Methods for managing user access to computing devices based on evaluation of authentication and maintenance of user control
The method disclosed herein provides for performing user authentication and maintaining user authentication and access to a second device based on the user maintaining control of a first device. The user's continued control may be based on determining the user's continued possession of the first device from the authentication to a pairing with the second electronic device which then causes a second security component executing on the second electronic device to change the second electronic device to an unlocked state.
1. A method comprising:
authenticating, by a first computing device, a user;
determining an authentication, by a first security component executing on the first computing device, that the user is authenticated;
determining a pairing, by the first security component, that the first computing device is paired with a second electronic device;
determining, by the first security component, that the user has been in control of the first computing device from the authentication to the pairing with the second electronic device; and
causing, by a second security component executing on the second electronic device, the second electronic device to change to an unlocked state when:
the first security component informs the second security component that the user is authenticated and has been in control of the first computing device from the authentication to the pairing with the second electronic device;
the second security component determines, from interpreting visual data provided by the second electronic device, that the user exceeded a threshold distance from the second electronic device and returned within the threshold distance from the second electronic device after a first period of time; and
the second security component determines, from interpreting the visual data, that the user was in continuous possession of the first electronic device during the first period of time.
2. A method comprising:
authenticating, by a first computing device, a user;
determining an authentication, by a first security component executing on the first computing device, that the user is authenticated;
determining a pairing, by the first security component, that the first computing device is paired with a second electronic device by confirming that the second electronic device has been previously paired with the first computing device;
determining, by the first security component, that the user has been in control of the first computing device based on continued presence data detected by the first security component;
generating a derived credential, by the first security component, in response to the first security component determining that the user is authenticated, that the second electronic device is paired with the first computing device, and that the user has been in control of the first computing device;
transmitting the derived credential to the second electronic device; and
causing the second electronic device to change to an unlocked state without requiring any action by the user.
3. The method of claim 2 , the derived credential comprising at least one of a protected key or a cryptographic proof of knowledge of an authorizing key.
4. The method of claim 2 , the determining that the user has been in control of the first computing device comprising confirming that the user has been in possession of the first computing device via a predetermined possession method selected from the group of: detecting a predetermined interaction with an input device of the first computing device, detecting that the first computing device is in motion, or receiving biometric signals from the user.
5. The method of claim 2 , further comprising:
continuing to monitor, by the first security component, the proximity between the first computing device and the second electronic device after the first computing device enters the locked state;
comparing, by the first security component, subsequent presence data, received from the first computing device after the first computing device enters the locked state, and the continued presence data; and
causing, by the first security component, the first computing device to enter an unlocked state when the proximity is less than the predetermined proximity threshold data and the subsequent presence data is determined to match the continued presence data based on the comparison.
6. The method of claim 2 , the continued presence data including
a notification, from the second electronic device, that interaction is taking place with input devices of the second electronic device.