device identifier are embedded;

transmitting a payload in response to the request to the voice assistant, the payload comprising the sound wave and a command to play the sound wave using the voice assistant;

receiving a token and at least a portion of the payload from the client device separate from the voice assistant, the token being associated with the user, wherein the client device obtains the payload by entering a listening mode and extracting the encrypted secret key from the sound wave played back by the voice assistant;

validating the token and the at least a portion of the payload; and

associating the user with the voice assistant in response to performing the user authentication and then validating the token and the at least a portion of the payload.

16. The method of claim 15 , wherein the secret key and the identifier embedded into the sound wave are encrypted using an encryption key that is unavailable to the voice assistant.

17. The method of claim 15 , wherein the token and the at least a portion of the payload are validated by determining whether the user associated with the client device has been authenticated with the identity provider service.

18. The method of claim 15 , further comprising obtaining a single sign-on (SSO) token from the identity provider service.

19. The method of claim 15 , further comprising:

receiving a request for data from a service associated with the user from the voice assistant;

obtaining an authentication token for the service from the identity provider service;

obtaining the requested data from the service on behalf of the user in response to the request for data, wherein the requested data is obtained using the authentication token; and

causing at least a portion of the data to be played back through the voice assistant.

20. The method of claim 15 , further comprising:

receive a command to suspend or terminate the association between the user and the voice assistant from an application executed by the client device; and

suspend or terminate the association between the user and the voice assistant, and reject a subsequent request for data from a service associated with the user.